Firewalld Cheatsheet

firewalld provides a dynamically managed firewall with support for network "zones" that assign a level of trust to a network and its associated connections and interfaces.

Installation

# RHEL / Rocky / AlmaLinux / Fedora
sudo dnf install firewalld
 
# Debian / Ubuntu
sudo apt install firewalld
 
# Arch Linux
sudo pacman -S firewalld

Service Management

sudo systemctl enable --now firewalld  # Start and enable on boot
sudo systemctl status firewalld        # Check if running
sudo systemctl restart firewalld       # Restart the service
sudo firewall-cmd --state              # Quick check: "running" or "not running"
sudo firewall-cmd --reload             # Reload rules (required after --permanent changes)

Zones

Zones define the trust level of network connections. Common zones: drop, block, public, external, internal, dmz, work, home, trusted.

sudo firewall-cmd --get-zones              # List all available zones
sudo firewall-cmd --get-default-zone       # Show the current default zone
sudo firewall-cmd --get-active-zones       # Show zones with assigned interfaces
sudo firewall-cmd --set-default-zone=home  # Change default zone
 
# Assign an interface to a zone
sudo firewall-cmd --zone=internal --change-interface=eth1 --permanent

Managing Rules

Important: Changes are temporary by default and are lost on reload/reboot. Add --permanent to persist them, then run --reload to apply.

Ports

# Allow a port (temporary — for testing)
sudo firewall-cmd --zone=public --add-port=8080/tcp
 
# Allow a port (permanent — survives reboot)
sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent
 
# Allow a port range
sudo firewall-cmd --zone=public --add-port=3000-3100/tcp --permanent
 
# Remove a port
sudo firewall-cmd --zone=public --remove-port=8080/tcp --permanent
 
# List allowed ports in a zone
sudo firewall-cmd --zone=public --list-ports
 
# Apply permanent changes
sudo firewall-cmd --reload

Services

Predefined services map to well-known ports (e.g., ssh = 22/tcp, http = 80/tcp).

# List all available predefined services
sudo firewall-cmd --get-services
 
# Allow a service
sudo firewall-cmd --zone=public --add-service=http --permanent
sudo firewall-cmd --zone=public --add-service=https --permanent
 
# Remove a service
sudo firewall-cmd --zone=public --remove-service=http --permanent
 
# List allowed services in a zone
sudo firewall-cmd --zone=public --list-services

Rich Rules (Advanced)

Rich rules allow complex conditions like source IP filtering with specific actions.

# Allow SSH only from a specific IP
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.100" service name="ssh" accept' --permanent
 
# Drop all traffic from an IP
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.0.0.5" drop' --permanent
 
# Allow port 3306 (MySQL) only from a subnet
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="3306" protocol="tcp" accept' --permanent
 
# List all rich rules in a zone
sudo firewall-cmd --zone=public --list-rich-rules

Port Forwarding

# Forward port 8080 to port 80 on the same machine
sudo firewall-cmd --zone=public --add-forward-port=port=8080:proto=tcp:toport=80 --permanent
 
# Forward port 8080 to port 80 on a different machine (192.168.1.10)
sudo firewall-cmd --zone=public --add-forward-port=port=8080:proto=tcp:toport=80:toaddr=192.168.1.10 --permanent
 
# Enable masquerading (required for forwarding to different machines)
sudo firewall-cmd --zone=public --add-masquerade --permanent

Viewing Configuration

sudo firewall-cmd --list-all                # Show all rules for the default zone
sudo firewall-cmd --zone=public --list-all  # Show all rules for a specific zone
sudo firewall-cmd --list-all-zones          # Show rules for all zones

Cheatsheets