CloudFormation部署Rocky Linux 8时firewalld配置报错求助

问题背景 #

在通过CloudFormation部署搭载Rocky Linux 8的EC2实例时，执行firewall-cmd --zone=internal1 --add-service=http命令时触发DBus无响应错误，改用firewall-offline-cmd配置后变更未生效。

解决方案 #

1. 等待firewalld完全就绪后执行在线命令

firewalld启动后需要时间初始化DBus连接，直接执行firewall-cmd会因服务未就绪报错。添加等待逻辑确保服务就绪：

echo "Waiting for firewalld to be ready..."
until sudo firewall-cmd --state >/dev/null 2>&1; do
    sleep 2
done

将这段代码放在sudo systemctl start firewalld之后，再执行后续firewall-cmd命令。

2. 确认并创建自定义Zone

Rocky Linux 8默认不存在internal1 Zone，需先创建并持久化：

if ! sudo firewall-cmd --get-zones | grep -q "internal1"; then
    sudo firewall-cmd --permanent --new-zone=internal1
    sudo firewall-cmd --reload
fi

--permanent参数确保Zone在重启后不会丢失。

3. 正确使用firewall-offline-cmd（可选离线方案）

若使用离线命令配置，必须指定--zone和--permanent参数，最后重新加载配置生效：

# 离线添加服务到internal1 Zone
sudo firewall-offline-cmd --zone=internal1 --add-service=http --permanent
sudo firewall-offline-cmd --zone=internal1 --add-service=https --permanent

# 重载配置使变更生效
sudo firewall-cmd --reload

之前配置未生效的原因是缺少--permanent参数，导致配置仅在当前会话有效，重启后丢失。

优化后的完整脚本片段 #

"echo Unmasking firewalld\n",
"sudo systemctl unmask firewalld\n",

"echo Enabling firewalld\n",
"sudo systemctl enable firewalld\n",

"echo Allow inbound and outbound traffic on port 80\n",
"sudo firewall-offline-cmd --add-port=80/tcp --permanent\n",

"echo Allow inbound and outbound traffic on port 443\n", 
"sudo firewall-offline-cmd --add-port=443/tcp --permanent\n",

"echo Allow loopback traffic\n",
"sudo firewall-offline-cmd --add-interface=lo --permanent\n",

"echo Allow established connections\n",
"sudo firewall-offline-cmd --add-rich-rule='rule family=\"ipv4\" source address=\"127.0.0.0/8\" accept' --permanent\n",
"sudo firewall-offline-cmd --add-rich-rule='rule family=\"ipv4\" source address=\"0.0.0.0/0\" port port=\"443\" protocol=\"tcp\" accept' --permanent\n",
"sudo firewall-offline-cmd --add-rich-rule='rule family=\"ipv4\" source address=\"0.0.0.0/0\" port port=\"80\" protocol=\"tcp\" accept' --permanent\n",
"sudo firewall-offline-cmd --add-rich-rule='rule family=\"ipv4\" source address=\"0.0.0.0/0\" port port=\"52311\" protocol=\"tcp\" accept' --permanent\n",
"sudo firewall-offline-cmd --add-rich-rule='rule family=\"ipv4\" source address=\"0.0.0.0/0\" port port=\"52311\" protocol=\"udp\" accept' --permanent\n",
"sudo firewall-offline-cmd --add-rich-rule='rule family=\"ipv4\" source address=\"0.0.0.0/0\" port port=\"22\" protocol=\"tcp\" accept' --permanent\n",
"sudo firewall-offline-cmd --add-rich-rule='rule family=\"ipv4\" source address=\"0.0.0.0/0\" protocol value=\"icmp\" accept' --permanent\n",
"sudo firewall-offline-cmd --add-rich-rule='rule family=\"ipv4\" source address=\"0.0.0.0/0\" port port=\"68\" protocol=\"udp\" accept' --permanent\n",
"sudo firewall-offline-cmd --add-rich-rule='rule family=\"ipv4\" source address=\"0.0.0.0/0\" port port=\"323\" protocol=\"udp\" accept' --permanent\n",

"echo Starting firewalld\n",
"sudo systemctl start firewalld\n",

"echo Waiting for firewalld to be ready...\n",
"until sudo firewall-cmd --state >/dev/null 2>&1; do\n",
"    sleep 2\n",
"done\n",

"echo Create internal1 zone if not exists\n",
"if ! sudo firewall-cmd --get-zones | grep -q \"internal1\"; then\n",
"    sudo firewall-cmd --permanent --new-zone=internal1\n",
"    sudo firewall-cmd --reload\n",
"fi\n",

"echo Add service http to internal1 zone\n", 
"sudo firewall-cmd --zone=internal1 --add-service=http --permanent\n",
"sudo firewall-cmd --zone=internal1 --add-service=https --permanent\n",

"echo Reload firewalld to apply all changes\n",
"sudo firewall-cmd --reload\n"

关键注意事项 #

• 所有需要永久生效的配置必须添加--permanent参数
• firewalld启动后必须等待服务就绪再执行在线命令
• 使用自定义Zone前必须确认Zone已创建，否则命令会执行失败

内容的提问来源于stack exchange，提问作者ToyingWithUbuntu