RHEL 7 firewalld Blocking Internal Application Port

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Clients cannot reach the application despite the process running. systemctl shows service active, but traffic fails and journalctl reports denied or dropped packets.

Environment & Reproduction

The issue appears on hosts where firewalld zone assignment changed or interface mapping is wrong. SELinux and service policies can compound the failure pattern.

Root Cause Analysis

Most cases are missing port/service definitions in the active zone, runtime-only changes not made permanent, or incorrect source zone rules. yum updates may also reset assumptions in playbooks.

Quick Triage

Check firewall-cmd –get-active-zones and –list-all, then systemctl status firewalld and application service status. Review journalctl and confirm SELinux mode and AVC logs.

Step-by-Step Diagnosis

Map interfaces to zones, validate expected port/protocol, test from trusted and untrusted subnets, and compare runtime versus permanent firewalld config.

Solution – Primary Fix

Add the required service or port in the correct zone with –permanent, reload firewalld, and retest. Confirm SELinux allows bind/connect behavior and restart application service through systemctl.

Solution – Alternative Approaches

Use rich rules for source-limited access, temporary maintenance windows with controlled open ports, or centralized policy via configuration management.

Verification & Acceptance Criteria

Connectivity succeeds from approved networks, service is active, and journalctl contains no recurring drop messages. firewalld runtime and permanent states match.

Rollback Plan

Remove newly added rules, reload firewalld, and restore prior zone mapping. If needed, rollback service deployment and yum transaction changes.

Prevention & Hardening

Codify firewalld zone and rule intent, monitor drift, and validate with automated probes. Keep SELinux enforcing and review service labels after deployments.

Related Errors & Cross-Refs

Related errors include wrong zone target, DNAT issues, and policy ordering mistakes. See linked tutorial 9053 for durable firewalld operations.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Use man firewall-cmd, man firewalld.zone, man systemctl, man service, man selinux, man yum, and man journalctl.