Configure firewalld on RHEL, Rocky Linux, and AlmaLinux

To configure firewalld on RHEL, Rocky Linux, or AlmaLinux, install and start the service, select the appropriate network zone, then add only the services or ports the server needs. Use firewall-cmd for runtime changes and add --permanent when a rule should survive a reload or reboot.

How firewalld works

Firewalld is the host firewall management service commonly used on these Linux distributions. It organizes rules into zones, which represent different levels of trust for network connections. A network interface or connection is associated with a zone, and that zone determines which incoming traffic is allowed.

Services are named rule sets, usually maintained as XML definitions. For example, allowing the ssh service opens the ports specified by its definition, rather than requiring you to remember the port number. You can also allow a specific port and protocol, such as TCP port 8443.

Firewalld distinguishes runtime configuration from permanent configuration. Runtime rules apply immediately but are lost when the service reloads or the system restarts. Permanent rules are saved on disk; they generally become active after a reload. This separation lets administrators test a change before committing it, but it can also cause confusion if you inspect one configuration while changing the other.

Install and start the service

On a minimal installation, firewalld may not be installed or enabled. Check its state and, if needed, install and start it with commands such as these:

sudo systemctl status firewalld
sudo dnf install firewalld
sudo systemctl enable --now firewalld

The install command is unnecessary if the package is already present. Enabling the service makes it start at boot; --now starts it immediately. Check the active state and the zones currently in use:

sudo firewall-cmd --state
sudo firewall-cmd --get-active-zones

Run administrative commands with sudo or from a suitably privileged account. If another firewall manager or custom network configuration is managing packet filtering, investigate that setup before changing rules. Avoid having competing tools rewrite firewall configuration independently.

Choose the right zone

Do not assume that every server should use the same zone. The default zone applies when a connection has not been assigned another one; active interfaces and connections can have explicit assignments. View the default and active zone details before editing:

sudo firewall-cmd --get-default-zone
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=public --list-all

The example inspects public, but use the zone that actually applies to the interface or connection. A zone name does not automatically configure a network interface, and changing the default zone does not necessarily override an explicit assignment.

To set the default zone, for example:

sudo firewall-cmd --set-default-zone=public

To assign an interface explicitly, use its real interface name:

sudo firewall-cmd --zone=public --change-interface=ens192

Interface names vary. NetworkManager connections may also have zone settings, so check the connection configuration if an assignment does not behave as expected. The appropriate zone depends on the network and trust boundary; do not select a more permissive zone simply to make an application work.

Allow required services and ports

Prefer a service rule when a suitable service definition exists. For instance, to allow SSH in the public zone temporarily and permanently, issue both forms:

sudo firewall-cmd --zone=public --add-service=ssh
sudo firewall-cmd --zone=public --add-service=ssh --permanent

For a web server, the corresponding service names are commonly http and https. Add only the services the machine needs. A permanent-only change does not necessarily take effect until firewalld reloads; a runtime-only change will not remain after a reload.

If the application uses a port without a service definition, specify both the port and protocol. For example, to allow TCP port 8443:

sudo firewall-cmd --zone=public --add-port=8443/tcp
sudo firewall-cmd --zone=public --add-port=8443/tcp --permanent

UDP is a different protocol and must be allowed separately where required. Opening a port in the firewall does not make an application listen on it, configure its TLS, or expose it through a router, cloud firewall, or upstream network filter. Confirm the application’s actual listening address and port as well.

Verify, reload, and remove rules

Inspect the configuration after making a change. These commands show runtime and permanent rules separately:

sudo firewall-cmd --zone=public --list-all
sudo firewall-cmd --permanent --zone=public --list-all

After editing permanent rules, apply them with:

sudo firewall-cmd --reload

A reload brings the permanent configuration into the active runtime configuration. Check the result again rather than assuming the command added the rule to the intended zone. To remove an unwanted rule, remove it from both configurations if it exists in both:

sudo firewall-cmd --zone=public --remove-service=ssh
sudo firewall-cmd --zone=public --remove-service=ssh --permanent

Replace the service option with --remove-port=8443/tcp for a port rule. Before removing remote access rules or reloading a remote server’s firewall, make sure you have an alternate way to regain access. A mistaken change can disconnect an SSH session or prevent a later connection.

Common problems and safe changes

• The rule appears missing: Check whether it was added to the runtime or permanent configuration, and inspect the zone actually assigned to the interface.
• The firewall allows traffic, but the application is unreachable: Verify that the service is running and listening on the expected address and port. Also check SELinux policy, application settings, routing, and any upstream firewall.
• A change disappears: A runtime-only change is not persistent. Add the rule permanently, then reload and verify it.
• A service name is rejected: Check available service definitions with firewall-cmd --get-services. If no matching definition exists, use a precise port and protocol rule or create a managed service definition.

For remote administration, keep an existing session open while testing a new rule and, where possible, arrange console access. Do not flush firewall rules or disable the service as a shortcut for troubleshooting. A narrow, documented rule is easier to review and safer than broadly allowing traffic.

Frequently Asked Questions

How do I open a port permanently with firewalld?
Run sudo firewall-cmd --permanent --zone=public --add-port=8443/tcp, substituting the correct zone, port, and protocol. Then run sudo firewall-cmd --reload and verify with --list-all.

What is the difference between runtime and permanent rules?
Runtime rules apply now but can disappear on reload or restart. Permanent rules are saved for later; reload firewalld to apply them to the running configuration.

How can I check which zone an interface uses?
Use sudo firewall-cmd --get-active-zones. It lists active zones and their associated interfaces or sources; inspect the specific zone with --zone=NAME --list-all.

Should I open a port or allow a service?
Use a service rule when the relevant predefined service exists, because it identifies the intended application traffic. Use a port rule when the application needs a port not covered by an appropriate service definition.

Does opening a port start the server application?
No. Firewalld controls filtering, not whether an application is installed, running, or listening. Check the application service and its listening socket separately.

Related

• No Backend Meaning in the Dev Community Story
• Galaxy S26 vs Z Fold8 Ultra: What $999 Buys
• Check Whether an AI Music Tool Trains on Copyrighted Recordings