Nftables Rules Conflict With Firewalld Runtime State

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Network behavior is inconsistent because direct nft rules and firewalld both modify tables.

Environment & Reproduction

Run `firewall-cmd –state` and `nft list ruleset` to confirm overlapping rule ownership.

Root Cause Analysis

Verify `firewalld`, `nftables`, and related scripts are intentionally deployed.

Quick Triage

Inspect `systemctl status firewalld nftables` and startup order interactions.

Step-by-Step Diagnosis

Review `journalctl -u firewalld -u nftables` for reload failures and table conflicts.

Solution – Primary Fix

Export firewalld zones and save nftables config before consolidating policy.

Solution – Alternative Approaches

Choose a single source of truth, usually firewalld on RHEL 9, and remove conflicting direct rules.

Verification & Acceptance Criteria

Confirm custom script contexts if startup units apply rules from nonstandard paths.

Rollback Plan

Disable redundant service, migrate required rules, reload chosen firewall manager.

Prevention & Hardening

Test expected connectivity matrix and verify rules persist across reboot.

Related Errors & Cross-Refs

Enforce firewall ownership policy in IaC and compliance audits.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Provide full ruleset dumps and service logs before and after consolidation.