{"id":2809,"date":"2018-10-22T23:04:34","date_gmt":"2018-10-22T17:34:34","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=2809"},"modified":"2026-09-29T22:56:08","modified_gmt":"2026-09-29T17:26:08","slug":"things-to-know-about-firewall-cmd","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/things-to-know-about-firewall-cmd\/","title":{"rendered":"Things to Know About firewall-cmd: Linux Firewall Configuration Guide"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>Post Date:<\/strong> October 22, 2018<br><strong>Last Updated:<\/strong> September 29, 2026<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><code>firewall-cmd<\/code> is the command-line client used to manage <strong>firewalld<\/strong>, a dynamic firewall management service commonly available on Linux systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It provides a convenient way to configure:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewall zones<\/li>\n\n\n\n<li>Services<\/li>\n\n\n\n<li>TCP\/UDP ports<\/li>\n\n\n\n<li>Network interfaces<\/li>\n\n\n\n<li>Source IP addresses<\/li>\n\n\n\n<li>Rich rules<\/li>\n\n\n\n<li>Masquerading<\/li>\n\n\n\n<li>Port forwarding<\/li>\n\n\n\n<li>Runtime and permanent firewall configurations<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most important concepts when working with firewalld is the difference between <strong>runtime<\/strong> and <strong>permanent<\/strong> configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The runtime configuration is currently active. Changes made without <code>--permanent<\/code> can be lost when firewalld is reloaded or restarted. Permanent configuration is stored and becomes active after a reload, restart, or system boot.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You should have:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A Linux server with <code>firewalld<\/code> installed<\/li>\n\n\n\n<li><code>root<\/code> or <code>sudo<\/code> access<\/li>\n\n\n\n<li>Basic Linux command-line knowledge<\/li>\n\n\n\n<li>Knowledge of the ports and services that your application actually requires<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The commands below are applicable to modern firewalld-based Linux systems. Package installation commands may differ depending on the distribution.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Implemenation<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">1. Install firewalld<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On systems using DNF:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo dnf install firewalld\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Start and enable the service:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo systemctl enable --now firewalld\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check the service:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo systemctl status firewalld\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check whether firewalld is running:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --state\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Expected output:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">running\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also check the installed version:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --version\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>firewall-cmd<\/code> is the primary command-line utility for querying and modifying firewalld configuration.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">2. Understand Runtime and Permanent Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is one of the most important concepts in firewalld.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Runtime Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Runtime configuration represents the rules currently active on the system.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --add-service=http\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This immediately allows HTTP traffic in the <code>public<\/code> zone.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, the change is not automatically saved to the permanent configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A firewalld reload can therefore remove a runtime-only change.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Permanent Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To save a rule permanently:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --add-service=http\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The permanent configuration must then be loaded into the runtime configuration:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Alternatively, you can apply a change both immediately and permanently with two commands:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --add-service=http\nsudo firewall-cmd --permanent --zone=public --add-service=http\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The official firewalld documentation recommends understanding this distinction before making production changes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Recommended Workflow<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For production systems, a useful approach is:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Make the change in runtime.<\/li>\n\n\n\n<li>Test connectivity.<\/li>\n\n\n\n<li>If everything works correctly, save it permanently.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">You can save the complete working runtime configuration with:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --runtime-to-permanent\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This overwrites the existing permanent configuration with the current runtime configuration.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">3. List Available Firewall Zones<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Firewalld uses <strong>zones<\/strong> to apply different firewall policies based on the trust level of a network connection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">List the available zones:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --get-zones\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Typical zones include:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">block\ndmz\ndrop\nexternal\nhome\ninternal\npublic\ntrusted\nwork\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The exact list can vary by firewalld installation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check the default zone:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --get-default-zone\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check currently active zones:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --get-active-zones\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also inspect the complete configuration of a zone:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-all\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">public\n  interfaces: eth0\n  services: ssh http https\n  ports:\n  protocols:\n  forward:\n  masquerade: no\n  rich rules:\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Firewalld zones provide a logical way to associate interfaces or source addresses with different firewall policies.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Change the Default Zone<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To change the default zone:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --set-default-zone=work\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --get-default-zone\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Be careful when changing the default zone on a remote production server. A zone change can alter which firewall rules apply to an interface and may affect remote access.