If a direct rule fails to insert for any reason (e.g. improper args), then all following direct rules with a higher priority will also fail to insert.

firewalld is translating a priority to an iptables insert index, but this logic breaks down if the previous insertion fails. firewalld should be able to detect the failure and adjust insert indexes appropriately.

This is especially problematic for permanent rules because the errors are hidden away in the log.

[root@dev-rhel7 ~]# firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -m set --match-set foobar -p tcp --dport 443 -j DROP
[root@dev-rhel7 ~]# firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 10 -m set --match-set foobar dst -p tcp --dport 8080 -j DROP                                               
success
[root@dev-rhel7 ~]# firewall-cmd --reload
success


[root@dev-rhel7 ~]# systemctl status -l -n 50 firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: active (running) since Thu 2017-10-05 10:22:47 EDT; 9min ago
     Docs: man:firewalld(1)
 Main PID: 5732 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─5732 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

[...]
 Oct 05 10:31:53 dev-rhel7 firewalld[5732]: WARNING: '/usr/sbin/iptables -w2 -t filter -I OUTPUT_direct 1 -m set --match-set foobar -p tcp --dport 443 -j DROP' failed: iptables v1.4.21: --match-set requires two args.
                                           Try `iptables -h' or 'iptables --help' for more information.
Oct 05 10:31:53 dev-rhel7 firewalld[5732]: WARNING: '/usr/sbin/iptables -w2 -t filter -I OUTPUT_direct 2 -m set --match-set foobar dst -p tcp --dport 8080 -j DROP' failed: iptables: Index of insertion too big.                                          


Here "Index of insertion too big" means we requested inserting to index 2, but there is no index 1.