RHEL 8 – firewalld Runtime Rules Lost After Reload

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Application ports close after firewalld reload, causing intermittent service outages.

Environment & Reproduction

Rules were added without –permanent or assigned to a non-active zone.

Root Cause Analysis

Runtime and permanent firewalld configurations drift and reload discards runtime-only changes.

Quick Triage

Compare firewall-cmd –list-all against firewall-cmd –permanent –list-all for active zone.

Step-by-Step Diagnosis

Confirm zone binding for interfaces and review firewalld service events in journalctl.

Solution – Primary Fix

Add required service and port rules with –permanent and run firewall-cmd –reload.

Solution – Alternative Approaches

Use rich rules for source-based access controls where service-based rules are insufficient.

Verification & Acceptance Criteria

Rules persist across reload and reboot, and endpoint tests pass from expected networks.

Rollback Plan

Remove newly added permanent rules if they violate approved segmentation policy.

Prevention & Hardening

Manage firewalld state with automation and continuously audit zone-policy drift.

Related Errors & Cross-Refs

Connection refused after reload, packet drops in default zone, missing service definitions.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

RHEL 8 firewalld zones, permanent/runtime model, and rich rule documentation.