Firewall (firewalld)

firewalld is the default dynamic firewall management tool on CentOS / AlmaLinux / Rocky Linux. It provides zone-based firewall management and supports modifying rules at runtime without restarting the service.

firewalld Basic Concepts

Zones

Zones are the core concept of firewalld. Each zone defines a set of trust levels and corresponding firewall rules, and network interfaces are assigned to different zones.

Commonly used built-in zones:

Zone	Description
public	Default zone. Suitable for public network environments; only selected inbound connections are allowed
trusted	Allows all inbound traffic
home	Suitable for home networks; trusts other devices on the network
work	Suitable for work networks
internal	Suitable for internal networks
dmz	Suitable for servers in a DMZ; only specific inbound connections are allowed
external	Suitable for external networks with NAT masquerading enabled
block	Rejects all inbound connections and returns an ICMP rejection message
drop	Drops all inbound packets without returning any response

Checking firewalld Service Status

View firewalld running status

sudo systemctl status firewalld

Start and enable at boot

sudo systemctl enable --now firewalld

Check if firewalld is running

sudo firewall-cmd --state

firewall-cmd Basic Operations

Viewing the Current Configuration

View the default zone

sudo firewall-cmd --get-default-zone

View all active zones and their bound interfaces

sudo firewall-cmd --get-active-zones

View the complete rules for the current zone

sudo firewall-cmd --list-all

View rules for a specific zone

sudo firewall-cmd --zone=public --list-all

List all available zones

sudo firewall-cmd --get-zones

Viewing Available Services

List all predefined services

sudo firewall-cmd --get-services

View the detailed definition of a service (e.g., http)

sudo firewall-cmd --info-service=http

Permanent Rules vs. Runtime Rules

firewalld rules come in two types:

• Runtime rules: Take effect immediately but are lost after restarting firewalld or the system
• Permanent rules: Written to configuration files and persist after a restart, but do not take effect immediately

Tip

Recommended workflow: Add rules with the --permanent flag to make them persistent, then run --reload to apply them immediately.

Add a permanent rule and apply it immediately

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload

You can also add both runtime and permanent rules simultaneously (no reload needed):

Apply both runtime and permanent rules at once

sudo firewall-cmd --add-service=http
sudo firewall-cmd --permanent --add-service=http

Allowing Services

Adding a Service

Allow HTTP service (permanent)

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload

Allow both HTTP and HTTPS

sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --reload

Removing a Service

Remove HTTP service allowance (permanent)

sudo firewall-cmd --permanent --remove-service=http
sudo firewall-cmd --reload

Viewing Allowed Services

List services allowed in the current zone

sudo firewall-cmd --list-services

Allowing Ports

Adding a Port

Allow TCP port 8080

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

Allow a UDP port

sudo firewall-cmd --permanent --add-port=53/udp
sudo firewall-cmd --reload

Allow a port range

sudo firewall-cmd --permanent --add-port=3000-3100/tcp
sudo firewall-cmd --reload

Removing a Port

Remove a port allowance

sudo firewall-cmd --permanent --remove-port=8080/tcp
sudo firewall-cmd --reload

Viewing Allowed Ports

List currently allowed ports

sudo firewall-cmd --list-ports

Zone Operations

Changing the Default Zone

Change the default zone to internal

sudo firewall-cmd --set-default-zone=internal

Assigning an Interface to a Specific Zone

Assign ens33 to the internal zone

sudo firewall-cmd --permanent --zone=internal --change-interface=ens33
sudo firewall-cmd --reload

Adding Rules to a Specific Zone

Allow MySQL service in the internal zone

sudo firewall-cmd --permanent --zone=internal --add-service=mysql
sudo firewall-cmd --reload

Rich Rules

Rich rules provide more granular firewall control, allowing you to flexibly set rules based on source addresses, destination addresses, ports, and other conditions.

Basic Syntax

The basic structure of a rich rule:

rule family="ipv4" source address="source_address" service name="service_name" accept/reject/drop

Allowing a Specific IP to Access a Service

Allow only the 192.168.1.0/24 subnet to access SSH

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" service name="ssh" accept'
sudo firewall-cmd --reload

Denying Access from a Specific IP

Drop all connections from 10.0.0.100

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.100" drop'
sudo firewall-cmd --reload

Allowing a Specific IP to Access a Given Port

Allow 172.16.0.0/16 to access TCP port 3306

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="172.16.0.0/16" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload

Rules with Logging

Log and drop connections from a specific IP

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.200" log prefix="BLOCKED: " level="warning" drop'
sudo firewall-cmd --reload

Viewing Rich Rules

List all current rich rules

sudo firewall-cmd --list-rich-rules

Deleting a Rich Rule

Delete a specific rich rule

sudo firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="10.0.0.100" drop'
sudo firewall-cmd --reload

Common Scenario Examples

Web Server

Typical web server configuration: allow HTTP, HTTPS, and SSH

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

Database Server (restricting access sources)

Allow only the application server subnet to access MySQL

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.10.0/24" service name="mysql" accept'
sudo firewall-cmd --reload

Custom Application Port

Node.js application running on port 3000

sudo firewall-cmd --permanent --add-port=3000/tcp
sudo firewall-cmd --reload

Port Forwarding

Forward external port 80 to internal port 8080

sudo firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080
sudo firewall-cmd --reload

Forward traffic to another host

sudo firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=80:toaddr=192.168.1.50
sudo firewall-cmd --permanent --add-masquerade
sudo firewall-cmd --reload

Enabling IP Masquerading (NAT)

Enable IP masquerading

sudo firewall-cmd --permanent --add-masquerade
sudo firewall-cmd --reload

Troubleshooting and Debugging

Viewing All Firewall Rules

View all rules across all zones

sudo firewall-cmd --list-all-zones

Viewing Underlying nftables/iptables Rules

View the nftables rules generated by firewalld

sudo nft list ruleset

EL 8 and earlier versions use the iptables backend:

View iptables rules (EL 8)

sudo iptables -L -n -v

Viewing firewalld Logs

View firewalld-related logs

sudo journalctl -u firewalld --no-pager -n 30

Panic Mode (block all network traffic)

Caution

Panic mode will cut all network connections, including SSH. Use only in emergencies and ensure you have console access.

Enable panic mode (block all traffic)

sudo firewall-cmd --panic-on

Disable panic mode

sudo firewall-cmd --panic-off

Check whether panic mode is active

sudo firewall-cmd --query-panic

Backup and Restore

Backing Up the Current Firewall Configuration

Back up the firewalld configuration directory

sudo cp -r /etc/firewalld /etc/firewalld.backup.$(date +%Y%m%d)

Restoring Configuration

Restore backed-up configuration

sudo cp -r /etc/firewalld.backup.20260324/* /etc/firewalld/
sudo firewall-cmd --reload