centOS 7 firewallD remove direct rule

Question

After upgrading the system from 6.5 to 7, I started learning implementing dynamic firewall, however, I made a mistake to add the following rule

firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -j DROP

which cause the machine drop all the output to outside,

I tried to use

firewall-cmd --permanent --direct --remove-rule ipv4 filter OUTPUT 1 -j DROP

to welcome everyone back.

However, after

firewall-cmd --reload

and

firewall-cmd --direct --get-all-rules

, I find this rule come back again automatically .

I even tried

firewall-cmd --complete-reload

but no effect.

What can I do now?

score 10 · Accepted Answer · answered Feb 15 '15 at 06:15

10

Eventually I find the remove command only work at one-time due to the rules are recorded in the direct.xml

Thus, the solution is easy, edit the direct.xml and comment the corresponded lines or jsut delet them.

answered Feb 15 '15 at 06:15

Mark

564
1
4
11

Is this documented anywhere do you know? I had the same thing with the `external` zone; removing ssh service didn't stay-removed until I edited the xml file (which presumably gets updated on an update...)? – artfulrobot Sep 06 '22 at 17:01

score 4 · Answer 2 · answered Jun 07 '17 at 04:16

After wrestling with a stubbornly persistent redirect rule I realized through testing the following:

iptables rules DB is transient
firewall-cmd --permanent rules DB persists through reboots, rewriting iptables rules DB after reboot
firewall-cmd --permanent --direct rules DB stored in /etc/firewalld/direct.xml persists despite firewall-cmd [--permanent] --direct --remove-rule unless DB file is removed
firewall-cmd [--permanent] --direct --query-rule will lie about persistence of rules in /etc/firewalld/direct.xml

score 1 · Answer 3 · answered Jan 18 '17 at 11:16

1

just tried the same thing and my direct.xml was emptied after running

firewall-cmd --direct --remove-rule ...

without --permanent option.
After reload there are no direct rules which was removed.

With this option rules was back after reload.

answered Jan 18 '17 at 11:16

deaDleSs balLoon

11
1

score 1 · Answer 4 · edited Sep 16 '18 at 12:25

1

firewall-cmd [--permanent] --direct --remove-rules { ipv4 | ipv6 | eb } table chain

edited Sep 16 '18 at 12:25

chicks

3,793
10
27
36

answered Sep 16 '18 at 07:03

Mohammed Alsayed

11
1

e.g. `firewall-cmd --direct --remove-rules ipv4 filter OUTPUT` – mwfearnley Apr 29 '19 at 09:16

score -1 · Answer 5 · answered Nov 26 '17 at 12:14

-1

No need to edict direct.xml file. Do a:

# systemctl restart firewalld

and that will do.

answered Nov 26 '17 at 12:14

The IT Guy

9
1

centOS 7 firewallD remove direct rule

5 Answers5