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Add a Service to a Zone<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Firewalld provides predefined services such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SSH<\/li>\n\n\n\n<li>HTTP<\/li>\n\n\n\n<li>HTTPS<\/li>\n\n\n\n<li>DNS<\/li>\n\n\n\n<li>SMTP<\/li>\n\n\n\n<li>FTP<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">List available services:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --get-services\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For example, to allow HTTP in the <code>public<\/code> zone:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --add-service=http\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To make it permanent:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --add-service=http\nsudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Allow HTTPS:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --add-service=https\nsudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-services\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Using a predefined service is generally preferable when the required service already exists because you do not need to manually specify its standard ports.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">6. Remove a Service<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To remove a service from the runtime configuration:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --remove-service=http\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To remove it permanently:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --remove-service=http\nsudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-services\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">7. Open a Specific Port<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If a predefined service is not appropriate, you can open a specific port.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, to allow TCP port <code>8080<\/code>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --add-port=8080\/tcp\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To make it permanent:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --add-port=8080\/tcp\nsudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-ports\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For UDP:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --add-port=51820\/udp\nsudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can also specify a port range:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --add-port=5000-5010\/tcp\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The official firewalld documentation supports both individual ports and port ranges.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">8. Remove an Open Port<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To remove port <code>8080\/tcp<\/code>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --remove-port=8080\/tcp\nsudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-ports\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">9. Create a Custom Zone<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can create a custom zone when the predefined zones do not match your network requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Create a zone named <code>application<\/code>:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --new-zone=application\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Reload firewalld:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --get-zones\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You can then add services or ports to the new zone:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=application --add-port=8080\/tcp\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Reload:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Custom zones can be useful when different interfaces, applications, or source networks require different firewall policies.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">10. Associate a Network Interface with a Zone<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First identify the available network interfaces:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">ip addr\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check the zone associated with an interface:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --get-zone-of-interface=eth0\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To associate an interface with a zone:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=internal --add-interface=eth0\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Reload:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --get-active-zones\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Firewalld uses interface and source bindings to determine which zone&#8217;s rules apply to traffic.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Warning:<\/strong> On a remote server, changing the zone associated with the active network interface can disconnect your SSH session. Confirm that SSH access is permitted in the target zone before applying the change.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">11. Associate a Source IP or Network with a Zone<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Instead of assigning an entire interface to a zone, you can associate traffic from a specific source network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=internal --add-source=192.168.10.0\/24\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Reload:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Verify:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=internal --list-sources\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This can be useful when internal applications should receive different access from trusted network ranges.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">12. Delete a Custom Zone<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before deleting a custom zone, verify its configuration:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=application --list-all\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Delete it:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --delete-zone=application\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Reload:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Only delete custom zones after confirming that no required interfaces or source networks depend on them.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">13. Rich Rules<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For more advanced firewall conditions, firewalld supports <strong>rich rules<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rich rules allow conditions such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Source IP restrictions<\/li>\n\n\n\n<li>Specific services<\/li>\n\n\n\n<li>Specific ports<\/li>\n\n\n\n<li>Accept, reject, or drop actions<\/li>\n\n\n\n<li>Logging<\/li>\n\n\n\n<li>Rate limiting<\/li>\n\n\n\n<li>More detailed traffic conditions<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For example, to reject SSH connections from a specific IP address:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd \\\n  --permanent \\\n  --zone=public \\\n  --add-rich-rule='rule family=\"ipv4\" source address=\"192.168.1.100\" service name=\"ssh\" reject'\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Reload:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">List rich rules:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-rich-rules\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Remove the rule when required:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd \\\n  --permanent \\\n  --zone=public \\\n  --remove-rich-rule='rule family=\"ipv4\" source address=\"192.168.1.100\" service name=\"ssh\" reject'\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Firewalld&#8217;s rich language provides a more detailed rule syntax than simply opening or closing a service or port.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">14. Example: Allow SSH Only From a Trusted Network<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A common security requirement is to restrict SSH access to a known network.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd \\\n  --permanent \\\n  --zone=public \\\n  --add-rich-rule='rule family=\"ipv4\" source address=\"192.168.10.0\/24\" service name=\"ssh\" accept'\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">However, when implementing restrictive SSH rules, carefully consider the existing zone policy and ensure you have an alternative administrative path before testing the configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For cloud servers, also check the provider&#8217;s firewall or security-group rules.