I am using chef firewall cookbook in the following way:firewall 'default'firewall_rule 'ssh' do    port 22endIt configures firewalld internally by writing commands like this to /etc/sysconfig/firewalld-chef.rules:firewall-cmd --direct --add-rule ipv4 filter INPUT 50 -p tcp -m tcp -m multiport --dports 22 -m comment --comment 'ssh' -j ACCEPTfirewall-cmd --direct --add-rule ipv6 filter INPUT 50 -p tcp -m tcp -m multiport --dports 22 -m comment --comment 'ssh' -j ACCEPTHowever, after systemctl restart firewalld, these changes are not applied. I lack experience with Linux network configuration, so I don't know how can I continue. Is there an easy way to set this file to run with firewalld start? Am I doing something wrong in my recipe?
How are chef firewall rules applied to firewalld in CentOS 7?
centos;firewalld;chef
The firewall cookbook is using /etc/sysconfig/firewalld-chef.rules to track the state of the firewall rules. It builds the list of commands it should run, and if the list is different than the contents of that file, it reapplies the whole file by clearing the ruleset and then running each command in the file. It doesn't necessarily run that file directly.We had someone contribute the original logic in this recipe, so I couldn't tell you much more about the way they are using it, but running the :save action seems to be the intended way to ensure the rules are permanent. If you're trying to be sure the rules are applied on startup, try running the firewall resource's :save action after all of the firewall_rule(s) are applied.