// Module included in the following assemblies:
//
// * microshift_networking/microshift-networking.adoc

:_mod-docs-content-type: CONCEPT
[id="microshift-firewall-known-issue_{context}"]
= Known firewall issue

[role="_abstract"]
To avoid traffic failures after a firewalld reload or restart on {microshift-short}, run firewall commands before you start {op-system-base-full}. If you must run firewall commands later, restart the `ovnkube-master` pod in `openshift-ovn-kubernetes` to restore iptable rules that OVN-Kubernetes manages.

The CNI driver in {microshift-short} makes use of iptable rules for some traffic flows, such as those using the NodePort service. The iptable rules are generated and inserted by the CNI driver, but are deleted when the firewall reloads or restarts. The absence of the iptable rules breaks traffic flows.