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">15. Check the Complete Firewall Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To display the configuration of the default zone:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --list-all\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For a specific zone:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-all\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To list all active zones:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --list-all-zones\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For the permanent configuration:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --list-all\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This distinction is useful when troubleshooting situations where a rule appears to exist but disappears after a reload.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">16. Reload firewalld<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After making permanent changes:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A reload applies the permanent configuration to the runtime environment. Firewalld is designed to preserve existing connections during a normal reload.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Avoid using:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --complete-reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">unless there is a specific reason to completely reload the firewall.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A complete reload can affect active connections and is intended for more serious firewall problems.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">17. Panic Mode<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Firewalld provides a panic mode for emergency situations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enable panic mode:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --panic-on\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check the status:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --query-panic\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Disable it:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --panic-off\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Panic mode drops incoming and outgoing packets and should only be used for serious network-security situations. It is a <strong>runtime-only<\/strong> setting and cannot be configured with <code>--permanent<\/code>.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Warning:<\/strong> Enabling panic mode on a remote server can immediately interrupt network connectivity, including SSH access.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">18. Check Whether a Port Is Actually Listening<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Opening a firewall port does not automatically mean that an application is listening on that port.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo ss -lntp\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To check a specific port:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo ss -lntp | grep :8080\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You should verify both:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>The application is listening on the port.<\/li>\n\n\n\n<li>The firewall allows the required traffic.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">For example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-ports\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">19. Test the Firewall From Another System<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">From another Linux system, you can test connectivity using:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">nc -vz SERVER_IP 8080\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For HTTP:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">curl -I http:\/\/SERVER_IP:8080\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For HTTPS:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">curl -Ik https:\/\/SERVER_IP\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the service is not reachable, check:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --state\nsudo firewall-cmd --get-active-zones\nsudo firewall-cmd --zone=public --list-all\nsudo ss -lntp\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Also check any external firewall provided by your hosting or cloud platform.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">20. Troubleshooting firewall-cmd<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\">Port is open but connection still fails<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Check whether the application is listening:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo ss -lntp | grep :8080\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then check firewalld:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-ports\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Also verify:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud security groups<\/li>\n\n\n\n<li>Cloud firewalls<\/li>\n\n\n\n<li>Network ACLs<\/li>\n\n\n\n<li>Load balancers<\/li>\n\n\n\n<li>Router\/firewall rules<\/li>\n\n\n\n<li>Application binding address<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Rule disappears after reload<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Check runtime configuration:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-all\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Check permanent configuration:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --list-all\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the rule exists only in runtime, add it permanently or use:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --runtime-to-permanent\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">SSH access was lost after firewall changes<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If possible, use:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud console<\/li>\n\n\n\n<li>Out-of-band management<\/li>\n\n\n\n<li>Existing administrative session<\/li>\n\n\n\n<li>Recovery console<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Then verify:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --get-active-zones\nsudo firewall-cmd --list-services\nsudo firewall-cmd --list-ports\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Make sure SSH is allowed in the correct zone:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-services\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">21. Security Recommendations<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">When managing a production Linux firewall:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Allow only required services<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Do not open ports simply because an application might use them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Check the application requirements first.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prefer services where appropriate<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For standard services:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">--add-service=http\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">is often clearer than:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">--add-port=80\/tcp\n<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Restrict administrative ports<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">SSH should ideally be restricted by:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Trusted source networks<\/li>\n\n\n\n<li>VPN access<\/li>\n\n\n\n<li>Bastion hosts<\/li>\n\n\n\n<li>Other appropriate access controls<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Avoid unnecessary public exposure<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Databases such as MySQL, PostgreSQL, Redis, and MongoDB generally should not be publicly exposed unless there is a specific architecture requiring it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Test before making changes permanent<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Use runtime configuration first when appropriate, verify connectivity, then persist the working configuration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Keep cloud-level controls aligned<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For cloud-hosted servers, firewalld is only one layer of network security. Also review:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud firewall<\/li>\n\n\n\n<li>Security groups<\/li>\n\n\n\n<li>Network ACLs<\/li>\n\n\n\n<li>Load balancer rules<\/li>\n\n\n\n<li>Private networking<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Keep the operating system supported<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Do not use an EOL operating system for new production deployments simply because an old firewall tutorial was written for it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CentOS Linux 7 reached EOL on June 30, 2024.