RHEL 10 Firewalld Blocks Application Port Despite Service Running

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Local service is active but remote clients cannot connect to required TCP/UDP port.

Environment & Reproduction

Frequently occurs after zone changes or host moved to a different network interface.

systemctl status firewalld ; sudo firewall-cmd --get-active-zones

Root Cause Analysis

Port or service is not allowed in the active zone, or runtime and permanent rules diverge.

Quick Triage

Confirm listening socket, active zone, and effective firewalld rules.

ss -tulpen | grep :8080 ; sudo firewall-cmd --list-all ; sudo journalctl -u firewalld -n 50

Step-by-Step Diagnosis

Map interface to zone and verify whether port is present in runtime and permanent configs.

nmcli -t -f DEVICE,CONNECTION device ; sudo firewall-cmd --zone=public --list-ports ; sudo firewall-cmd --runtime-to-permanent --check

Solution — Primary Fix

Add required port/service to the correct zone and reload firewalld.

sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent ; sudo firewall-cmd --reload ; sudo firewall-cmd --zone=public --list-ports

Solution — Alternative Approaches

Use predefined service XML or rich rules for source-restricted access.

Verification & Acceptance Criteria

Remote connectivity test succeeds and rules persist after reboot.

nc -zv  8080 ; sudo firewall-cmd --zone=public --list-ports ; systemctl is-enabled firewalld

Rollback Plan

Remove temporary broad port rules and restore least-privilege firewall policy.

sudo firewall-cmd --zone=public --remove-port=8080/tcp --permanent ; sudo firewall-cmd --reload

Prevention & Hardening

Manage firewalld policy as code and validate after every interface or zone change.

Related Errors & Cross-Refs

Similar symptoms can come from SELinux port labeling or upstream network ACLs.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL firewalld administration docs and zone design recommendations.