RHEL 7 – firewalld Runtime Rules Disappear After Restart

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Application access works temporarily, then fails after firewalld reload or host reboot.

Environment & Reproduction

Rules were added without –permanent or added to the wrong active zone.

Root Cause Analysis

Runtime and permanent configuration differ, and restart discards runtime-only changes.

Quick Triage

Compare firewall-cmd –list-all with firewall-cmd –permanent –list-all output.

Step-by-Step Diagnosis

Confirm active zone per interface and review firewalld restart messages in journalctl.

Solution – Primary Fix

Re-add required ports/services with –permanent and execute firewall-cmd –reload.

Solution – Alternative Approaches

Deploy direct rules when zone logic does not satisfy strict segmentation requirements.

Verification & Acceptance Criteria

Rules remain after restart and connectivity tests pass from approved source networks.

Rollback Plan

Remove permanent rules if exposure exceeds approved policy boundaries.

Prevention & Hardening

Manage firewalld with IaC and audit permanent/runtime drift continuously.

Related Errors & Cross-Refs

Port appears open then closes after reload, zone mismatch, dropped packets.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL 7 firewalld zone model, persistence behavior, and hardening practices.