Service Is Running But Not Reachable Through firewalld

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Application listens locally but remote clients time out or connection is refused.

Environment & Reproduction

firewalld zone assignment or allowed services/ports do not match interface traffic.

Root Cause Analysis

Run ss -tulpen and verify the daemon listens on the expected address and port.

Quick Triage

Run firewall-cmd –get-active-zones and map interfaces to their zones.

Step-by-Step Diagnosis

Run firewall-cmd –zone= –add-service= –permanent as needed.

Solution – Primary Fix

Apply changes with firewall-cmd –reload and validate with firewall-cmd –list-all.

Solution – Alternative Approaches

Review firewall-cmd –list-rich-rules for any deny logic overriding access.

Verification & Acceptance Criteria

If nonstandard port is used, map it with semanage port -a and correct type.

Rollback Plan

Use nc or curl from remote hosts and verify packets reach the service.

Prevention & Hardening

Users perceive outage although service process is healthy on the server.

Related Errors & Cross-Refs

Open only required ports and restrict source ranges via rich rules.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Include firewalld verification in deployment scripts and post-change checks.