firewalld Runtime Rules Lost After Reboot

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Network access works temporarily but breaks after reboot because rules were runtime-only.

Environment & Reproduction

firewall-cmd output differs before and after reboot, and app service becomes unreachable.

Root Cause Analysis

Rules were added without –permanent or configuration was not reloaded correctly.

Quick Triage

Compare runtime and permanent state and verify firewalld enablement.

Step-by-Step Diagnosis

Run firewall-cmd –list-all, –permanent –list-all, systemctl status firewalld, and journalctl -u firewalld.

Solution – Primary Fix

Reapply required service and port rules with –permanent, reload firewalld, and verify service listeners remain reachable.

Solution – Alternative Approaches

Rules persist across reboot and connectivity remains stable.

Verification & Acceptance Criteria

Remove unintended permanent rules if they violate network policy.

Rollback Plan

Always script firewalld changes as permanent plus explicit reload.

Prevention & Hardening

Run boot-time compliance checks for required firewalld rules.

Related Errors & Cross-Refs

Runtime/permanent split is a common source of confusion in operations.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Escalate if host policy must be aligned with external firewall governance.