RHEL 10 – nftables and firewalld Policy Conflict Breaks Traffic – Unified Rule Strategy

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Expected firewall openings do not work due to overlapping rule managers.

Environment & Reproduction

Hosts using manual nft rules while firewalld also manages nftables backend.

systemctl is-active firewalld
nft list ruleset | head -n 80

Root Cause Analysis

Rules applied outside firewalld are overwritten or conflict with zone chains.

Quick Triage

Locate rule ownership and active chain order.

firewall-cmd --list-all-zones
nft list ruleset | grep -E 'hook input|policy'

Step-by-Step Diagnosis

Map dropped packets to chain and policy source.

journalctl -k -n 200 --no-pager
firewall-cmd --direct --get-all-rules

Solution – Primary Fix

Consolidate rules into firewalld permanent configuration and remove unmanaged nft snippets.

firewall-cmd --permanent --zone=public --add-service=http
firewall-cmd --reload
rm -f /etc/nftables/conf.d/custom.conf

Solution – Alternative Approaches

Disable firewalld only if organization standardizes fully on static nftables management.

systemctl disable --now firewalld

Verification & Acceptance Criteria

Traffic policy behaves as expected after reload and reboot.

firewall-cmd --list-all
nft list ruleset | head -n 120

Rollback Plan

Reapply backup nft ruleset if service outage persists after consolidation.

nft -f /root/nftables.backup.conf

Prevention & Hardening

Define single firewall authority per host role.

systemctl status firewalld
firewall-cmd --state

Related Errors & Cross-Refs

Unexpected drop in input chain, direct rule precedence confusion.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

firewalld with nftables backend architecture.