# Need help on firewalld

**URL:** <https://forum.endeavouros.com/t/need-help-on-firewalld/58223>\
**Category:** Applications\
**Created:** [July 19, 2024, 12:20pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223 "2024-07-19T12:20:00Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\
**Post date:** [July 19, 2024, 12:20pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/1 "2024-07-19T12:20:00Z")

</div>

I have adjusted my firewalld. After the last update, a pacnew file was added and I merged them. Now firewalld no longer works as desired.  
Is someone able to help me to fix this?

```auto
➜ sudo systemctl status firewalld
[sudo] Passwort für swh: 
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: disabled)
     Active: active (running) since Fri 2024-07-19 14:13:22 CEST; 2min 35s ago
 Invocation: 624f52867fac45ddb43356f76603a30f
       Docs: man:firewalld(1)
   Main PID: 792 (firewalld)
      Tasks: 2 (limit: 18940)
     Memory: 61.9M (peak: 61.9M)
        CPU: 267ms
     CGroup: /system.slice/firewalld.service
             └─792 /usr/bin/python /usr/bin/firewalld --nofork --nopid

Jul 19 14:13:22 ryzen systemd[1]: Starting firewalld - dynamic firewall daemon...
Jul 19 14:13:22 ryzen systemd[1]: Started firewalld - dynamic firewall daemon.
Jul 19 14:13:25 ryzen firewalld[792]: ERROR: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: Datei o>
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      
                                      JSON blob:
                                      {"nftables": [{"metainfo": {"json_schema_version": 1}}, {"add": {"rule": {"family": "in>
Jul 19 14:13:25 ryzen firewalld[792]: ERROR: COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not proce>
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden
                                      
                                      
                                      JSON blob:
                                      {"nftables": [{"metainfo": {"json_schema_version": 1}}, {"add": {"rule": {"family": "in>
lines 11-36/36 (END)

```

I don’t understand internal error. I don’t know what it means.  
As soon as I check ‘activate shields’ in the applet in the systray, the entire internet access is blocked with an error message

Datei oder Verzeichnis nicht gefunden means = File or directory not found  
Somehow I must have messed something up big

---

<div class="post-metadata">

**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\
**Post date:** [July 19, 2024, 12:31pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/2 "2024-07-19T12:31:24Z")

</div>

Last time I merged a file some merge things were added like special characters, things like ^^^^^merge and other lines that were added during the merge. This was with my mirrorlist, after I removed those I had a working mirrorlist again. I’m guessing this could be the case for your firewall configuration file as well.

---

<div class="post-metadata">

**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\
**Post date:** [July 19, 2024, 12:38pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/3 "2024-07-19T12:38:26Z")

</div>

this is my firewalld.conf

```auto
# firewalld config file

# default zone
# The default zone used if an empty zone string is used.
# Default: public
DefaultZone=public

# Clean up on exit
# If set to no or false the firewall configuration will not get cleaned up
# on exit or stop of firewalld.
# Default: yes
CleanupOnExit=yes

# Clean up kernel modules on exit
# If set to yes or true the firewall related kernel modules will be
# unloaded on exit or stop of firewalld. This might attempt to unload
# modules not originally loaded by firewalld.
# Default: no
CleanupModulesOnExit=no

# Lockdown
# If set to enabled, firewall changes with the D-Bus interface will be limited
# to applications that are listed in the lockdown whitelist.
# The lockdown whitelist file is lockdown-whitelist.xml
# Default: no
Lockdown=no

# IPv6_rpfilter
# Performs a reverse path filter test on a packet for IPv6. If a reply to the
# packet would be sent via the same interface that the packet arrived on, the
# packet will match and be accepted, otherwise dropped.
# The rp_filter for IPv4 is controlled using sysctl.
# Note: This feature has a performance impact. See man page FIREWALLD.CONF(5)
# for details.
# Default: yes
IPv6_rpfilter=yes

# IndividualCalls
# Do not use combined -restore calls, but individual calls. This increases the
# time that is needed to apply changes and to start the daemon, but is good for
# debugging.
# Default: no
IndividualCalls=no

# LogDenied
# Add logging rules right before reject and drop rules in the INPUT, FORWARD
# and OUTPUT chains for the default rules and also final reject and drop rules
# in zones. Possible values are: all, unicast, broadcast, multicast and off.
# Default: off
LogDenied=off

# FirewallBackend
# Selects the firewall backend implementation.
# Choices are:
#	- nftables (default)
#	- iptables (iptables, ip6tables, ebtables and ipset)
# Note: The iptables backend is deprecated. It will be removed in a future
# release.
FirewallBackend=nftables

# FlushAllOnReload
# Flush all runtime rules on a reload. In previous releases some runtime
# configuration was retained during a reload, namely; interface to zone
# assignment, and direct rules. This was confusing to users. To get the old
# behavior set this to "no".
# Default: yes
FlushAllOnReload=yes

# ReloadPolicy
# Policy during reload. By default all traffic except for established
# connections is dropped while the rules are updated. Set to "DROP", "REJECT"
# or "ACCEPT". Alternatively, specify it per table, like
# "OUTPUT:ACCEPT,INPUT:DROP,FORWARD:REJECT".
# Default: ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP
ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP

# RFC3964_IPv4
# As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that
# correspond to IPv4 addresses that should not be routed over the public
# internet.
# Defaults to "yes".
RFC3964_IPv4=yes

# NftablesFlowtable
# This may improve forwarded traffic throughput by enabling nftables flowtable.
# It is a software fastpath and avoids calling nftables rule evaluation for
# data packets. This only works for TCP and UDP traffic.
# The value is a space separated list of interfaces.
# Example value "eth0 eth1".
# Defaults to "off".
NftablesFlowtable=off

# NftablesCounters
# If set to yes, add a counter to every nftables rule. This is useful for
# debugging and comes with a small performance cost.
# Defaults to "no".
NftablesCounters=no

