nftables and firewalld Rule Conflict on RHEL 9

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Traffic behavior is inconsistent because manual nft rules and firewalld managed rules overlap.

Environment & Reproduction

Run nft list ruleset and firewall-cmd –list-all –zone= to compare active policy layers.

Root Cause Analysis

Both direct nftables edits and firewalld runtime/permanent rules are used without coordination.

Quick Triage

Choose one management approach, migrate custom rules to firewalld direct/rich rules, then reload cleanly.

Step-by-Step Diagnosis

Capture full nft ruleset and firewalld state before consolidating policies.

Solution – Primary Fix

After consolidation, packet filtering is predictable and rule inspection matches policy design.

Solution – Alternative Approaches

Run connectivity tests and re-check nft list ruleset after firewalld reload operations.

Verification & Acceptance Criteria

Document firewall ownership and prohibit unmanaged direct nft changes on managed hosts.

Rollback Plan

Restore saved ruleset and zone config backups if migration introduces service impact.

Prevention & Hardening

Deploy firewall policy from source control with a single toolchain across environments.

Related Errors & Cross-Refs

Use journalctl -u firewalld and packet logs for rule hit diagnostics.

Related tutorial: View the step-by-step tutorial for rhel-9.

View all rhel-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Provide prior and current rulesets, expected flows, and failed connection examples.