Firewalld Cheatsheet

firewalld provides a dynamically managed firewall with support for network "zones" that assign a level of trust to a network and its associated connections and interfaces.

Installation

# RHEL / Rocky / AlmaLinux / Fedora
sudo dnf install firewalld
 
# Arch Linux
sudo pacman -S firewalld

Basic Commands

sudo systemctl enable --now firewalld  # Start and enable on boot
sudo firewall-cmd --state              # Check if running
sudo firewall-cmd --reload             # Reload rules (do this after --permanent changes)

Zones

Zones define the trust level of the network connections.

sudo firewall-cmd --get-zones          # List all available zones
sudo firewall-cmd --get-default-zone   # Get the current default zone
sudo firewall-cmd --get-active-zones   # See which zones are currently active
sudo firewall-cmd --set-default-zone=public # Change default zone

Managing Rules

Important: By default, changes are temporary. Add --permanent to make them survive a reboot. You must run --reload after making permanent changes!

Ports

# Allow a port (temporary)
sudo firewall-cmd --zone=public --add-port=8080/tcp
 
# Allow a port (permanent)
sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent
 
# Remove a port
sudo firewall-cmd --zone=public --remove-port=8080/tcp --permanent

Services

Instead of ports, you can use predefined services (like ssh, http, https).

# List all predefined services
sudo firewall-cmd --get-services
 
# Allow HTTP service
sudo firewall-cmd --zone=public --add-service=http --permanent
 
# Remove HTTP service
sudo firewall-cmd --zone=public --remove-service=http --permanent

Rich Rules (Advanced)

Rich rules allow you to create complex rules (like allowing a specific port only from a specific IP).

# Allow SSH only from 192.168.1.100
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept' --permanent
 
# Drop all traffic from an IP
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.0.0.5" drop' --permanent

Cheatsheets