firewalld Runtime vs Permanent
You run firewall-cmd --permanent --zone=public --add-service=https. The command prints success, but clients still cannot reach port 443. Nginx is listening. What is the most likely reason?
firewall-cmd --permanent --zone=public --add-service=https
success
Choose one answer
--permanent only changes the saved configuration; the running firewall changes after firewall-cmd --reload.
--permanent
firewall-cmd --reload
firewalld needs a full systemctl restart firewalld after every change, and nothing less works.
systemctl restart firewalld
The --zone flag cannot be combined with --permanent.
--zone
The https service must be added to the trusted zone instead of public.
https
trusted
public