After upgrading the system from 6.5 to 7, I started learning implementing dynamic firewall, however, I made a mistake to add the following rule

firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -j DROP

which cause the machine drop all the output to outside,

I tried to use

firewall-cmd --permanent --direct --remove-rule ipv4 filter OUTPUT 1 -j DROP

to welcome everyone back.

However, after

firewall-cmd --reload


firewall-cmd --direct --get-all-rules

, I find this rule come back again automatically .

I even tried

firewall-cmd --complete-reload

but no effect.

What can I do now?

5 Answers 5


Eventually I find the remove command only work at one-time due to the rules are recorded in the direct.xml

Thus, the solution is easy, edit the direct.xml and comment the corresponded lines or jsut delet them.

  • Is this documented anywhere do you know? I had the same thing with the external zone; removing ssh service didn't stay-removed until I edited the xml file (which presumably gets updated on an update...)? Sep 6, 2022 at 17:01

After wrestling with a stubbornly persistent redirect rule I realized through testing the following:

  1. iptables rules DB is transient
  2. firewall-cmd --permanent rules DB persists through reboots, rewriting iptables rules DB after reboot

  3. firewall-cmd --permanent --direct rules DB stored in /etc/firewalld/direct.xml persists despite firewall-cmd [--permanent] --direct --remove-rule unless DB file is removed

  4. firewall-cmd [--permanent] --direct --query-rule will lie about persistence of rules in /etc/firewalld/direct.xml


just tried the same thing and my direct.xml was emptied after running

firewall-cmd --direct --remove-rule ...

without --permanent option.
After reload there are no direct rules which was removed.

With this option rules was back after reload.


firewall-cmd [--permanent] --direct --remove-rules { ipv4 | ipv6 | eb } table chain

  • e.g. firewall-cmd --direct --remove-rules ipv4 filter OUTPUT
    – mwfearnley
    Apr 29, 2019 at 9:16

No need to edict direct.xml file. Do a:

# systemctl restart firewalld

and that will do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.