firewalld direct rules with ACCEPT not working on RHEL 8, 9 and 10
Issue
- Direct rules with ACCEPT verdict not working with nftables backend
-
Even though
httpd.serviceandfirewalld.serviceare running, allowing port 80 through direct rules does not provide access to the webserver:systemctl start httpd.service systemctl start firewalld.service firewall-cmd --direct --add-rule ipv4 filter INPUT 1 -p tcp --dport 80 -j ACCEPT -
Client can't accesss, gets
No route to hosterror. - Changing from
FirewallBackend=nftablestoFirewallBackend=iptablesthe direct rule works. - Connectivity not working between servers when firewall getting started in RHEL8
- firewalld
direct.xmlfrom RHEL 7 no longer works on RHEL 8 - How do direct rules work with firewalld when firewalld uses nftables?
Environment
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 10
- firewalld (with default
nftablesbackend) - Direct firewall rule with
-j ACCEPTto allow traffic
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.