RHEL 9 firewalld blocks expected application traffic

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Clients cannot connect to a service even though the process is running on RHEL 9.

Environment & Reproduction

Connection timeout, refused packets in certain zones, or inconsistent behavior across interfaces.

Root Cause Analysis

Wrong zone assignment, missing permanent rule, rich rule mismatch, or source restrictions.

Quick Triage

Run firewall-cmd –get-active-zones and firewall-cmd –list-all for each active zone.

Step-by-Step Diagnosis

Confirm production NICs are in intended zones and not defaulting to public unexpectedly.

Solution – Primary Fix

Use firewall-cmd –add-service or –add-port with –permanent, then reload policy.

Solution – Alternative Approaches

Check rich rules and source blocks that may override basic allow rules.

Verification & Acceptance Criteria

Ensure temporary runtime changes are committed as permanent where needed.

Rollback Plan

Confirm service binds to correct address and SELinux port types are appropriate.

Prevention & Hardening

Use journalctl -u firewalld and packet capture tools for stubborn filtering issues.

Related Errors & Cross-Refs

Template zone policy through automation and validate firewall state after deployments.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Test inbound access from expected networks and verify with firewall-cmd –list-all-zones.