📖 ~1 min read
Table of contents
Symptom & Impact
Application remains unreachable externally even after adding a port or service via firewall-cmd.
Environment & Reproduction
RHEL 8 with firewalld and one or more network interfaces mapped to non-default zones.
Root Cause Analysis
Rule is applied to a different zone than the interface source, or rule is runtime-only and lost after reload/reboot.
Quick Triage
Check firewall-cmd –get-active-zones, firewall-cmd –zone= –list-all, and ss -lntup for listening service.
Step-by-Step Diagnosis
Use journalctl -u firewalld and packet testing from a remote host to confirm drop behavior.
Solution – Primary Fix
Add rule to active zone with –permanent, then firewall-cmd –reload. Example: firewall-cmd –zone=public –add-port=8443/tcp –permanent.
Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.
Solution – Alternative Approaches
Validate with firewall-cmd –list-ports and external nc -zv or curl tests to the target host and port.
Verification & Acceptance Criteria
Remove incorrect rules and restore baseline firewall configuration from documented policy set.
Rollback Plan
Standardize zone mapping per interface and enforce firewall definitions with infrastructure-as-code.
Prevention & Hardening
Only open minimum required ports and scope source CIDRs where possible using rich rules.
Related Errors & Cross-Refs
Run periodic compliance checks comparing firewall-cmd –runtime-to-permanent output against approved manifests.
Related tutorial: View the step-by-step tutorial for rhel-8.
View all rhel-8 tutorials on the Tutorials Hub →
Browse all common problems & solutions on the Tutorials Hub.
References & Further Reading
firewall-cmd(1), firewalld zones concept docs, and RHEL 8 security hardening guidance.
Need Expert Help?
If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.
