Application port blocked by firewalld – RHEL 7 Post 007

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Service listens locally but clients cannot connect from network segments that should be allowed.

Environment & Reproduction

RHEL 7 host with firewalld running; connection tests to app TCP port time out.

Root Cause Analysis

Port not added to active zone, wrong interface-zone mapping, or rule not persisted.

Quick Triage

Run firewall-cmd –get-active-zones and ss -lntp to confirm listener and zone mismatch.

Step-by-Step Diagnosis

Inspect runtime and permanent rules, check rich rules, and verify with journalctl -u firewalld.

Solution – Primary Fix

Add required port/service to correct zone with –permanent and reload firewalld safely.

Solution – Alternative Approaches

Use predefined service XML profile or iptables direct rules when strict policy requires.

Verification & Acceptance Criteria

Remote nc or curl succeeds and firewall-cmd –list-all shows expected persistent rules.

Rollback Plan

Remove newly added rule and reload firewalld to restore previous network policy.

Prevention & Hardening

Treat firewall changes as code and validate with automated reachability checks.

Related Errors & Cross-Refs

Connection timed out, No route to host, service unavailable only from remote clients.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

firewall-cmd man page, RHEL 7 firewalld guide, zone design best practices.