RH134 Ch 9: firewalld Essentials

firewalld manages packet filtering through zones. Each network interface or source address belongs to one zone, and each zone has its own list of allowed services, ports and rules. public is the usual default zone.

Runtime vs permanent. Every firewall-cmd change applies to the runtime configuration only, which is lost on reload or reboot — unless you add --permanent, which changes only the saved configuration. Two habits work:

bash firewall-cmd --permanent --add-service=http firewall-cmd --reload load permanent into runtime or: change runtime, test, then save it all firewall-cmd --add-port=8443/tcp firewall-cmd --runtime-to-permanent

Looking around.

bash firewall-cmd --get-default-zone firewall-cmd --get-active-zones firewall-cmd --list-all default zone firewall-cmd --list-all --zone=trusted firewall-cmd --get-services predefined service names

Services and ports. Prefer services (http, https, ssh, nfs) where one exists; use --add-port=PORT/tcp otherwise. Remove with --remove-service/--remove-port.

Sources and zones. --zone=trusted --add-source=172.25.250.11/32 sends one host's traffic to the trusted zone; source zones are matched before interface zones. --change-interface=eth1 --zone=work moves an interface (on NetworkManager systems also set connection.zone).

Rich rules express more detailed policy:

bash firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="172.25.250.99" reject' firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="172.25.250.0/24" service name="ssh" accept'

reject answers with an error; drop stays silent. Port forwarding uses --add-forward-port=port=80:proto=tcp:toport=8080.

Common exam mistakes - Adding a rule without --permanent (it works now, disappears after reboot). - Adding with --permanent and forgetting --reload (saved, but not active now). - Opening a non-standard port for a service but forgetting SELinux needs its own port label. - Changing the wrong zone because the interface is not in the default zone.