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">22. Useful firewall-cmd Commands<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Purpose<\/th><th>Command<\/th><\/tr><\/thead><tbody><tr><td>Check firewalld state<\/td><td><code>firewall-cmd --state<\/code><\/td><\/tr><tr><td>Check version<\/td><td><code>firewall-cmd --version<\/code><\/td><\/tr><tr><td>List zones<\/td><td><code>firewall-cmd --get-zones<\/code><\/td><\/tr><tr><td>Check default zone<\/td><td><code>firewall-cmd --get-default-zone<\/code><\/td><\/tr><tr><td>List active zones<\/td><td><code>firewall-cmd --get-active-zones<\/code><\/td><\/tr><tr><td>List services<\/td><td><code>firewall-cmd --get-services<\/code><\/td><\/tr><tr><td>List zone configuration<\/td><td><code>firewall-cmd --zone=public --list-all<\/code><\/td><\/tr><tr><td>List open services<\/td><td><code>firewall-cmd --zone=public --list-services<\/code><\/td><\/tr><tr><td>List open ports<\/td><td><code>firewall-cmd --zone=public --list-ports<\/code><\/td><\/tr><tr><td>Add HTTP<\/td><td><code>firewall-cmd --zone=public --add-service=http<\/code><\/td><\/tr><tr><td>Add HTTPS permanently<\/td><td><code>firewall-cmd --permanent --zone=public --add-service=https<\/code><\/td><\/tr><tr><td>Open TCP port<\/td><td><code>firewall-cmd --zone=public --add-port=8080\/tcp<\/code><\/td><\/tr><tr><td>Reload configuration<\/td><td><code>firewall-cmd --reload<\/code><\/td><\/tr><tr><td>Save runtime configuration<\/td><td><code>firewall-cmd --runtime-to-permanent<\/code><\/td><\/tr><tr><td>Check panic mode<\/td><td><code>firewall-cmd --query-panic<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Conclusion<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\"><code>firewall-cmd<\/code> provides a structured way to manage Linux firewall rules through firewalld.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The most important concepts to understand are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Zones<\/strong> determine which firewall policy applies.<\/li>\n\n\n\n<li><strong>Services<\/strong> provide predefined groups of ports and protocols.<\/li>\n\n\n\n<li><strong>Ports<\/strong> can be opened directly when required.<\/li>\n\n\n\n<li><strong>Runtime configuration<\/strong> applies immediately but is not automatically persistent.<\/li>\n\n\n\n<li><strong>Permanent configuration<\/strong> survives reloads and reboots.<\/li>\n\n\n\n<li><strong>Rich rules<\/strong> provide more granular traffic controls.<\/li>\n\n\n\n<li><strong>Panic mode<\/strong> provides an emergency mechanism that drops network traffic.<\/li>\n\n\n\n<li>Firewall configuration should always be considered together with application listening ports and external cloud\/network firewalls.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For production systems, avoid blindly opening ports. Identify the required traffic, restrict access to trusted sources where possible, test the configuration, and keep the underlying operating system supported.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Frequently Asked Questions<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">What is firewall-cmd?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><code>firewall-cmd<\/code> is the command-line client used to manage firewalld.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What is the difference between firewall-cmd and firewalld?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><code>firewalld<\/code> is the firewall management service\/daemon. <code>firewall-cmd<\/code> is the command-line interface used to interact with it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What is the difference between runtime and permanent configuration?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Runtime configuration is currently active. Permanent configuration is stored and loaded when firewalld starts or reloads.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does <code>--permanent<\/code> immediately open the port?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. A permanent change is stored but does not immediately become active. Run:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --reload\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">to load the permanent configuration into the runtime environment.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How do I check whether port 8080 is allowed?<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --zone=public --list-ports\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">You should also check whether an application is listening:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo ss -lntp | grep :8080\n<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">How do I allow HTTP and HTTPS?<\/h3>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">sudo firewall-cmd --permanent --zone=public --add-service=http\nsudo firewall-cmd --permanent --zone=public --add-service=https\nsudo firewall-cmd --reload\n<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Can firewall-cmd block a specific IP?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Rich rules can be used to accept, reject, or drop traffic based on source addresses and other conditions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is CentOS 7 still recommended for new servers?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. CentOS Linux 7 reached EOL on June 30, 2024. New deployments should use a currently supported operating system.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Related Articles<\/h1>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/how-to-allow-any-tcp-port-via-firewall\/\">How to allow any TCP port via Firewall?<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/pheonixsolutions.com\/blog\/how-to-manage-the-csf-firewall-in-whm-cpanel\/\">How to Manage the CSF Firewall in WHM\/cPanel<\/a><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Talk to our experts<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Have a technology challenge or looking for the right solution for your business? Our team can help you with <strong>cloud, DevOps, development, infrastructure, design, and more<\/strong>. Feel free to reach out to our experts <a href=\"https:\/\/pheonixsolutions.com\/contact\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Post Date: October 22, 2018Last Updated: September 29, 2026 Introduction firewall-cmd is the command-line client used to manage firewalld, a [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1024],"tags":[460,458,459,423],"class_list":["post-2809","post","type-post","status-publish","format-standard","hentry","category-security","tag-commands","tag-firewall","tag-firewall-cmd","tag-firewalld","psol-cat-security"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-Jj","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2809","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=2809"}],"version-history":[{"count":1,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2809\/revisions"}],"predecessor-version":[{"id":12021,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2809\/revisions\/12021"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=2809"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=2809"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=2809"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}