CentOS Stream 9 – Common Problem 241 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

firewalld rule order ignored

Environment & Reproduction

Multiple rich rules collide due to default priority 0 on CS9.

Root Cause Analysis

Without explicit priority, rich rule evaluation order is undefined.

Quick Triage

firewall-cmd –list-rich-rules in the affected zone.

Step-by-Step Diagnosis

Run: sudo firewall-cmd –get-active-zones; sudo firewall-cmd –info-zone=public.

Solution – Primary Fix

Recreate rules with priority: firewall-cmd –add-rich-rule=’rule priority=-10 … reject’.

Solution – Alternative Approaches

Replace rich rules with nftables direct chain for advanced ordering.

Verification & Acceptance Criteria

Traffic now hits the intended rule and others are skipped as expected.

Rollback Plan

firewall-cmd –remove-rich-rule of the new entry and restore prior set.

Prevention & Hardening

Document priority bands per environment and lint rules in CI.

Related Errors & Cross-Refs

Pairs with Access denied or unexpected accept where reject was intended.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

firewalld rich language docs.