# Rocky-8: FirewallD reload extreme slow with hughe IPSET list

**URL:** <https://forums.rockylinux.org/t/rocky-8-firewalld-reload-extreme-slow-with-hughe-ipset-list/15970>\
**Category:** Rocky Linux Help & Support\
**Created:** [September 26, 2024, 10:36am UTC](https://forums.rockylinux.org/t/rocky-8-firewalld-reload-extreme-slow-with-hughe-ipset-list/15970 "2024-09-26T10:36:51Z")\
**Posts on this page:** 4\
**Page:** 2

<div class="post-metadata">

**Author:** ![TecWolf](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/tecwolf/32/1193_2.png) [@TecWolf](https://forums.rockylinux.org/u/TecWolf)\
**Post date:** [October 3, 2024, 10:40pm UTC](https://forums.rockylinux.org/t/rocky-8-firewalld-reload-extreme-slow-with-hughe-ipset-list/15970/21 "2024-10-03T22:40:56Z")

</div>

I have done that. The rule is not active until a reload/restart.

---

<div class="post-metadata">

**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\
**Post date:** [October 4, 2024, 6:05am UTC](https://forums.rockylinux.org/t/rocky-8-firewalld-reload-extreme-slow-with-hughe-ipset-list/15970/22 "2024-10-04T06:05:54Z")

</div>

If using the firewalld commands that I gave previously that is simply not possible. See below how my public zone looks:

```auto
root@rocky9:~# firewall-cmd --info-zone=public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens33
  sources: 
  services: cockpit dhcpv6-client mssql ssh
  ports: 
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
	port=443:proto=tcp:toport=8443:toaddr=
  source-ports: 
  icmp-blocks: 
  rich rules: 

```

You can clearly see the `ports:` section is empty. Now I am going to add port 6443:

```auto
root@rocky9:~# firewall-cmd --zone=public --add-port=6443/tcp
success

```

as you can see a reload hasn’t been done, now let’s check what is active:

```auto
root@rocky9:~# firewall-cmd --info-zone=public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens33
  sources: 
  services: cockpit dhcpv6-client mssql ssh
  ports: 6443/tcp
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
	port=443:proto=tcp:toport=8443:toaddr=
  source-ports: 
  icmp-blocks: 
  rich rules:

```

as you can see port 6443 is clearly there. If I use a reload now, I will lose that configuration because I have not yet used the second command that I gave with the permanent parameter which is the one that saves it to the configuration. Whether I use Rocky 8 or Rocky 9 the results are still the same. If it doesn’t work for you then it would suggest your machine is messed up from whatever you have been trying up until now.

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [October 4, 2024, 7:20am UTC](https://forums.rockylinux.org/t/rocky-8-firewalld-reload-extreme-slow-with-hughe-ipset-list/15970/23 "2024-10-04T07:20:27Z")

</div>

To be fair, there are `firewall-cmd` commands where the `--permanent` is obligatory. For example, the `--new-policy`.  
However, since these cannot be run without `--permanent`, it should be evident that they do not take effect before reload.

There is also `--runtime-to-permanent` action. If you can make all changes on runtime, then you can save current runtime config to (permanent) files in one go, saving you from rerunning all commands with the `--permanent`.

* * *

Another way to check whether command has any effect on runtime:

```bash
nft list ruleset > before.nft
firewall-cmd ...
nft list ruleset > after.nft
diff before.nft after.nft

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [December 3, 2024, 7:20am UTC](https://forums.rockylinux.org/t/rocky-8-firewalld-reload-extreme-slow-with-hughe-ipset-list/15970/24 "2024-12-03T07:20:28Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

[Previous page](https://forums.rockylinux.org/t/rocky-8-firewalld-reload-extreme-slow-with-hughe-ipset-list/15970.md?page=1)