CentOS Stream 10 – Common Problem 228 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Rich rules accepted at runtime are lost after firewall-cmd reload or system reboot.

Environment & Reproduction

Common when administrators add rules without the –permanent flag or edit zones manually.

Root Cause Analysis

Runtime configuration lives only in memory; without –permanent it never reaches the on-disk zone XML.

Quick Triage

Compare runtime and permanent state with firewall-cmd –list-all and –permanent –list-all.

Step-by-Step Diagnosis

Run: sudo firewall-cmd –list-all; sudo firewall-cmd –permanent –list-all; diff outputs.

Solution – Primary Fix

Run: sudo firewall-cmd –permanent –add-rich-rule=’…’; sudo firewall-cmd –reload.

Solution – Alternative Approaches

Use firewalld direct interface or nftables backend rules for advanced cases, but document carefully.

Verification & Acceptance Criteria

Rule survives firewall-cmd –reload and a full reboot, visible in –permanent –list-rich-rules.

Rollback Plan

Edit /etc/firewalld/zones backups or remove the rule with –permanent –remove-rich-rule.

Prevention & Hardening

Adopt a configuration management module (Ansible firewalld) to enforce persistent rules.

Related Errors & Cross-Refs

Related to zone misassignment, masquerade gaps, and ICMP block-inversion problems.

Related tutorial: View the step-by-step tutorial for centos-stream-10.

View all centos-stream-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

firewalld.richlanguage(5) and Red Hat networking security guide.