0

I don't know what happened with FirewallD on recent updates but it's all messed up, first I had issues with my active rules on Fedora 24, where I supposedly have the samba-server services enabled but I couldnt connect, the solution was to manually add the 145 and 339 ports. But things get worse on Fedora 25, where I just can't even set a default zone. I can execute the firewall-cmd --set-default-zone FedoraServer command properly, however, upon issuing firewall-cmd --reload I get an error about a bad argument COMMIT. And on top of all if I just do systemctl restart firewalld I lose all the changes I made, e.g. if I now run firewall-cmd --get-default-zone I get an empty string. What's even worse is that runtime changes don't even come into effect because if I run firewall-cmd --add-port 22/tcp I can't still connect because (surprise!) none of my interfaces is bound to a zone (not even the default) and I can't even set a default zone because well, I can't even reload the service to apply changes. Has anyone run into these issues? How can I go about this? Right now, both my production servers are running without a firewall and this is driving me mad.

Edit:

These are two "strange" things in the log of systemctl status firewalld when the service is stopped (systemctl stop firewalld):

ERROR: Failed to flush eb firewall: '/usr/sbin/ebtables-restore --noflush' failed: Bad argument : 'COMMIT'.

...

ERROR: Failed to set policy of eb firewall: '/usr/sbin/ebtables-restore --noflush' failed: Bad argument : 'COMMIT'.

  • systemctl status firewalld reports something interesting? – Jakuje Dec 11 '16 at 8:24
0

You need to add the --permanent argument, otherwise you’re only changing the runtime configuration. When you reload the configuration, you’re removing all runtime configuration and loading in the permanent configuration. Similarly, when you restart the service or the system – runtime configuration is also lost. Read When is it necessary to reload FirewallD configuration? for a better explanation.

As for the COMMIT errors you’re seeing; your system must have some ebtables rules somewhere in your iptables. This is unsupported as per the firewalld.spec. Remove all your iptables firewall rules and try configuring your firewalld again without mixing management toolchains.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.