Diagnosing firewalld Start Failures on Rocky Linux 9

Recognizable Condition

After a reboot or a manual systemctl restart firewalld, the service enters a failed state. Running systemctl status firewalld shows Active: failed (Result: exit-code) and the journal contains lines such as Failed to start firewalld - dynamic firewall daemon. The system may be left without any active firewall rules, exposing open ports until the service is recovered.

Cause and Diagnostic Quick-Reference

Observed Symptom	Likely Root Cause	Primary Diagnostic Command
Journal shows XML parsing error with line/column numbers	Malformed zone or policy XML in /etc/firewalld/	journalctl -u firewalld -n 50 --no-pager
Error FirewallD is not running from firewall-cmd --state but systemctl shows inactive	Legacy iptables or nftables service still holding netfilter locks	systemctl list-unit-files | grep -E 'iptables|nftables|ebtables'
Permission denied on /etc/firewalld/zones/	Directory or file ownership changed (e.g., after manual edit as non-root)	ls -la /etc/firewalld/
Message modprobe: ERROR: could not insert 'nf_conntrack'	Kernel module mismatch after partial kernel update	dmesg -T | grep -i firewall
Service starts but firewall-cmd --list-all returns empty	Default zone file missing or corrupted	firewall-cmd --get-default-zone then cat /etc/firewalld/zones/.xml

Ordered Diagnostic Checks

1. Capture the exact failure. Run as root:

   journalctl -u firewalld -b --no-pager | tail -30

   Look for ERROR lines that mention XML line numbers, missing files, or kernel module load failures.
2. Verify configuration syntax. Firewalld ships a validation utility:

   firewall-cmd --check-config

   A non-zero exit code with output like Error: ZONE_CONF: 'public' - XML syntax error at line 12 points directly at a broken zone file.
3. Check for conflicting firewall services. Rocky Linux 9 uses nftables as the backend; ensure no legacy service is enabled:

   systemctl is-enabled iptables nftables ebtables 2>/dev/null

   Any result other than disabled or masked indicates a conflict. Mask them:

   systemctl mask iptables nftables ebtables

4. Inspect permissions on /etc/firewalld. The daemon runs as root but reads zone files as root; however, SELinux context matters:

   ls -laZ /etc/firewalld/
   restorecon -Rv /etc/firewalld/

   If restorecon changes labels, retry the service start.
5. Validate kernel module availability. After a kernel upgrade without reboot, modules may be missing:

   modprobe nf_conntrack nf_defrag_ipv4 nf_defrag_ipv6 xt_tcpudp

   If any module fails, a reboot is required to load the matching kernel modules.

Fixes Tied to Findings

1. Malformed Zone XML

If firewall-cmd --check-config reports a syntax error in /etc/firewalld/zones/public.xml (or another zone), back up the file first:

cp /etc/firewalld/zones/public.xml /etc/firewalld/zones/public.xml.bak

Edit the file with a validating XML editor or correct the reported line manually. Common issues: unclosed tags, stray characters, or an incorrect namespace declaration. After correction, run firewall-cmd --check-config again. Then reload:

systemctl restart firewalld
firewall-cmd --state

Risk: Editing XML without a backup can lose custom rules. The .bak mitigates this.

2. Legacy Service Conflict

If iptables or nftables services are active, stop and mask them before restarting firewalld:

systemctl stop iptables nftables ebtables
systemctl mask iptables nftables ebtables
systemctl restart firewalld

Verify with firewall-cmd --state returning running.

3. Permission or SELinux Label Issues

If ls -laZ shows incorrect contexts (e.g., user_home_t instead of firewalld_etc_rw_t), run:

restorecon -Rv /etc/firewalld/
systemctl restart firewalld

If the directory was created manually, ensure ownership is root:root and mode 755 for directories, 644 for files.

4. Missing Default Zone

If firewall-cmd --get-default-zone returns nothing or a zone file is absent, restore the default configuration from the package:

dnf reinstall -y firewalld
systemctl restart firewalld

This reinstalls the stock zone files under /usr/lib/firewalld/zones/ and symlinks them into /etc/firewalld/zones/.

5. Kernel Module Mismatch

When modprobe fails with Module not found, the running kernel differs from the installed modules. The only reliable fix is a reboot into the updated kernel:

reboot

After reboot, confirm systemctl status firewalld shows active (running).

Escalation Criteria

• After completing all five checks and applying the corresponding fix, systemctl status firewalld still reports failed.
• Journal shows SELinux is preventing /usr/sbin/firewalld from ... — indicates a policy bug; file a bug with ausearch -m avc -ts recent output.
• Multiple zone files report syntax errors simultaneously — suggests filesystem corruption; run fsck on the root filesystem.
• Kernel module errors persist after reboot — verify kernel-devel and kernel-modules packages match uname -r.

Verification After Fix

1. systemctl status firewalld — expect Active: active (running).
2. firewall-cmd --state — returns running.
3. firewall-cmd --list-all — shows the active zone with expected services/ports.
4. Functional test: from a remote host, attempt a connection to a permitted port (e.g., ssh on 22) and a denied port (e.g., telnet 80 if HTTP not allowed). Use curl -I http:// for HTTP checks.

Limitations

• This guide covers Rocky Linux 9 (firewalld 1.1.x+). Rocky Linux 8 uses firewalld 0.9.x with slightly different paths and SELinux policies.
• Custom nftables rules added via firewall-cmd --direct or --passthrough are not validated by --check-config; they may still cause start failures.
• Systems with NetworkManager managing interfaces may experience race conditions; ensure NetworkManager-dispatcher-routing-rules is installed.

Practical Checklist

• ☐ Capture journal output for the failed unit.
• ☐ Run firewall-cmd --check-config.
• ☐ Disable and mask legacy iptables/nftables services.
• ☐ Restore SELinux contexts on /etc/firewalld.
• ☐ Reinstall firewalld package if zone files are missing.
• ☐ Reboot if kernel modules mismatch.
• ☐ Verify with firewall-cmd --state and a remote connectivity test.