firewalld: zones, services and ports

Why a firewall?

A server may run many programs that listen on the network. Some should be reachable from outside (the website on port 443), many should not (a database admin port). A firewall is a filter in the kernel that accepts or drops each incoming packet based on rules. On RHEL, firewalld manages those rules for you, and firewall-cmd is its command-line tool.

Zones

A zone is a named set of rules for a level of trust. Each network interface, or each source address range, belongs to one zone. Anything not assigned uses the default zone, normally public. In public, RHEL 9 allows only ssh, dhcpv6-client and cockpit (the web console) by default.

# firewall-cmd --state
running
# firewall-cmd --get-default-zone
public
# firewall-cmd --get-active-zones
public
  interfaces: enp1s0
# firewall-cmd --list-all
public (active)
  target: default
  interfaces: enp1s0
  services: cockpit dhcpv6-client ssh
  ports:
  ...

Allowing services and ports

# firewall-cmd --add-service=http --permanent
success
# firewall-cmd --add-service=https --permanent
# firewall-cmd --add-port=8080/tcp --permanent
# firewall-cmd --reload
success
# firewall-cmd --list-services
cockpit dhcpv6-client http https ssh
# firewall-cmd --list-ports
8080/tcp
# firewall-cmd --remove-service=cockpit --permanent && firewall-cmd --reload

Runtime versus permanent

firewalld keeps two configurations. The runtime one is what is active right now. The permanent one is saved on disk and loaded at boot or on --reload. Without --permanent, a change is active at once but lost at reload or reboot. With --permanent, it is saved but NOT active until you reload.

Sources and other zones

# firewall-cmd --zone=internal --add-source=10.10.0.0/16 --permanent   # this range uses zone internal
# firewall-cmd --zone=internal --add-service=mysql --permanent
# firewall-cmd --reload
# firewall-cmd --zone=internal --list-all

For finer rules (allow one IP to one port, log and drop something), firewalld has rich rules, for example: firewall-cmd --add-rich-rule='rule family="ipv4" source address="203.0.113.7" service name="ssh" reject' --permanent. Use them when zones and services are not enough.

Common mistakes

• Adding --permanent and forgetting --reload: the port stays closed until the next reboot, and you think the app is broken.
• Adding a rule without --permanent: it works today and disappears after the next reboot. In exams, the grader reboots.
• Opening the port but the service still fails: check that it listens on the right address (ss -tlnp), and, for a non-standard port, that SELinux allows it (module 6).
• Turning the firewall off to "test". If you must, test with a specific rule instead; never leave it off.