```

It seems OK

---

<div class="post-metadata">

**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\
**Post date:** [July 19, 2024, 12:40pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/4 "2024-07-19T12:40:40Z")

</div>

This is the error when i am activate firewalld via firewalld applet in systray

```auto
COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden

internal:0:0-0: Error: Could not process rule: Datei oder

```

As soon i activate it, my standard-zone is setting to **block**

---

<div class="post-metadata">

**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\
**Post date:** [July 19, 2024, 12:44pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/5 "2024-07-19T12:44:04Z")

</div>

Here’s mine as a comparison.

```auto
# firewalld config file

# default zone
# The default zone used if an empty zone string is used.
# Default: public
DefaultZone=public

# Clean up on exit
# If set to no or false the firewall configuration will not get cleaned up
# on exit or stop of firewalld.
# Default: yes
CleanupOnExit=yes

# Clean up kernel modules on exit
# If set to yes or true the firewall related kernel modules will be
# unloaded on exit or stop of firewalld. This might attempt to unload
# modules not originally loaded by firewalld.
# Default: no
CleanupModulesOnExit=no

# IPv6_rpfilter
# Performs reverse path filtering (RPF) on IPv6 packets as per RFC 3704.
# Possible values:
# - strict: Performs "strict" filtering as per RFC 3704. This check
# verifies that the in ingress interface is the same interface
# that would be used to send a packet reply to the source. That
# is, ingress == egress.      
# - loose: Performs "loose" filtering as per RFC 3704. This check only
# verifies that there is a route back to the source through any
# interface; even if it's not the same one on which the packet
# arrived.
# - strict-forward: This is almost identical to "strict", but does not perform
# RPF for packets targeted to the host (INPUT).
# - loose-forward: This is almost identical to "loose", but does not perform
# RPF for packets targeted to the host (INPUT).
# - no: RPF is completely disabled.
#
# The rp_filter for IPv4 is controlled using sysctl.
# Note: This feature has a performance impact. See man page FIREWALLD.CONF(5)
# for details.
# Default: strict
IPv6_rpfilter=strict

# IndividualCalls
# Do not use combined -restore calls, but individual calls. This increases the
# time that is needed to apply changes and to start the daemon, but is good for
# debugging.
# Default: no
IndividualCalls=no

# LogDenied
# Add logging rules right before reject and drop rules in the INPUT, FORWARD
# and OUTPUT chains for the default rules and also final reject and drop rules
# in zones. Possible values are: all, unicast, broadcast, multicast and off.
# Default: off
LogDenied=off

# FirewallBackend
# Selects the firewall backend implementation.
# Choices are:
#	- nftables (default)
#	- iptables (iptables, ip6tables, ebtables and ipset)
# Note: The iptables backend is deprecated. It will be removed in a future
# release.
FirewallBackend=nftables

# FlushAllOnReload
# Flush all runtime rules on a reload. In previous releases some runtime
# configuration was retained during a reload, namely; interface to zone
# assignment, and direct rules. This was confusing to users. To get the old
# behavior set this to "no".
# Default: yes
FlushAllOnReload=yes

# ReloadPolicy
# Policy during reload. By default all traffic except for established
# connections is dropped while the rules are updated. Set to "DROP", "REJECT"
# or "ACCEPT". Alternatively, specify it per table, like
# "OUTPUT:ACCEPT,INPUT:DROP,FORWARD:REJECT".
# Default: ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP
ReloadPolicy=INPUT:DROP,FORWARD:DROP,OUTPUT:DROP

# RFC3964_IPv4
# As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that
# correspond to IPv4 addresses that should not be routed over the public
# internet.
# Defaults to "yes".
RFC3964_IPv4=yes

# NftablesFlowtable
# This may improve forwarded traffic throughput by enabling nftables flowtable.
# It is a software fastpath and avoids calling nftables rule evaluation for
# data packets. This only works for TCP and UDP traffic.
# The value is a space separated list of interfaces.
# Example value "eth0 eth1".
# Defaults to "off".
NftablesFlowtable=off

# NftablesCounters
# If set to yes, add a counter to every nftables rule. This is useful for
# debugging and comes with a small performance cost.
# Defaults to "no".
NftablesCounters=no

# NftablesTableOwner
# If set to yes, the generated nftables rule set will be owned exclusively by
# firewalld. This prevents other entities from mistakenly (or maliciously)
# modifying firewalld's rule set. If you intentionally modify firewalld's
# rules, then you will have to set this to "no".
# Defaults to "yes".
NftablesTableOwner=yes

