DocCraft

English

中文

English

中文

Appearance

🆘 FAQ & Troubleshooting ​

Issue 1: Locked Out via SSH ​

bash
# ===== UFW Scenario =====
# Log in through the console (VNC/iDRAC/cloud provider web terminal), then:
ufw disable
ufw status

# Or directly edit the rule file
# /etc/ufw/user.rules — remove the SSH-related DROP lines

# ===== firewalld Scenario =====
# Log in through the console, then:
firewall-cmd --state
firewall-cmd --list-all
# Check if SSH is in the allowed list
firewall-cmd --add-service=ssh
firewall-cmd --permanent --add-service=ssh
firewall-cmd --reload

# Golden rule: Always allow SSH first, then change the default policy!
ufw allow 22/tcp && ufw enable

Issue 2: Firewall and Docker Conflict ​

bash
# Docker bypasses UFW/firewalld when starting, directly manipulating iptables
# This means you think you've blocked a port, but Docker container ports are still reachable

# Verify: Check rules Docker inserted in iptables
iptables -L DOCKER -v -n

# Solution 1: Disable Docker's iptables management
cat > /etc/docker/daemon.json << 'EOF'
{
  "iptables": false
}
EOF
systemctl restart docker
# ⚠️ This requires manual configuration for inter-container communication

# Solution 2: Control via DOCKER-USER chain
iptables -I DOCKER-USER -i eth0 -p tcp --dport 8080 -j DROP
iptables -I DOCKER-USER -i eth0 -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT

# Solution 3: Don't use Docker port mapping, use host network mode instead
docker run --network host myapp
# This way ports bind directly on the host, and UFW/firewalld can control them normally

Issue 3: firewalld Rules Not Taking Effect ​

bash
# Checklist:

# 1. Is firewalld running?
systemctl status firewalld

# 2. View current zone and rules
firewall-cmd --get-active-zones
firewall-cmd --list-all

# 3. Were rules added to the correct zone?
firewall-cmd --get-default-zone    # Default zone
firewall-cmd --get-zone-of-interface=eth0  # Zone the NIC is bound to

# 4. Did you forget --permanent?
firewall-cmd --list-all              # Temporary rules
firewall-cmd --permanent --list-all  # Permanent rules

# 5. Did you reload after modifying permanent rules?
firewall-cmd --reload

# 6. Check logs
journalctl -u firewalld --since "5 minutes ago"
dmesg | grep -i drop

Issue 4: UFW and firewalld Conflict ​

bash
# Ubuntu uses UFW by default, CentOS/RHEL uses firewalld by default
# They cannot run simultaneously!

# Check which one is currently active
ufw status 2>/dev/null && echo "UFW is active"
firewall-cmd --state 2>/dev/null && echo "firewalld is active"

# If you want to switch:
# Switch from UFW to firewalld (Ubuntu)
ufw disable
apt install firewalld
systemctl enable --now firewalld

# Switch from firewalld to UFW (CentOS)
systemctl disable --now firewalld
yum install ufw
ufw enable

# ⚠️ Back up current rules before switching!
ufw status verbose > /tmp/ufw-backup.txt
firewall-cmd --list-all > /tmp/firewalld-backup.txt

Related Posts