CentOS Stream 10 – Common Problem 055 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Service ports become unreachable after a network interface change despite open rules.

Environment & Reproduction

Occurs when NetworkManager moves an interface between zones without updating rules.

Root Cause Analysis

Active zone for the interface differs from the zone where the rule was added.

Quick Triage

Use `firewall-cmd –get-active-zones` to map interfaces to current zones.

Step-by-Step Diagnosis

Compare zone assignment to expected rule scope.

Solution – Primary Fix

Move the interface back with `firewall-cmd –zone=public –change-interface=ens3 –permanent` and reload.

Solution – Alternative Approaches

Add the rule to all relevant zones if multiple interface paths exist.

Verification & Acceptance Criteria

`firewall-cmd –list-all-zones` shows the port open under the correct active zone.

Rollback Plan

Restore prior zone bindings with the previous configuration backup.

Prevention & Hardening

Pin interface to zone in the NetworkManager profile to prevent drift.

Related Errors & Cross-Refs

Common alongside NetworkManager profile churn and policy-routing failures.

Related tutorial: View the step-by-step tutorial for centos-stream-10.

View all centos-stream-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

firewalld and NetworkManager integration documentation.