invis-server » invisAD-setup

It seems that firewalld starts to early. The original service-unit file defines to start firewalld before "network-pre.target":

"[Unit]
Description=firewalld - dynamic firewall daemon
Before=network-pre.target
Wants=network-pre.target
After=dbus.service
After=polkit.service
..."

Starting firewalld later brings the risk that the system runs for a few moments without the firewall. Sytemd knows three different network targets. "network-pre.target", "network.target" and "network-online.target". The last one means that all network interfaces are up and online. Starting the firewall before this target should be secure enough.

Changing the firewalld service-unit file to:

"[Unit]
Description=firewalld - dynamic firewall daemon
After=network-pre.target
Before=network-online.target
After=dbus.service
After=polkit.service
..."

did the job. This should be secure enough.