firewalld Not Running and Ports Stay Closed

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Required application ports are unreachable because firewalld is inactive or misconfigured.

Environment & Reproduction

Connection timeouts occur even though application service appears started.

Root Cause Analysis

firewalld may be disabled, zones may be wrong, or older iptables service rules conflict.

Quick Triage

Check active zone, default zone, and whether the app service binds to the expected port.

Step-by-Step Diagnosis

Run systemctl status firewalld, firewall-cmd –list-all, ss -tulpn, and journalctl -u firewalld.

Solution – Primary Fix

Start and enable firewalld with systemctl, add permanent service or port rules, reload, and retest connectivity.

Solution – Alternative Approaches

Remote connection succeeds and firewall-cmd shows expected rules.

Verification & Acceptance Criteria

Remove the new permanent rule if it opens unintended exposure.

Rollback Plan

Template firewalld zones and keep service definitions under version control.

Prevention & Hardening

Use Ansible firewalld modules to enforce approved port and service policy.

Related Errors & Cross-Refs

RHEL 7 commonly runs firewalld; mixing direct iptables edits can create drift.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Escalate for edge firewall path issues beyond the host-level firewalld scope.