How to fix Error response from daemon: driver failed programming external connectivity: firewalld is not running in Docker

DockerINTERMEDIATEMEDIUMUpdated Dec 6, 2025· 224 views

This error occurs when Docker expects firewalld to manage network rules but the firewall service is not running. The fix involves either starting firewalld or configuring Docker to work without it by restarting the Docker daemon.

Quick fix

Fixes Error response from daemon: driver failed programming external connectivity: firewalld is not running

# Check if firewalld is installed
rpm -qa | grep firewalld
# or on Debian-based systems
dpkg -l | grep firewalld

# Check firewalld service status
sudo systemctl status firewalld
  1. Check the current status of firewalld
  2. Start firewalld service
  3. Restart Docker daemon
  4. Test container port publishing
docker — error
# Check if firewalld is installed
rpm -qa | grep firewalld
# or on Debian-based systems
dpkg -l | grep firewalld
# Check firewalld service status
sudo systemctl status firewalld
Error response from daemon: driver failed programming external connectivity: firewalld is not running

What this error means

Docker on Linux uses iptables to manage network traffic for containers. When Docker is configured to integrate with firewalld (the dynamic firewall daemon used by RHEL, CentOS, Fedora, and other systemd-based distributions), it expects firewalld to be running so it can properly set up NAT rules and port forwarding for containers. The error "driver failed programming external connectivity: firewalld is not running" indicates that Docker's network driver attempted to configure port publishing rules through firewalld, but the firewalld service was stopped or disabled. This typically happens when: - The system was rebooted and firewalld didn't start automatically - An administrator manually stopped firewalld - Docker was installed after firewalld was disabled - A system update changed firewall configuration Without proper firewall rules, Docker cannot publish container ports to the host, preventing external access to your containerized applications.

Typical symptoms

  • Docker containers fail to start when publishing ports with -p flag
  • docker run or docker-compose up exits with 'driver failed programming external connectivity' error
  • The error specifically mentions 'firewalld is not running'
  • Containers without port mappings start normally
  • The issue appeared after system reboot or firewall service changes
  • Running 'systemctl status firewalld' shows the service is inactive or dead

Common causes

  1. firewalld service is stopped or not running on the host system
  2. firewalld was disabled and the system was rebooted
  3. Docker daemon started before firewalld during system boot
  4. firewalld was manually stopped while Docker was running
  5. System administrator replaced firewalld with iptables but Docker still expects firewalld
  6. Docker's iptables configuration became stale after firewall restart

How to fix "Error response from daemon: driver failed programming external connectivity: firewalld is not running"

1Check the current status of firewalld

First, verify whether firewalld is installed and check its current status:

bash
# Check if firewalld is installed
rpm -qa | grep firewalld
# or on Debian-based systems
dpkg -l | grep firewalld

# Check firewalld service status
sudo systemctl status firewalld

If the output shows "inactive (dead)" or "disabled", the service is not running. If firewalld is not installed at all, you'll need to either install it or configure Docker to use iptables directly.

2Start firewalld service

If firewalld is installed but stopped, start it:

bash
# Start firewalld
sudo systemctl start firewalld

# Verify it's running
sudo systemctl status firewalld

You should see "active (running)" in the output. If the service fails to start, check the logs with journalctl -u firewalld for error details.

3Restart Docker daemon

After starting firewalld, restart Docker so it can properly configure its network rules:

bash
# Restart Docker
sudo systemctl restart docker

# Verify Docker is running
sudo systemctl status docker

Docker will now detect firewalld and configure its iptables rules through the firewalld interface.

4Test container port publishing

Verify the fix by running a container with port mapping:

bash
# Test with a simple nginx container
docker run -d --name test-nginx -p 8080:80 nginx

# Verify it's running
docker ps

# Test connectivity
curl http://localhost:8080

If the container starts successfully and you can access it, the issue is resolved.

5Enable firewalld to start on boot

To prevent this error from recurring after reboots, enable firewalld to start automatically:

bash
# Enable firewalld on boot
sudo systemctl enable firewalld

# Verify it's enabled
sudo systemctl is-enabled firewalld

The output should show "enabled".

6Alternative: Configure Docker without firewalld

If you prefer not to use firewalld, you can configure Docker to manage iptables directly. First, stop and disable firewalld:

bash
# Stop and disable firewalld
sudo systemctl stop firewalld
sudo systemctl disable firewalld

Then ensure iptables is available and restart Docker:

bash
# Install iptables if needed (RHEL/CentOS)
sudo yum install iptables-services

# Start iptables
sudo systemctl start iptables
sudo systemctl enable iptables

# Clear any stale rules and restart Docker
sudo iptables -t filter -F
sudo iptables -t filter -X
sudo systemctl restart docker

Note: This approach requires you to manually manage firewall rules for host security.

7Handle boot order issues

If the error occurs intermittently after reboots, Docker may be starting before firewalld. Create a systemd override to ensure correct ordering:

bash
# Create override directory
sudo mkdir -p /etc/systemd/system/docker.service.d/

# Create override file
sudo tee /etc/systemd/system/docker.service.d/firewalld.conf << 'EOF'
[Unit]
After=firewalld.service
Requires=firewalld.service
EOF

# Reload systemd and restart Docker
sudo systemctl daemon-reload
sudo systemctl restart docker

This ensures Docker waits for firewalld to be fully started before initializing.

8Add Docker zone to firewalld (advanced setup)

For better integration, add the docker0 interface to firewalld's trusted zone:

bash
# Add docker0 to trusted zone
sudo firewall-cmd --permanent --zone=trusted --add-interface=docker0

# Enable masquerading for container internet access
sudo firewall-cmd --permanent --zone=public --add-masquerade

# Reload firewalld
sudo firewall-cmd --reload

# Restart Docker
sudo systemctl restart docker

This configuration allows containers to communicate freely while maintaining firewall protection on other interfaces.

Advanced notes

Understanding Docker and firewalld interaction:
Docker can work with different firewall backends. On systems with firewalld, Docker detects it and uses firewalld's D-Bus interface to manage rules. If firewalld is stopped, Docker falls back to direct iptables manipulation, but only if it's restarted after the firewall change.

The --iptables flag:
If you consistently run without firewalld, you can disable Docker's automatic iptables management by setting --iptables=false in /etc/docker/daemon.json:

json
{
  "iptables": false
}

However, this means you must manually configure all port forwarding rules, which is not recommended for most users.

nftables vs iptables:
Modern Linux distributions are transitioning from iptables to nftables. Docker's firewalld integration generally handles this transparently, but mismatches between Docker's expected backend and the system's actual backend can cause issues. Check your system with:

bash
firewall-cmd --state
nft list ruleset

SELinux considerations:
On SELinux-enabled systems, firewall rule changes may be blocked by SELinux policies. If firewalld starts but Docker still fails, check for SELinux denials:

bash
sudo ausearch -m avc -ts recent

Container networking modes:
This error only affects containers using bridge networking with port publishing. Containers using --network=host or --network=none bypass Docker's NAT rules entirely and won't trigger this error.

Frequently asked questions

What does "Error response from daemon: driver failed programming external connect" mean?
Docker on Linux uses iptables to manage network traffic for containers. When Docker is configured to integrate with firewalld (the dynamic firewall daemon used by RHEL, CentOS, Fedora, and other systemd-based distributions), it expects firewalld to be running so it can properly set up NAT rules and port forwarding for containers. The error "driver failed programming external connectivity: firewalld is not running" indicates that Docker's network driver attempted to configure port publishing rules through firewalld, but the firewalld service was stopped or disabled.
How do I fix "Error response from daemon: driver failed programming external connect"?
This error occurs when Docker expects firewalld to manage network rules but the firewall service is not running. The fix involves either starting firewalld or configuring Docker to work without it by restarting the Docker daemon.
What causes "Error response from daemon: driver failed programming external connect"?
firewalld service is stopped or not running on the host system firewalld was disabled and the system was rebooted Docker daemon started before firewalld during system boot
Is the "Error response from daemon: driver failed programming external connect" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading