firewalld

Identity

• Unit: firewalld.service
• Config: /etc/firewalld/ (zones, services, rich rules — user overrides)
• Default zones/services: /usr/lib/firewalld/ (system-provided; don't edit)
• Custom zones: /etc/firewalld/zones/
• Custom services: /etc/firewalld/services/
• Backend: nftables (default since firewalld 0.6); legacy iptables still supported
• Logs: journalctl -u firewalld
• Install: dnf install firewalld (default on RHEL/Fedora); apt install firewalld

Key Operations

Goal	Command
Check if running	sudo firewall-cmd --state
Get default zone	sudo firewall-cmd --get-default-zone
List all zones	sudo firewall-cmd --get-zones
List active zones + interfaces	sudo firewall-cmd --get-active-zones
List services in zone	sudo firewall-cmd --zone=public --list-services
List all rules in zone	sudo firewall-cmd --zone=public --list-all
Add service (runtime)	sudo firewall-cmd --zone=public --add-service=http
Add service (permanent)	sudo firewall-cmd --zone=public --add-service=http --permanent
Remove service	sudo firewall-cmd --zone=public --remove-service=http --permanent
Add port (runtime)	sudo firewall-cmd --zone=public --add-port=8080/tcp
Add port (permanent)	sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent
Remove port	sudo firewall-cmd --zone=public --remove-port=8080/tcp --permanent
Add rich rule	sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="10.0.0.1" accept' --permanent
List rich rules	sudo firewall-cmd --zone=public --list-rich-rules
Set default zone	sudo firewall-cmd --set-default-zone=home
Reload firewall	sudo firewall-cmd --reload
Make runtime permanent	sudo firewall-cmd --runtime-to-permanent
List available services	sudo firewall-cmd --get-services
View actual nftables rules	sudo nft list ruleset

Zone Concept

Zones define trust levels; each network interface is assigned to exactly one zone. Packets arriving on an interface are evaluated against that zone's rules. Common zones, from most restrictive to least:

• drop: All incoming packets dropped silently; only outgoing allowed.
• block: Incoming rejected with ICMP unreachable; outgoing allowed.
• public: Default for internet-facing interfaces. Explicitly allowed services only.
• external: Like public, with masquerading enabled (NAT for routing).
• dmz: Publicly accessible services, limited internal access.
• work / home / internal: Progressively more trust; some services allowed by default.
• trusted: All connections accepted.

public is the typical default for internet-facing servers. An interface not explicitly assigned to a zone falls back to the default zone.

Expected State

Default policy after install: public zone active, ssh (and dhcpv6-client) allowed, all other incoming blocked. Outgoing is unrestricted.

Common Failures

Symptom	Likely cause	Check/Fix
Rule added but traffic still blocked	Used --permanent but forgot --reload	sudo firewall-cmd --reload
Rule lost after reload/restart	Forgot --permanent flag	Re-add with --permanent; rules without it are runtime-only
Service not found	Service name not recognized	sudo firewall-cmd --get-services to list valid names
Docker ports bypass firewall	Docker writes nftables rules directly	Use DOCKER-USER zone or bind containers to localhost
Zone not applied to interface	Interface not assigned to zone	sudo firewall-cmd --get-active-zones; assign with --change-interface
Rich rule syntax error	Quoting or family mismatch	Test runtime first (no --permanent); check journalctl -u firewalld
nft rules conflict with firewalld	Mixed management	Don't mix nft manual rules with firewalld; use only firewall-cmd

Pain Points

• --permanent vs runtime: Without --permanent, rules reset on reload or restart. Without --reload, permanent rules don't take effect in the running firewall. Standard pattern for persistent changes: add with --permanent then sudo firewall-cmd --reload. For testing first: add without --permanent (takes effect immediately), verify, then add again with --permanent.

• Docker bypass: Docker writes nftables rules that are evaluated before firewalld's zone rules. Ports published with -p 80:80 are reachable even if port 80 is not allowed in the public zone. Workaround: bind containers to localhost (-p 127.0.0.1:8080:80) and proxy through nginx, or add rich rules to the DOCKER-USER chain via firewalld's direct interface.

• nftables direct access: sudo nft list ruleset shows the full active ruleset that firewalld generates. This is useful for debugging but firewall-cmd is the correct management interface. Manually adding nft rules alongside firewalld is unsupported and will be overwritten on reload.

• Zone assignment: sudo firewall-cmd --get-active-zones reveals which interfaces are in which zone. If an interface isn't listed, it's using the default zone silently. Assign explicitly with --change-interface=eth0 --zone=public --permanent.

• Rich rules for complex logic: Regular --add-port and --add-service can't express source IP restrictions, port forwarding, or logging. Rich rules handle all of these. The rich rule language is verbose — see references/common-rules.md for copy-paste examples.

• --runtime-to-permanent: If you've made several runtime changes and want to persist them all at once without re-entering each command, sudo firewall-cmd --runtime-to-permanent promotes the entire current runtime configuration to permanent.

References

See references/ for:

• common-rules.md — practical rule examples for common services
• docs.md — official documentation links