Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop your firewalld rules from hiding the connection source

🧩 The Challenge

Dealing with a service that suddenly refuses connections is already annoying enough, but it gets worse when your firewall logs don’t show you which source IP is actually getting blocked. I’ve spent way too long staring at empty logs wondering if my rules were even running.

💡 The Fix

Add a temporary log rule to your firewalld setup to capture packets before they hit the drop policy. It pulls the curtain back on exactly what traffic is being silently discarded.

firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -m state --state NEW -j LOG --log-prefix "FIREWALL-DROP: "
firewall-cmd --reload

⚙️ Why It Works

By inserting this rule at the very top of your input chain with a log prefix, you force the kernel to dump packet metadata into your journal before the default drop rule catches it.

🚀 Pro-Tip: Use journalctl -k | grep FIREWALL-DROP to filter the noise and see the blocked traffic in real-time.

Linux Tips & Tricks | © ngelinux.com | 8/1/2026