Podman network communcation broken after update to tumbleweed 20260717 / 18

[formwandler]

After updating to tumbleweed 20260718, my Podman internal network does not work any more as before/expected in terms of blocking (even forwarded) connections.

• Outgoing connections from docker container (e.g. monitoring system) to the host network are blocked, like pinging or HTTPing from container to a host in host network.
• Incoming connections from host network or Internet to the docker containers are blocked as well (even though ports are forwarded).
• What still works: reverse proxy connection into container on localhost (e.g. in Apache like ws://localhost:3001/$1)

I expect that the new firewalld (2.1.2 → 2.3.2) from 20260717 is causing these issues, since podman and kernel are still the same. I already checked the firewalld settings, which seem all okay. Podman containers are running rootful. I am not a docker/podman network guru, but that setup runs since years

Is someone else facing similar issues?
I can of course provide mot info.

[dezza]

I think one of the best things I did was uninstall firewalld and just write my own nftables. First I was writing wrapper script for firewalld and thats when I realized how much it truly sucked, its not worth using.

[formwandler]

After performing a lot of troubleshooting on firewalld and Podman (5.8) with hints about firewalld 2.3 and/or nftables would not work well with Podman (any more?), I did the trick:

I removed podman0 interface from the “trusted” zone (i.e. no zone assigned at all) and rebooted the system. Now, Podman interacts well with firewalld again.

BTW: When troubleshooting I thought just stopping firewalld service would disable the firewall completely and all connections would be allowed (incl. containers reachable again), but that was false. I had to flush all rulesets manually nft flush ruleset.

[dezza]

Leaving a base template for integrating with podman. My nftables policy framework is modular, but since solved I figure you can figure it out

# podman network inspect podman
# [
#      {
#           "name": "podman",
#           "id": "2f259bab93aaaaa2542ba43ef33eb990d0999ee1b9924b557b7be53c0b7a1bb9",
#           "driver": "bridge",
#           "network_interface": "podman0",
#           "created": "2026-05-13T13:18:03.878217706+02:00",
#           "subnets": [
#                {
#                     "subnet": "10.88.0.0/16",
#                     "gateway": "10.88.0.1"
#                }
#           ],
#           "ipv6_enabled": false,
#           "internal": false,
#           "dns_enabled": false,
#           "ipam_options": {
#                "driver": "host-local"
#           },
#           "containers": {}
#      }
# ]

foward.nft

# Config
define PODMAN_SUBNET = 10.88.0.0/16
define PODMAN_GATEWAY = $GATEWAY

# Any out
ip saddr $PODMAN_SUBNET counter accept comment "accept forward podman-container"
ip saddr $PODMAN_GATEWAY counter accept comment "accept forward podman-gw"

# Any in
ip daddr $PODMAN_SUBNET counter accept comment "accept forward podman-input"

input.nft

ip saddr 10.88.0.0/16 counter accept comment "accept input podman"

… also wanted to clarify my dislike to firewalld is not baseless… More time was spent reading man-pages, writing xml profiles and then finding more shortcomings in the firewall-cmd.

As a user-friendly firewall cli it quickly falls short - the more you commit to its idioms the more abstraction cost is added, about equal with nftables - but more flexible and standard.

Good luck!