Oracle Linux 10 – nftables custom rules conflict with firewalld policies – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Traffic is intermittently blocked because manual nftables rules override expected firewalld behavior.

Environment & Reproduction

Occurs on systems where both direct nft scripts and firewalld are used.

systemctl status firewalld
nft list ruleset

Root Cause Analysis

Competing firewall management layers introduce conflicting chains and priorities.

Quick Triage

Map active chains and identify duplicate policy logic.

firewall-cmd --list-all
nft list ruleset | less

Step-by-Step Diagnosis

Trace packet path with rule counters and logs.

nft -a list ruleset
journalctl -u firewalld -n 100

Solution – Primary Fix

Consolidate policy under firewalld and remove unmanaged nft rules.

sudo systemctl stop nftables
sudo systemctl disable nftables
sudo firewall-cmd --reload

Solution – Alternative Approaches

If raw nftables is required, disable firewalld and manage complete ruleset declaratively.

Verification & Acceptance Criteria

Policy behavior is consistent and expected ports are reachable.

firewall-cmd --state
firewall-cmd --list-all

Rollback Plan

Restore saved nftables ruleset if service migration fails.

Prevention & Hardening

Use one firewall authority per host and enforce with baseline checks.

Related Errors & Cross-Refs

Can appear alongside container network policy conflicts and duplicated MASQUERADE rules.

Related tutorial: View the step-by-step tutorial for oracle-linux-10.

View all oracle-linux-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL networking security stack documentation for firewalld and nftables.