RHEL 10 – firewalld default zone blocking application port access – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Service is running locally but remote clients cannot connect to required ports.

Environment & Reproduction

Common when interfaces are attached to unexpected zones during provisioning.

systemctl status firewalld
firewall-cmd --get-active-zones
ss -tulpn | grep 8443

Root Cause Analysis

Missing permanent rules, wrong zone assignment, or runtime-only changes lost after reboot.

Quick Triage

Compare runtime and permanent rules for the target service.

firewall-cmd --list-all
firewall-cmd --runtime-to-permanent --check || true
journalctl -u firewalld -n 50

Step-by-Step Diagnosis

Identify active zone for interface and required service/port mappings.

nmcli -t -f DEVICE,CONNECTION device
firewall-cmd --zone=public --list-ports
firewall-cmd --zone=public --list-services

Solution – Primary Fix

Add permanent rule and reload firewalld.

firewall-cmd --zone=public --add-port=8443/tcp --permanent
firewall-cmd --reload
firewall-cmd --zone=public --query-port=8443/tcp

Solution – Alternative Approaches

Define a custom service and attach interfaces to dedicated zone.

firewall-cmd --permanent --new-service=myapp
firewall-cmd --permanent --service=myapp --add-port=8443/tcp
firewall-cmd --zone=internal --change-interface=eth0 --permanent
firewall-cmd --reload

Verification & Acceptance Criteria

Remote connection succeeds and rule persists across reboot.

nc -zv localhost 8443
firewall-cmd --list-all
systemctl reboot

Rollback Plan

Remove added rules if exposure is broader than intended.

firewall-cmd --zone=public --remove-port=8443/tcp --permanent
firewall-cmd --reload

Prevention & Hardening

Standardize zone mapping and review firewall policy in change approvals.

firewall-cmd --get-default-zone
firewall-cmd --permanent --list-all-zones

Related Errors & Cross-Refs

Correlates with SELinux port labeling and reverse-proxy misbinding.

Related tutorial: View the step-by-step tutorial for rhel-10.

View all rhel-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL firewalld zone management and service policy documentation.