CentOS Stream 10 – Common Problem 121 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Custom iptables rules vanish after firewalld reload.

Environment & Reproduction

Common when migrating from iptables backend to nftables on CentOS Stream 10.

Root Cause Analysis

Direct iptables rules are not preserved by nftables backend.

Quick Triage

Verify backend with firewall-cmd –state and firewall-cmd –get-default-zone.

Step-by-Step Diagnosis

Check /etc/firewalld/firewalld.conf FirewallBackend setting.

Solution – Primary Fix

Convert direct rules to rich rules or native nftables policy objects.

Solution – Alternative Approaches

Switch FirewallBackend=iptables temporarily during migration window.

Verification & Acceptance Criteria

Policy survives reload and active connections continue to work.

Rollback Plan

Restore iptables backend via firewalld config and reload.

Prevention & Hardening

Plan migration in maintenance window with rule replay testing.

Related Errors & Cross-Refs

Linked to direct rule deprecation and policy objects.

Related tutorial: View the step-by-step tutorial for centos-stream-10.

View all centos-stream-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

firewalld.direct and firewalld.policies manuals.