I have for a school project a simple architecture composed of 3 virtual machines which all run Fedora 24: one server, one client, and one router. I decided to use iptables over firewalld for the extensive use of DNAT/SNAT that I only knew how to manage well with iptables; therefore, I disabled firewalld, and enable iptables:

# dnf install iptables-services
# systemctl stop firewalld
# systemctl disable firewalld
# systemctl start iptables && systemctl start ip6tables
# systemctl enable iptables && systemctl enable ip6tables

I had a set of rules I saved through # service iptables save and it worked perfectly on my router.

I used the same method on my two other machines, server, and client, but the rules were not saved. After a bit of research, I realized that iptables.service does not start on boot; and I further noticed that firewalld did even though it was disabled as presented above.

Is there a particular reason why firewalld would start even though it is disabled? Here's what the status shows right after boot:

firewalld.service - firewalld - dynamic firewall daemon
  Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset : enabled)
  Active: active (running) since Sun 2017-01-22 23:52:34 PST; 15s ago
    Docs:  man:firewalld(1)
Main PID: 619 (firewalld)
   Tasks: 2 (list:512)
  CGroup: /system.slice/firewalld.service
          └─619 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid

Jan 22 23:52:33 public systemd[1]: Starting firewalld - dynamic firewall daemon
Jan 22 23:52:34 public systemd[1]: Started firewalld - dynamic firewall daemon.

On the other hand, here is iptables's:

iptables.service - IPv4 firewall with iptables
 Loaded: loaded (/usr/lib/systemd/systemd/system/iptables.service; enabled; vendor preset: disabled)
 Active: inactive (dead)
  • 1
    dnf remove firewalld should do the job – Jakuje Jan 23 '17 at 9:26
  • That did the job. iptables can now run. Thanks! – Kevin Cuallado-Keltsch Jan 23 '17 at 9:30
  • systemctl disable SERVICE doesn't completely disable the service. Only systemctl mask SERVICE guarantees that the service will not start no matter what. The systemctl manpage does a really bad job of explaining when this matters. – zwol Jan 23 '17 at 12:34

The safest way to get rid of firewalld is to remove it:

dnf remove firewalld

It is quite ok to do for virtual machines.

| improve this answer | |
  • I had a similar issue with Fedora27 NetworkManager, so I removed NM. – ManuParra May 2 '18 at 7:35

Mask and disable the firewalld service:

systemctl mask firewalld
systemctl disable firewalld
| improve this answer | |

you can turn it off using the following command:

#chkconfig firewalld off

then restart your machine and its done.

this way you will turn off the firewalld service from run levels so it wont get started when you boot the machine.

| improve this answer | |
  • -1. Fedora 24 uses systemd. If systemctl disable does not show any warning, but leaves the service enabled, it was a bug. Did anyone test chkconfig as a workaround for this mysterious problem? – sourcejedi Dec 30 '18 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.