My IPtables -L shows a pretty complex structure that seems to only be present when using firewalld. For instance... Such chains as FWDI_public (which invokes FWDI_public_pre, FWDI_public_log, FWDI_public_deny, FWDI_public_allow, and FWDI_public_post. Same for FWDO_public, IN_public, etc. Chain IN_public (2 references) target prot opt source destination IN_public_pre all -- 0.0.0.0/0 0.0.0.0/0 IN_public_log all -- 0.0.0.0/0 0.0.0.0/0 IN_public_deny all -- 0.0.0.0/0 0.0.0.0/0 IN_public_allow all -- 0.0.0.0/0 0.0.0.0/0 IN_public_post all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 In all of the chains that call their corresponding _pre, _post, etc., I find that my _deny comes before my _allow. This means that everything is denied, and the specific allows don't function. On other servers, _allow precedes _deny, as one would expect. My question is, "Does FirewallD create these chains and subchains? If so, Where in Firewalld does the order that puts deny before allow get defined so I can fix it? Ed