After upgrading the system from 6.5 to 7, I started learning implementing dynamic firewall, however, I made a mistake to add the following rule

firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -j DROP

which cause the machine drop all the output to outside,

I tried to use

firewall-cmd --permanent --direct --remove-rule ipv4 filter OUTPUT 1 -j DROP

to welcome everyone back.

However, after

firewall-cmd --reload


firewall-cmd --direct --get-all-rules

, I find this rule come back again automatically .

I even tried

firewall-cmd --complete-reload

but no effect.

What can I do now?

5 Answers 5


Eventually I find the remove command only work at one-time due to the rules are recorded in the direct.xml

Thus, the solution is easy, edit the direct.xml and comment the corresponded lines or jsut delet them.

  • Is this documented anywhere do you know? I had the same thing with the external zone; removing ssh service didn't stay-removed until I edited the xml file (which presumably gets updated on an update...)? Commented Sep 6, 2022 at 17:01

After wrestling with a stubbornly persistent redirect rule I realized through testing the following:

  1. iptables rules DB is transient
  2. firewall-cmd --permanent rules DB persists through reboots, rewriting iptables rules DB after reboot

  3. firewall-cmd --permanent --direct rules DB stored in /etc/firewalld/direct.xml persists despite firewall-cmd [--permanent] --direct --remove-rule unless DB file is removed

  4. firewall-cmd [--permanent] --direct --query-rule will lie about persistence of rules in /etc/firewalld/direct.xml


just tried the same thing and my direct.xml was emptied after running

firewall-cmd --direct --remove-rule ...

without --permanent option.
After reload there are no direct rules which was removed.

With this option rules was back after reload.


firewall-cmd [--permanent] --direct --remove-rules { ipv4 | ipv6 | eb } table chain

  • e.g. firewall-cmd --direct --remove-rules ipv4 filter OUTPUT
    – mwfearnley
    Commented Apr 29, 2019 at 9:16

No need to edict direct.xml file. Do a:

# systemctl restart firewalld

and that will do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .