topic Can Managed be installed or run without firewalld and nft present? in Dynatrace Managed Q&A

Can Managed be installed or run without firewalld and nft present?

andre_vdveen — Tue, 07 Apr 2026 12:07:23 GMT

Hi,

A client is insisting they do not use local (operating system) firewalls in their environment and is questioning the need for firewalld and nftables for Managed. We've explained that it is used to make the Managed setup as secure as possible, incl. traffic between nodes, but they are adament that without any firewall blocking ports, we should be able to run Managed without firewalld and nft present.

Can Managed be installed and run without issues without those present?

The installer checks for this and warns that neither are present, but the question is whether the warning can be ignored without any future impact?
I know Managed has a firewall component, which I assume relies on nft/firewalld to operate correctly...but that really is the question: why is the firewall component critical when these systems are typically placed inside the client network (LAN), behind perimeter firewalls?

Re: Can Managed be installed or run without firewalld and nft present?

t_pawlak — Tue, 07 Apr 2026 12:35:54 GMT

Hi,

Dynatrace Managed can run without firewalld or nftables, and the installer warning is not blocking.

However, documentation shows that firewall rules are used for traffic routing and access control.

Here you have some related topisc:

So It is possible to disable the firewall, but then all network configuration and security must be handled manually.

Re: Can Managed be installed or run without firewalld and nft present?

andre_vdveen — Thu, 09 Apr 2026 13:47:46 GMT

So, we can run Managed without firewalld active - tested that and it seems to be working as expected.

However, when the hosts are rebooted, the nftables ruleset is cleared and the Dynatrace firewall.sh script fails to load the nftables rules back (timeout), as it seemingly relies on firewalld - see output of firewall.sh status below.

./dynatrace.sh status
Redirecting to /bin/systemctl status dynatrace-firewall.service
× dynatrace-firewall.service - Dynatrace Firewall settings
Loaded: loaded (/etc/systemd/system/dynatrace-firewall.service; enabled; preset: disabled)
Active: failed (Result: timeout) since Thu 2026-04-09 15:28:55 SAST; 2min 15s ago
Main PID: 1617
CPU: 259ms

Apr 09 15:29:01 redacted.co.za firewall.sh[18570]: Error: Could not process rule: No such file or directory
Apr 09 15:29:01 redacted.co.za firewall.sh[18570]: insert rule inet firewalld mangle_PREROUTING jump dt_mangle_PREROUTING
Apr 09 15:29:01 redacted.co.za firewall.sh[18570]: ^^^^^^^^^
Apr 09 15:29:01 redacted.co.za firewall.sh[18576]: Error: Could not process rule: No such file or directory
Apr 09 15:29:01 redacted.co.za firewall.sh[18576]: insert rule inet firewalld filter_INPUT jump dt_filter_INPUT
Apr 09 15:29:01 redacted.co.za firewall.sh[18576]: ^^^^^^^^^
Apr 09 15:29:01 redacted.co.za firewall.sh[18578]: Error: Could not process rule: No such file or directory
Apr 09 15:29:01 redacted.co.za firewall.sh[18578]: insert rule inet firewalld filter_FORWARD jump dt_filter_FORWARD
Apr 09 15:29:01 redacted.co.za firewall.sh[18578]: ^^^^^^^^^
Apr 09 15:29:01 redacted.co.za firewall.sh[1617]: Adding rules ... failed.

How do we get around this, and future proof it so that when Managed updates are applied, we do not have to redo all of the work manually again?

The current /etc/dynatrace.conf lists the following re: firewall

FIREWALL_ENABLED = true
FIREWALL_TYPE_DETECTION = on
FIREWALL_TYPE = nftables