```

I see some lines are different, try backing up your current firewalld.conf file and replacing it with mine to see what happens?

---

<div class="post-metadata">

**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\
**Post date:** [July 19, 2024, 12:45pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/6 "2024-07-19T12:45:05Z")

</div>

> [@swh](#):
>
> `COMMAND_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: Datei oder Verzeichnis nicht gefunden`

When I check in the repos `python-nftables` doesn’t seem to exist?

---

<div class="post-metadata">

**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\
**Post date:** [July 19, 2024, 12:57pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/7 "2024-07-19T12:57:45Z")

</div>

> [@Cphusion](#):
>
> When I check in the repos `python-nftables` doesn’t seem to exist?

You are right. Just cecked. How to remove that?

> [@Cphusion](#):
>
> I see some lines are different, try backing up your current firewalld.conf file and replacing it with mine to see what happens?

The same behavior as mine. Except that firewalld does not set itself to **block**. As soon as I set ‘activate shields’, I only have a limited connection. So I have to restart my computer every time I switch it on or off

A catastrophe. Something is completely messed up

---

<div class="post-metadata">

**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\
**Post date:** [July 19, 2024, 12:59pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/8 "2024-07-19T12:59:05Z")

</div>

> [@swh](#):
>
> You are right. Just cecked. How to remove that?

Is that package installed on your system?

---

<div class="post-metadata">

**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\
**Post date:** [July 19, 2024, 1:00pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/9 "2024-07-19T13:00:29Z")

</div>

> [@Cphusion](#):
>
> Is that package installed on your system?

No

```auto
➜ pactree python-nftables     
error: package 'python-nftables' not found

```

```auto
✗ pacman -Qs python-nftables

```

---

<div class="post-metadata">

**Author:** ![r0ckhopper](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/r0ckhopper/32/51768_2.png) [@r0ckhopper](https://forum.endeavouros.com/u/r0ckhopper)\
**Post date:** [July 19, 2024, 1:06pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/10 "2024-07-19T13:06:37Z")

</div>

Could it be this problem?

