// Module included in the following assemblies:
//
// * installing/install_config/configuring-firewall.adoc

:_mod-docs-content-type: PROCEDURE
[id="commatrix-revert-nftables_{context}"]
= Revert nftables firewall rules generated by the commatrix plugin

[role="_abstract"]
If you need to remove the `nftables` firewall rules from your cluster nodes, delete the `MachineConfig` resources, and then clean up the `NodeDisruptionPolicy` entries.

.Prerequisites

* You installed the {oc-first}.
* You logged in as a user with `cluster-admin` privileges.
* You applied `nftables` firewall rules generated by the `commatrix` plugin.

.Procedure

. Identify the `MachineConfig` resources created by the `commatrix` plugin by running the following command:
+
[source,terminal]
----
$ oc get machineconfig | grep nftables
----

. Delete the `MachineConfig` resource for each node pool by running the following command:
+
[source,terminal]
----
$ oc delete machineconfig 98-nftables-commatrix-<pool_name>
----

. Wait for all `MachineConfigPool` resources to return to the `UPDATED` state:
+
[source,terminal]
----
$ oc get mcp
----
+
.Example output showing pools in `UPDATED` state
[source,terminal]
----
NAME     CONFIG                                             UPDATED   UPDATING   DEGRADED   MACHINECOUNT   READYMACHINECOUNT   UPDATEDMACHINECOUNT   DEGRADEDMACHINECOUNT   AGE
master   rendered-master-a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6   True      False      False      1              1                   1                     0                      160d
worker   rendered-worker-a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6   True      False      False      0              0                   0                     0                      160d
----

. Open a debug shell on a target node by running the following commands:
+
[source,terminal]
----
$ oc debug node/<node_name>
sh-5.1# chroot /host
----
+
* `<node_name>` is the name of a cluster node.
* `chroot /host` accesses the host filesystem.

. Verify that the custom `nftables` rules were removed by running the following command:
+
[source,terminal]
----
sh-5.1# nft list ruleset 2>&1 | grep -q openshift_filter || echo "Custom rules removed"
----

. Remove the related `nftables` rules from the `NodeDisruptionPolicy` entries by editing the `MachineConfiguration` resource:
+
[source,terminal]
----
$ oc edit machineconfiguration cluster
----
+
Remove the `nftables.service` entry from `.spec.nodeDisruptionPolicy.units` and the `/etc/sysconfig/nftables.conf` entry from `.spec.nodeDisruptionPolicy.files`.
