Linux · high · Networking, DNS & SSH

A firewall change has no effect, or locks the machine out

More than one firewall front end is installed and they do not know about each other. The rules being edited are not the rules in force.

What you see

A port opened with one tool is still blocked, rules vanish after a reboot, or a change locks out the SSH session that made it.

What is actually wrong

firewalld, ufw and raw nftables all write to the same kernel tables. Running two produces a ruleset that reflects neither. Beyond that, a rule added with iptables without saving does not survive a reboot.

Codes and articles

firewalldnftablesiptablesufwFirewallD is not runningCOMMAND_FAILED

Fixes (3)

Establish what is actually in force

Root shell15 minuteslow riskreversible

Before changing anything. Two front ends fighting is the most common cause of a rule that does nothing.

See which services are running.
Shell
```
systemctl is-active firewalld ufw nftables iptables 2>/dev/null
```
More than one active here explains almost every "my rule does not work" report. Pick one, disable the others, and the confusion goes with them.
Look at the real kernel ruleset, which is the only authority.
Shell
```
sudo nft list ruleset | head -80
```

Check the legacy view as well, since some tools still write there.

Shell

sudo iptables -S | head -40sudo iptables -L -n -v --line-numbers | head -40

Disable the front ends you are not using.

Shell

sudo systemctl disable --now ufwsudo systemctl enable --now firewalld

Confirm it workedOne front end is active and nft list ruleset matches what it reports.

Shell

sudo firewall-cmd --list-all

If you need to undo itRe-enable whichever service was previously in use.

Open a port in firewalld so it persists

Root shell15 minutesmedium riskreversible

firewalld is the manager.

Find which zone the interface is in — a rule added to the wrong zone does nothing.
Shell
```
sudo firewall-cmd --get-active-zonessudo firewall-cmd --get-default-zone
```
Add the rule to the runtime first and test it.
Shell
```
sudo firewall-cmd --zone=public --add-port=8080/tcp
```
A runtime rule disappears at the next reload. That is a feature here: if the change locks you out, waiting or rebooting restores access, which permanent rules do not.

Once proven, make it permanent and reload.

Shell

sudo firewall-cmd --zone=public --add-port=8080/tcp --permanentsudo firewall-cmd --reload

Prefer a named service over a bare port where one exists — it is self-documenting and covers every port the service needs.
Shell
```
sudo firewall-cmd --zone=public --add-service=https --permanentsudo firewall-cmd --reload
```
Before any restrictive change on a remote machine, set a panic timer as a safety net.
Shell
```
echo 'sleep 300; firewall-cmd --reload' | sudo at now
```

Confirm it workedThe port is listed permanently and reachable from outside.

Shell

sudo firewall-cmd --list-allsudo ss -tlnp | grep 8080

If you need to undo itfirewall-cmd --remove-port=8080/tcp --permanent then --reload.

Use ufw without locking yourself out

Root shell15 minuteshigh riskreversible

ufw is the manager. Enabling it with a default deny and no SSH rule is the classic lockout.

Add the SSH rule before enabling anything. This order is not optional on a remote machine.
Shell
```
sudo ufw allow OpenSSHsudo ufw status verbose
```
ufw enable applies a default deny immediately. Enabling first and adding SSH second means the second command never runs, because the session is already gone.
Enable it.
Shell
```
sudo ufw enable
```

Add the rules you need, with a source restriction where it makes sense.

Shell

sudo ufw allow from 192.168.1.0/24 to any port 3306 proto tcpsudo ufw allow 443/tcp

Check the numbered list before deleting anything.
Shell
```
sudo ufw status numbered
```
Remember that Docker publishes ports by writing directly to the kernel tables and bypasses ufw entirely — a container published with -p is reachable regardless of what ufw says.
This surprises people badly. A machine that looks locked down by ufw status can have a database exposed to the internet by one docker run command.

Confirm it workedufw status shows the intended rules and a new SSH session still connects.

Shell

sudo ufw status verbose

If you need to undo itsudo ufw disable removes enforcement entirely, or delete a rule by its number with sudo ufw delete N.

Related faults

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.