> <https://github.com/firewalld/firewalld/issues/1366>
>
> \### What happened
> 
> at the system start i have log issue: 
> juil. 18 22:50:25 Leg…itux firewalld\[869\]: ERROR: UNKNOWN\_INTERFACE: 'pvpnksintrf0' is not in any zone
> juil. 18 22:50:27 Legitux firewalld\[869\]: ERROR: 'handle'
> juil. 18 22:50:27 Legitux firewalld\[869\]: ERROR: COMMAND\_FAILED: 'handle'
> 
> i have 4 rules in the table which all of them have the same style:
> 
> \` rule priority="2" family="ipv4" source address="0.0.0.0" destination address="X.X.X.X/32" port port="443" protocol="tcp" log prefix="Title" level="alert" drop\`
> 
> moreover firewalld doesn't filter the traffic as it should
> 
> \### What you expected to happen
> 
> know what happens and got some info
> 
> \### How to reproduce it (as minimally and precisely as possible)
> 
> i don't know
> 
> \### Anything else we need to know?
> 
> \`\`\`
> juil. 18 22:50:24 Legitux firewalld\[869\]: ERROR: COMMAND\_FAILED: 'python-nftables' failed: internal:0:0-0: Error: Could not process rule: Aucun fichier ou dossier de ce nom
> 
> internal:0:0-0: Error: Could not process rule: Aucun fichier ou dossier de ce nom
> 
> internal:0:0-0: Error: Could not process rule: Aucun fichier ou dossier de ce nom
> 
> internal:0:0-0: Error: Could not process rule: Aucun fichier ou dossier de ce nom
> 
> internal:0:0-0: Error: Could not process rule: Aucun fichier ou dossier de ce nom
> 
> 
> JSON blob:
> {"nftables": \[{"metainfo": {"json\_schema\_version": 1}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FWD\_block\_allow", "expr": \[{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"accept": null}\]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_INPUT\_POLICIES", "expr": \[{"match": {"left": {"meta":{"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op":"==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter\_IN\_block\_REJECT: "}}\]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_INPUT\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"reject": {"type": "icmpx", "expr":"admin-prohibited"}}\], "index": 0}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_OUTPUT\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}\]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_OUTPUT\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}\]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter\_FWD\_block\_REJECT: "}}\]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"counter": null}, {"reject": {"type":"icmpx", "expr": "admin-prohibited"}}\], "index": 0}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_PREROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}\]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "mangle\_PREROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==","right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}\]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_POSTROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op":"==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}\]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter\_FWD\_block\_REJECT: "}}\], "index": 1}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"reject": {"type": "icmpx", "expr": "admin-prohibited"}}\], "index": 2}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_POSTROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op":"==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"counter": null}, {"return": null}\], "index": 0}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter\_FWD\_block\_REJECT: "}}\]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"reject": {"type": "icmpx", "expr": "admin-prohibited"}}\], "index": 0}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_POSTROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op":"==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}\]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter\_FWD\_block\_REJECT: "}}\], "index": 3}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"reject": {"type": "icmpx", "expr": "admin-prohibited"}}\], "index": 4}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_POSTROUTING\_POLICIES", "expr": \[{"match":{"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}\], "index": 1}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "pkttype"}}, "op": "==", "right": "unicast"}}, {"counter": null}, {"log": {"prefix": "filter\_FWD\_block\_REJECT: "}}\], "index": 25}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"reject": {"type": "icmpx", "expr": "admin-prohibited"}}\], "index": 26}}}, {"add": {"rule": {"family":"inet", "table": "firewalld", "chain": "nat\_POSTROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"return": null}\], "index": 15}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_INPUT\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter\_IN\_block"}}\]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_OUTPUT\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter\_OUT\_block"}}\]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_OUTPUT\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat\_OUT\_block"}}\]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"counter": null}, {"jump": {"target": "filter\_FWD\_block"}}\], "index": 1}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_PREROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat\_PRE\_block"}}\]}}}, {"insert":{"rule": {"family": "inet", "table": "firewalld", "chain": "mangle\_PREROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "mangle\_PRE\_block"}}\]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_POSTROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat\_POST\_block"}}\], "index": 0}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter\_FWD\_block"}}\], "index": 6}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain":"nat\_POSTROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnrouteintrf0"}}, {"counter": null}, {"jump": {"target": "nat\_POST\_block"}}\], "index": 3}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter\_FWD\_block"}}\]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_POSTROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat\_POST\_block"}}\]}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter\_FWD\_block"}}\], "index": 5}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_POSTROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat\_POST\_block"}}\], "index": 3}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_FORWARD\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "oifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter\_FWD\_block"}}\], "index": 29}}}, {"add": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_POSTROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat\_POST\_block"}}\], "index": 19}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "filter\_INPUT\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "filter\_IN\_policy\_allow-host-ipv6"}}\]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "nat\_PREROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}}, "op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "nat\_PRE\_policy\_allow-host-ipv6"}}\]}}}, {"insert": {"rule": {"family": "inet", "table": "firewalld", "chain": "mangle\_PREROUTING\_POLICIES", "expr": \[{"match": {"left": {"meta": {"key": "iifname"}},"op": "==", "right": "pvpnksintrf0"}}, {"counter": null}, {"jump": {"target": "mangle\_PRE\_policy\_allow-host-ipv6"}}\]}}}\]}
> juil. 18 22:50:25 Legitux firewalld\[869\]: ERROR: UNKNOWN\_INTERFACE: 'pvpnksintrf0' is not in any zone
> juil. 18 22:50:27 Legitux firewalld\[869\]: ERROR: 'handle'
> juil. 18 22:50:27 Legitux firewalld\[869\]: ERROR: COMMAND\_FAILED: 'handle'
> \`\`\`
> 
> \### Firewalld Version
> 
> 2.2.0-1
> 
> \### Firewalld Backend
> 
> nftables
> 
> \### Linux distribution
> 
> endeavouros
> 
> \### Linux kernel version
> 
> 6.9.9-arch1-1
> 
> \### Other information
> 
> \_No response\_

If so, the `nftables` package in Arch Linux has been fixed, and should be reaching the mirrors.

