This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
FAQ
Dynatrace Managed Q&A
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Looking to upgrade from Dynatrace Managed to SaaS? See how

Can Managed be installed or run without firewalld and nft present?

andre_vdveen
DynaMight Leader
DynaMight Leader

‎07 Apr 2026 01:07 PM

Hi,

A client is insisting they do not use local (operating system) firewalls in their environment and is questioning the need for firewalld and nftables for Managed. We've explained that it is used to make the Managed setup as secure as possible, incl. traffic between nodes, but they are adament that without any firewall blocking ports, we should be able to run Managed without firewalld and nft present.

Can Managed be installed and run without issues without those present?

The installer checks for this and warns that neither are present, but the question is whether the warning can be ignored without any future impact?
I know Managed has a firewall component, which I assume relies on nft/firewalld to operate correctly...but that really is the question: why is the firewall component critical when these systems are typically placed inside the client network (LAN), behind perimeter firewalls?

Reply
2 REPLIES 2

t_pawlak
Leader

‎07 Apr 2026 01:35 PM

Hi,

Dynatrace Managed can run without firewalld or nftables, and the installer warning is not blocking.

However, documentation shows that firewall rules are used for traffic routing and access control.

Here you have some related topisc:

So It is possible to disable the firewall, but then all network configuration and security must be handled manually.

Reply

andre_vdveen
DynaMight Leader
DynaMight Leader
In response to t_pawlak

‎09 Apr 2026 02:29 PM - edited ‎09 Apr 2026 02:47 PM

So, we can run Managed without firewalld active - tested that and it seems to be working as expected.

However, when the hosts are rebooted, the nftables ruleset is cleared and the Dynatrace firewall.sh script fails to load the nftables rules back (timeout), as it seemingly relies on firewalld - see output of firewall.sh status below.

./dynatrace.sh status
Redirecting to /bin/systemctl status dynatrace-firewall.service
× dynatrace-firewall.service - Dynatrace Firewall settings
Loaded: loaded (/etc/systemd/system/dynatrace-firewall.service; enabled; preset: disabled)
Active: failed (Result: timeout) since Thu 2026-04-09 15:28:55 SAST; 2min 15s ago
Main PID: 1617
CPU: 259ms

Apr 09 15:29:01 redacted.co.za firewall.sh[18570]: Error: Could not process rule: No such file or directory
Apr 09 15:29:01 redacted.co.za firewall.sh[18570]: insert rule inet firewalld mangle_PREROUTING jump dt_mangle_PREROUTING
Apr 09 15:29:01 redacted.co.za firewall.sh[18570]: ^^^^^^^^^
Apr 09 15:29:01 redacted.co.za firewall.sh[18576]: Error: Could not process rule: No such file or directory
Apr 09 15:29:01 redacted.co.za firewall.sh[18576]: insert rule inet firewalld filter_INPUT jump dt_filter_INPUT
Apr 09 15:29:01 redacted.co.za firewall.sh[18576]: ^^^^^^^^^
Apr 09 15:29:01 redacted.co.za firewall.sh[18578]: Error: Could not process rule: No such file or directory
Apr 09 15:29:01 redacted.co.za firewall.sh[18578]: insert rule inet firewalld filter_FORWARD jump dt_filter_FORWARD
Apr 09 15:29:01 redacted.co.za firewall.sh[18578]: ^^^^^^^^^
Apr 09 15:29:01 redacted.co.za firewall.sh[1617]: Adding rules ... failed.

 How do we get around this, and future proof it so that when Managed updates are applied, we do not have to redo all of the work manually again?

The current /etc/dynatrace.conf lists the following re: firewall

FIREWALL_ENABLED = true
FIREWALL_TYPE_DETECTION = on
FIREWALL_TYPE = nftables

 

0 Kudos
Reply
Ask a question

Featured Posts