On Fri, Sep 11, 2020 at 08:27:54PM -0000, Jason Long wrote: AFAIK, NFQUEUE action holds the packet and sends a copy to userspace. Userspace must issue a verdict. If no userspace is listening to NF_QUEUE then the packets will be dropped. So your traffic being dropped makes sense. Maybe add the `--queue-bypass` options. With this if no userspace is listening the packet will be accepted instead of dropped. Two options: 1. Use firewall-offline-cmd ``` # firewall-offline-cmd --direct --remove-rule ipv4 filter INPUT 0 -j NFQUEUE # firewall-offline-cmd --direct --remove-rule ipv4 filter OUTPUT 0 -j NFQUEUE ``` 2. manually edit `/etc/firewalld/direct.xml` - remove the direct XML elements that correspond to your direct rules above

On Fri, Sep 18, 2020 at 11:55:40AM -0000, Jason Long wrote: It does not affect firewalld's rules. Depends. The implications are: if FirewallBackend=iptables, then - firewalld's rules are bypassed. packet immediately accepted. if FirewallBackend=nftables, then - packet still subject to firewalld's rules. It may be dropped or accepted by firewalld.