diff --git a/libnetwork/drivers/bridge/bridge_linux.go b/libnetwork/drivers/bridge/bridge_linux.go
index ee79b79548..4af11e326e 100644
--- a/libnetwork/drivers/bridge/bridge_linux.go
+++ b/libnetwork/drivers/bridge/bridge_linux.go
@@ -939,9 +939,10 @@ func (d *driver) createNetwork(config *networkConfiguration) (err error) {
 
 		// We want to track firewalld configuration so that
 		// if it is started/reloaded, the rules can be applied correctly
-		{config.EnableIPv4 && d.config.EnableIPTables, network.setupFirewalld},
-		// same for IPv6
-		{config.EnableIPv6 && d.config.EnableIP6Tables, network.setupFirewalld6},
+		{
+			(config.EnableIPv4 && d.config.EnableIPTables) || (config.EnableIPv6 && d.config.EnableIP6Tables),
+			network.setupFirewalld,
+		},
 
 		// Setup DefaultGatewayIPv4
 		{config.DefaultGatewayIPv4 != nil, setupGatewayIPv4},
diff --git a/libnetwork/drivers/bridge/port_mapping_linux.go b/libnetwork/drivers/bridge/port_mapping_linux.go
index 2a80950372..f1dd719b1f 100644
--- a/libnetwork/drivers/bridge/port_mapping_linux.go
+++ b/libnetwork/drivers/bridge/port_mapping_linux.go
@@ -962,15 +962,7 @@ func rawRulesDisabled(ctx context.Context) bool {
 	return false
 }
 
-func (n *bridgeNetwork) reapplyPerPortIptables4() {
-	n.reapplyPerPortIptables(func(b portBinding) bool { return b.IP.To4() != nil })
-}
-
-func (n *bridgeNetwork) reapplyPerPortIptables6() {
-	n.reapplyPerPortIptables(func(b portBinding) bool { return b.IP.To4() == nil })
-}
-
-func (n *bridgeNetwork) reapplyPerPortIptables(needsReconfig func(portBinding) bool) {
+func (n *bridgeNetwork) reapplyPerPortIptables() {
 	n.Lock()
 	var allPBs []portBinding
 	for _, ep := range n.endpoints {
@@ -979,10 +971,8 @@ func (n *bridgeNetwork) reapplyPerPortIptables(needsReconfig func(portBinding) b
 	n.Unlock()
 
 	for _, b := range allPBs {
-		if needsReconfig(b) {
-			if err := n.setPerPortIptables(context.Background(), b, true); err != nil {
-				log.G(context.TODO()).Warnf("Failed to reconfigure iptables on firewalld reload %s: %s", b, err)
-			}
+		if err := n.setPerPortIptables(context.Background(), b, true); err != nil {
+			log.G(context.TODO()).Warnf("Failed to reconfigure iptables on firewalld reload %s: %s", b, err)
 		}
 	}
 }
diff --git a/libnetwork/drivers/bridge/setup_firewalld.go b/libnetwork/drivers/bridge/setup_firewalld.go
index c2bd225a63..17877e2478 100644
--- a/libnetwork/drivers/bridge/setup_firewalld.go
+++ b/libnetwork/drivers/bridge/setup_firewalld.go
@@ -3,39 +3,18 @@
 package bridge
 
 import (
-	"errors"
-
 	"github.com/docker/docker/libnetwork/iptables"
 )
 
 func (n *bridgeNetwork) setupFirewalld(config *networkConfiguration, i *bridgeInterface) error {
-	d := n.driver
-	d.Lock()
-	driverConfig := d.config
-	d.Unlock()
-
-	// Sanity check.
-	if !driverConfig.EnableIPTables {
-		return errors.New("no need to register firewalld hooks, iptables is disabled")
+	// FIXME(robmry) - these reload functions aren't deleted when the network is deleted.
+	//  So, a firewalld reload leads to creation of zombie rules belonging to those networks.
+	if n.driver.config.EnableIPTables && config.EnableIPv4 {
+		iptables.OnReloaded(func() { n.setupIP4Tables(config, i) })
 	}
-
-	iptables.OnReloaded(func() { n.setupIP4Tables(config, i) })
-	iptables.OnReloaded(n.reapplyPerPortIptables4)
-	return nil
-}
-
-func (n *bridgeNetwork) setupFirewalld6(config *networkConfiguration, i *bridgeInterface) error {
-	d := n.driver
-	d.Lock()
-	driverConfig := d.config
-	d.Unlock()
-
-	// Sanity check.
-	if !driverConfig.EnableIP6Tables {
-		return errors.New("no need to register firewalld hooks, ip6tables is disabled")
-	}
-
-	iptables.OnReloaded(func() { n.setupIP6Tables(config, i) })
-	iptables.OnReloaded(n.reapplyPerPortIptables6)
+	if n.driver.config.EnableIP6Tables && config.EnableIPv6 {
+		iptables.OnReloaded(func() { n.setupIP6Tables(config, i) })
+	}
+	iptables.OnReloaded(n.reapplyPerPortIptables)
 	return nil
 }