RHEL 8 nftables and firewalld Rules Conflict After Manual Changes

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Traffic behavior is inconsistent because manual nftables changes conflict with firewalld-managed state. Some connections pass unexpectedly while others are dropped without clear policy intent.

Environment & Reproduction

Occurs on RHEL 8 systems where administrators mix direct nft commands with zone policy via firewalld. Reproduce by applying out-of-band nft rules and reloading firewalld.

Root Cause Analysis

firewalld expects ownership of active ruleset composition; direct nft mutations drift from declared policy and are overwritten or merged unpredictably across reloads.

Quick Triage

Check firewall-cmd –list-all-zones, nft list ruleset, systemctl status firewalld, and journalctl -u firewalld to identify source-of-truth mismatch.

Step-by-Step Diagnosis

Diff runtime nft rules against firewalld configuration, map conflicting chains, and trace packet path to confirm which rule actually decides traffic outcome.

Solution – Primary Fix

Remove manual nft drift, reapply policy through firewalld only, reload configuration, and retest connectivity from approved and denied source segments.

Solution – Alternative Approaches

If direct nft management is required, disable firewalld ownership in controlled designs and document a single policy authority model.

Verification & Acceptance Criteria

nft ruleset matches declared firewalld policy, expected traffic matrix passes, and journalctl shows clean reloads without rule reconciliation warnings.

Rollback Plan

Restore prior known-good firewalld backup, flush conflicting manual chains, and revert to approved baseline ruleset.

Prevention & Hardening

Ban ad-hoc firewall edits on production, enforce policy as code, and audit rule ownership drift during routine compliance scans.

Related Errors & Cross-Refs

Cross-reference blocked application ports, zone-interface mismatches, and container network egress policies that rely on consistent host firewall behavior.

Related tutorial: View the step-by-step tutorial for rhel-8.

View all rhel-8 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

firewalld and nft man pages, Red Hat network security guidance, and journalctl documentation for firewall event analysis.