> **[Commits · main · Arch Linux / Packaging / Packages / nftables · GitLab](https://gitlab.archlinux.org/archlinux/packaging/packages/nftables/-/commits/main)**
>
> Netfilter tables userspace tools packages: nftables

---

<div class="post-metadata">

**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\
**Post date:** [July 19, 2024, 1:11pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/11 "2024-07-19T13:11:49Z")

</div>

Thank you @r0ckhopper . It seems the same issue like mine. I have to wait until the update reached `extra`.

I report later if its fixed on my side

---

<div class="post-metadata">

**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\
**Post date:** [July 19, 2024, 1:17pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/12 "2024-07-19T13:17:06Z")

</div>

I would be curios to know what causes the issues because I have `nftables 1:1.1.0-1` and `firewalld 2.2.0-1` on my system and I’m not experiencing issues with firewalld. Did I miss something in that issue?

---

<div class="post-metadata">

**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\
**Post date:** [July 19, 2024, 1:23pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/13 "2024-07-19T13:23:58Z")

</div>

It seems good.  
But how do i set my standardzone to **public** instead of **block**?

![block](https://forum.endeavouros.com/uploads/default/original/3X/a/7/a7408962b622b9b0a78b5c7292cde0eb79494a75.png)

---

<div class="post-metadata">

**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\
**Post date:** [July 19, 2024, 1:24pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/14 "2024-07-19T13:24:53Z")

</div>

I think you have to run this.  
`sudo firewall-cmd --set-default-zone=public`

---

<div class="post-metadata">

**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\
**Post date:** [July 19, 2024, 1:26pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/15 "2024-07-19T13:26:15Z")

</div>

Thanks. I used your firewalld.conf and there is standardzone defined as public. I try the command

---

<div class="post-metadata">

**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\
**Post date:** [July 19, 2024, 1:28pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/16 "2024-07-19T13:28:55Z")

</div>

I think I have misunderstood the principle. As soon as firewalld is active, it is set to **public**. But when I set ‘activate shields’ it automatically sets to **block**. I hope my english gave it as I wanted to express it

---

<div class="post-metadata">

**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\
**Post date:** [July 19, 2024, 1:30pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/17 "2024-07-19T13:30:57Z")

</div>

What is “activate shields”? Why do you need to set your default zone to block? Is your system directly accessible from the internet, by which I mean do you have port forwarding enabled on your isp router forwarding to ports on your pc’s ports? Public zone for home use should be just fine because only the ssh port is open by default on the public zone?

---

<div class="post-metadata">

**Author:** ![r0ckhopper](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/r0ckhopper/32/51768_2.png) [@r0ckhopper](https://forum.endeavouros.com/u/r0ckhopper)\
**Post date:** [July 19, 2024, 1:31pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/18 "2024-07-19T13:31:07Z")

</div>

I use `ufw` so wouldn’t know!

I was searching for a `python-nftables` Arch package (had it been renamed or dropped to the AUR), when I found the `nftables` package and the very recent commit.

---

<div class="post-metadata">

**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\
**Post date:** [July 19, 2024, 1:34pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/19 "2024-07-19T13:34:17Z")

</div>

> [@Cphusion](#):
>
> What is “activate shields”?

In the systray is the display of the fireall applet where I can select whether I want to ‘activate shields’ or not  
As soon as I activate this, firewalld automatically sets the default zone to **block**.

I must have misunderstood this

 ![activateshields](https://forum.endeavouros.com/uploads/default/original/3X/b/e/be2abb1f193db1e6c0d5e0efa2085ed4b6bee566.jpeg)

---

<div class="post-metadata">

**Author:** ![Cphusion](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@Cphusion](https://forum.endeavouros.com/u/Cphusion)\
**Post date:** [July 19, 2024, 1:36pm UTC](https://forum.endeavouros.com/t/need-help-on-firewalld/58223/20 "2024-07-19T13:36:42Z")

</div>

> [@swh](#):
>
> As soon as I activate this, firewalld automatically sets the default zone to **block**.

I don’t use the firewall-gui, I just use firewall-cmd when I do need to configure something. But setting the default zone to “block” seem unnecessary for a home computer which isn’t directly accessible from the internet. Someone will probably disagree with me but it’s up to you what you want to do.

[Next page](https://forum.endeavouros.com/t/need-help-on-firewalld/58223.md?page=2)