Firewalld Blocking New Application Port on RHEL 9

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Service is running but remote clients cannot connect to the new port.

Environment & Reproduction

Check systemctl status firewalld and firewall-cmd –get-active-zones.

Root Cause Analysis

Test local curl or nc first, then remote connectivity from another host.

Quick Triage

Port not opened in the active zone or added only to runtime config.

Step-by-Step Diagnosis

Add port to the correct zone with firewall-cmd –permanent –add-port.

Solution – Primary Fix

Reload firewalld and confirm with firewall-cmd –list-ports.

Solution – Alternative Approaches

Verify application listens on expected interface using ss -tulpn.

Verification & Acceptance Criteria

Check cloud security groups and upstream ACLs in addition to firewalld.

Rollback Plan

If nonstandard port type is used, map it with semanage port if needed.

Prevention & Hardening

Review journalctl -u firewalld for reload or zone assignment warnings.

Related Errors & Cross-Refs

Store firewall rules in infrastructure code and verify after deploy.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Remove erroneous rule with firewall-cmd –permanent –remove-port and reload.