firewalld Quick Reference

Luke Hebert

- 2 minutes read - 306 words

A practical cheat sheet for managing firewalld on RHEL, Fedora, and CentOS systems. Covers the essentials: starting and stopping the service, working with zones, opening services and ports, writing rich rules, configuring NAT and port forwarding, and applying direct iptables-style rules.

Basics

  • Check if firewalld is running
    • systemctl status firewalld
  • Start / Stop / Restart firewalld
    • systemctl start firewalld
    • systemctl stop firewalld
    • systemctl restart firewalld
  • Enable at boot
    • systemctl enable firewalld

Zones

  • List all zones
    • firewall-cmd --get-zones
  • Show default zone
    • firewall-cmd --get-default-zone
  • Set default zone
    • firewall-cmd --set-default-zone=public
  • List active zones and interfaces
    • firewall-cmd --get-active-zones
  • Assign interface to a zone
    • firewall-cmd --zone=public --change-interface=eth0

Services and Ports

  • List allowed services in current zone
    • firewall-cmd --list-services
  • List allowed ports in current zone
    • firewall-cmd --list-ports
  • Allow a service (permanent)
    • firewall-cmd --permanent --zone=public --add-service=http
  • Remove a service
    • firewall-cmd --permanent --zone=public --remove-service=http
  • Allow a port
    • firewall-cmd --permanent --zone=public --add-port=8080/tcp
  • Remove a port
    • firewall-cmd --permanent --zone=public --remove-port=8080/tcp
  • Reload firewall to apply changes
    • firewall-cmd --reload

Rich Rules (Advanced)

  • Allow access from specific IP
    • firewall-cmd --permanent --zone=public --add-rich-rule="rule family=ipv4 source address=192.168.1.50 accept"
  • Block specific IP
    • firewall-cmd --permanent --zone=public --add-rich-rule="rule family=ipv4 source address=203.0.113.10 drop"
  • Allow SSH only from subnet
    • firewall-cmd --permanent --zone=public --add-rich-rule="rule family=ipv4 source address=192.168.1.0/24 service name=ssh accept"

Masquerading, NAT, and Forwarding

  • Enable masquerading (NAT)
    • firewall-cmd --zone=public --add-masquerade --permanent
  • Port forwarding
    • firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=192.168.1.100

Direct Rules (iptables-like)

  • List direct rules
    • firewall-cmd --direct --get-all-rules
  • Add direct rule (example: block an IP)
    • firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -s 10.10.10.10 -j DROP

Useful Info

  • List all services firewalld knows about
    • firewall-cmd --get-services
  • Show detailed info about a zone
    • firewall-cmd --zone=public --list-all
  • Copy runtime config to permanent
    • firewall-cmd --runtime-to-permanent

Pro Tips

  • Always test with runtime changes first (omit --permanent).
  • If it works, make it permanent and reload.
  • Use zones per interface (LAN = internal, WAN = public).
  • Prefer rich rules for complex configs over direct rules.