I am trying to change some of the firewall settings during an automatic kickstart installation in the %post section on a RHEL 8 server. For example: firewall-cmd --permanent --zone=public --set-target=DROP. When I use the command after I chroot, I get: FirewallD is not running.

If I try to start it with the systemctl start firewalld gives me Running in chroot, ignoring request: start during the post-installation with chroot. When I try the command in the post-installation script before I chroot, I get this error: Failed to start firewalld.service: Unit firewalld.service not found..

How do I make changes to the firewall during a kickstart installation?

  • Are you averse to simply creating the XML files in /etc/firewalld/zones?
    – jsbillings
    Jun 16, 2022 at 22:54
  • @jsbillings No, I wasn't. I will look into it to see how complicated it will be since I am not that familiar with xml.
    – Garnet
    Jun 17, 2022 at 12:42

1 Answer 1


You can use firewall-offline-cmd in kickstart, it should be used only if the firewalld service is not running.


firewall-offline-cmd is an offline command line client of the firewalld daemon. It should be used only if the firewalld service is not running. For example to migrate from system-config-firewall/lokkit or in the install environment to configure firewall settings with kickstart. Some lokkit options can not be automatically converted for firewalld, they will result in an error or warning message. This tool tries to convert as much as possible, but there are limitations for example with custom rules, modules and masquerading. Check the firewall configuration after using this tool.



You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .