{"id":50838,"date":"2022-11-07T22:29:17","date_gmt":"2022-11-07T22:29:17","guid":{"rendered":"https:\/\/linuxiac.com\/?p=50838"},"modified":"2022-12-03T21:48:29","modified_gmt":"2022-12-03T21:48:29","slug":"firewalld-in-examples","status":"publish","type":"post","link":"https:\/\/linuxiac.com\/firewalld-in-examples\/","title":{"rendered":"Firewalld in Examples: A Complete Beginner\u2019s Guide"},"content":{"rendered":"\n<div class=\"wp-block-ultimate-post-table-of-content ultp-block-32dac5\"><div class=\"ultp-block-wrapper\"><div class=\"ultp-block-toc\"><div class=\"ultp-toc-header\"><div class=\"ultp-toc-heading\">Table of Contents<\/div><div class=\"ultp-collapsible-toggle  ultp-collapsible-right\"><a class=\"ultp-collapsible-text ultp-collapsible-open\" href=\"javascript:;\">[Open]<\/a><a class=\"ultp-collapsible-text ultp-collapsible-hide\" href=\"javascript:;\">[Close]<\/a><\/div><\/div><div class=\"ultp-block-toc-style1 ultp-block-toc-body\" style=\"display:block;\"><ul class=\"ultp-toc-lists\"><li><a href=\"#What_is_Firewalld?\">What is Firewalld?<\/a><\/li><li><a href=\"#How_to_Manage_Firewall_Rules_with_Firewalld\">How to Manage Firewall Rules with Firewalld<\/a><ul class=\"ultp-toc-lists\"><li><a href=\"#Checking_the_Firewalld_Status\">Checking the Firewalld Status<\/a><\/li><li><a href=\"#Zones_and_Interfaces\">Zones and Interfaces<\/a><\/li><li><a href=\"#Allow_and_Deny_by_Service_Name\">Allow and Deny by Service Name<\/a><\/li><li><a href=\"#Allow_and_Deny_by_Port_Number\">Allow and Deny by Port Number<\/a><\/li><li><a href=\"#Firewalld_Rich_Rules\">Firewalld Rich Rules<\/a><\/li><\/ul><\/li><li><a href=\"#Conclusion\">Conclusion<\/a><\/li><\/ul><\/div><\/div><\/div><\/div>\n\n\n\n<p>Nowadays, configuring and implementing a reliable firewall for your servers and network is a must. Without it, the question is no longer if but when malicious attacks will harm you, unfortunately, are common on the Internet these days.<\/p>\n\n\n\n<p>This is where Firewalld comes into play. Firewalld, the default firewall in Linux distros such as Red Hat Enterprise Linux, Fedora, Oracle Linux, openSUSE, AlmaLinux, Rocky Linux, and others, provides all the protection you need to secure your servers and network. But before we get into how to use it, let&#8217;s first explain what it is.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"What_is_Firewalld?\">What is Firewalld?<\/h2>\n\n\n\n<p>Firewalld is a zone-based firewall management tool that provides a dynamically managed firewall with support for network zones that define the trust level for network connections or interfaces.<\/p>\n\n\n\n<p>In addition, it acts as a front-end for the Linux kernel\u2019s Netfilter framework, providing firewall functionality.<\/p>\n\n\n\n<p>Unlike iptables chains, it manages firewall rules using zones and services. These rules are used to sort incoming traffic and determine whether it should be blocked or allowed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"How_to_Manage_Firewall_Rules_with_Firewalld\">How to Manage Firewall Rules with Firewalld<\/h2>\n\n\n\n<p>The main tool for managing the Firewalld rules is <code>firewall-cmd<\/code>. It is a command-line tool that provides an interface for managing Firewalld&#8217;s runtime and permanent configuration. When you use it, the changes take effect immediately, and there is no need to restart the service.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Checking_the_Firewalld_Status\">Checking the Firewalld Status<\/h3>\n\n\n\n<p>Run the following command to see if your Firewalld is active:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code lang=\"bash\" class=\"hljs language-bash\">sudo firewall-cmd --state<\/code><\/span><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-status.jpg\"><img decoding=\"async\" width=\"983\" height=\"182\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-status.jpg\" alt=\"Checking the Firewalld status\" class=\"wp-image-50945\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-status.jpg 983w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-status-380x70.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-status-768x142.jpg 768w\" sizes=\"(max-width: 983px) 100vw, 983px\" \/><\/a><\/figure>\n\n\n\n<p>The output should say either&nbsp;&#8220;running&#8221;&nbsp;or&nbsp;&#8220;not running.&#8221;<\/p>\n\n\n\n<p>In addition, to view the status of the Firewalld service, run the following:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code lang=\"bash\" class=\"hljs language-bash\">sudo systemctl status firewalld<\/code><\/span><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-service-status.jpg\"><img decoding=\"async\" width=\"983\" height=\"423\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-service-status.jpg\" alt=\"Checking the Firewalld service status\" class=\"wp-image-50948\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-service-status.jpg 983w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-service-status-380x164.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-service-status-768x330.jpg 768w\" sizes=\"(max-width: 983px) 100vw, 983px\" \/><\/a><\/figure>\n\n\n\n<p>If the service is not started for some reason, you can start it and set it to start automatically when the system boots as run:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code lang=\"bash\" class=\"hljs language-bash\">sudo systemctl start firewalld\nsudo systemctl enable firewalld<\/code><\/span><\/pre>\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>Similarly, you can stop and disable the Firewalld service&#8217;s automatic startup by doing the following:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code lang=\"bash\" class=\"hljs language-bash\">sudo systemctl stop firewalld\nsudo systemctl disable firewalld<\/code><\/span><\/pre>\n\n\n<h3 class=\"wp-block-heading\" id=\"Zones_and_Interfaces\">Zones and Interfaces<\/h3>\n\n\n\n<p>Firewalld, as previously stated, is a zone-based firewall. But what exactly does that mean, and what are zones?<\/p>\n\n\n\n<p>In short, they are a top-level component of the Firewalld organization. So, zones can provide different levels of security for different connection zones. The idea is to have separate security measures for different network zones.<\/p>\n\n\n\n<p>Each zone is connected to at least one network interface &#8211; hardware or a virtual network adapter. Getting a list of the preconfigured Firewalld zones is simple. Type the command:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code lang=\"bash\" class=\"hljs language-javascript language-bash\">sudo firewall-cmd --<span class=\"hljs-keyword\">get<\/span>-zones<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-firewalld-zones.jpg\"><img decoding=\"async\" width=\"984\" height=\"160\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-firewalld-zones.jpg\" alt=\"List Firewalld zones\" class=\"wp-image-50951\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-firewalld-zones.jpg 984w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-firewalld-zones-380x62.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-firewalld-zones-768x125.jpg 768w\" sizes=\"(max-width: 984px) 100vw, 984px\" \/><\/a><\/figure>\n\n\n\n<p>As you can see, the zones that are listed by default are:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>block<\/strong>: Incoming network connections are rejected with an icmp-host-prohibited message. Only network connections initiated by this system are allowed.<\/li>\n\n\n\n<li><strong>dmz<\/strong>: For publicly accessible computers in your demilitarized zone with limited access to your internal network. Only certain inbound connections are accepted.<\/li>\n\n\n\n<li><strong>drop<\/strong>: Any incoming network connections are dropped, and no response is sent. Only outgoing network connections are allowed.<\/li>\n\n\n\n<li><strong>external<\/strong>: For usage on external networks with masquerading enabled, mainly routers. You don&#8217;t trust other computers on networks not to harm yours. Only certain types of inbound connections are accepted.<\/li>\n\n\n\n<li><strong>home<\/strong>: For usage in a home. You generally trust other computers on networks not to harm yours. Only certain types of incoming connections are accepted.<\/li>\n\n\n\n<li><strong>internal<\/strong>: For usage on internal networks. You generally trust that the other computers on the network will not harm your computer. Only certain inbound connections are accepted.<\/li>\n\n\n\n<li><strong>public<\/strong>: For usage on external networks. You don&#8217;t trust other computers on networks not to hurt yours. Only certain types of inbound connections are accepted.<\/li>\n\n\n\n<li><strong>trusted<\/strong>: Any network connection is allowed.<\/li>\n\n\n\n<li><strong>work<\/strong>: For usage in workplaces. You generally trust that other computers on networks will not harm your computer. Only certain inbound connections are accepted.<\/li>\n<\/ul>\n\n\n\n<p>If you haven&#8217;t made any additional changes, Firewalld&#8217;s default zone is set to &#8220;public.&#8221; To check the default zone:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-2\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code lang=\"bash\" class=\"hljs language-javascript language-bash\">sudo firewall-cmd --<span class=\"hljs-keyword\">get<\/span>-default-zone<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-2\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/check-default-firewalld-zone.jpg\"><img decoding=\"async\" width=\"986\" height=\"181\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/check-default-firewalld-zone.jpg\" alt=\"Check Firewalld's default zone\" class=\"wp-image-50957\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/check-default-firewalld-zone.jpg 986w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/check-default-firewalld-zone-380x70.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/check-default-firewalld-zone-768x141.jpg 768w\" sizes=\"(max-width: 986px) 100vw, 986px\" \/><\/a><\/figure>\n\n\n\n<p>To change the default zone, for example, &#8220;home,&#8221; type:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-3\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code lang=\"bash\" class=\"hljs language-javascript language-bash\">sudo firewall-cmd --<span class=\"hljs-keyword\">set<\/span>-default-zone=home<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-3\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/change-default-zone.jpg\"><img decoding=\"async\" width=\"985\" height=\"161\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/change-default-zone.jpg\" alt=\"Change default zone\" class=\"wp-image-50960\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/change-default-zone.jpg 985w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/change-default-zone-380x62.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/change-default-zone-768x126.jpg 768w\" sizes=\"(max-width: 985px) 100vw, 985px\" \/><\/a><\/figure>\n\n\n\n<p>To list the active zones and the network interfaces assigned to them, run the following:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-4\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code lang=\"bash\" class=\"hljs language-javascript language-bash\">sudo firewall-cmd --<span class=\"hljs-keyword\">get<\/span>-active-zones<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-4\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/view-zones-network-interfaces.jpg\"><img decoding=\"async\" width=\"983\" height=\"180\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/view-zones-network-interfaces.jpg\" alt=\"List the active zones and the network interfaces assigned to them\" class=\"wp-image-50963\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/view-zones-network-interfaces.jpg 983w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/view-zones-network-interfaces-380x70.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/view-zones-network-interfaces-768x141.jpg 768w\" sizes=\"(max-width: 983px) 100vw, 983px\" \/><\/a><\/figure>\n\n\n\n<p>To assign a network interface (enp1s0 in our case) to another zone, such as &#8220;home,&#8221; type:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-5\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=home --change-<span class=\"hljs-class\"><span class=\"hljs-keyword\">interface<\/span>=<span class=\"hljs-title\">enp1s0<\/span><\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-5\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/assign-interface-to-zone.jpg\"><img decoding=\"async\" width=\"982\" height=\"157\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/assign-interface-to-zone.jpg\" alt=\"Assigning network interface to zone\" class=\"wp-image-50972\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/assign-interface-to-zone.jpg 982w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/assign-interface-to-zone-380x61.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/assign-interface-to-zone-768x123.jpg 768w\" sizes=\"(max-width: 982px) 100vw, 982px\" \/><\/a><\/figure>\n\n\n\n<p>Remember that if you have only one network interface on your system and assign it to another zone, that zone will become active by default.<\/p>\n\n\n\n<p>To get all configurations for a specific zone, for example, &#8220;public,&#8221; run:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-6\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --<span class=\"hljs-keyword\">list<\/span>-all<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-6\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-zone-details.jpg\"><img decoding=\"async\" width=\"985\" height=\"446\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-zone-details.jpg\" alt=\"Get zone details\" class=\"wp-image-50969\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-zone-details.jpg 985w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-zone-details-380x172.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-zone-details-768x348.jpg 768w\" sizes=\"(max-width: 985px) 100vw, 985px\" \/><\/a><\/figure>\n\n\n\n<p>Similarly, to get configurations for all zones at once:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-7\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --<span class=\"hljs-keyword\">list<\/span>-all-zones<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-7\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h3 class=\"wp-block-heading\" id=\"Allow_and_Deny_by_Service_Name\">Allow and Deny by Service Name<\/h3>\n\n\n\n<p>Firewalld can allow traffic for specific network services based on predefined rules. The simplest method is to add the services you need to allow to the zones you are using.<\/p>\n\n\n\n<p>Of course, you should first know the name of the service. But it is hard to remember the names of all the services, even though they are as expected. So, using the following command, we can view the names of all available predefined ones.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-8\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code lang=\"bash\" class=\"hljs language-javascript language-bash\">sudo firewall-cmd --<span class=\"hljs-keyword\">get<\/span>-services<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-8\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/list-services.png\"><img decoding=\"async\" width=\"986\" height=\"555\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/list-services.png\" alt=\"List services\" class=\"wp-image-50978\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/list-services.png 986w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/list-services-380x214.png 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/list-services-768x432.png 768w\" sizes=\"(max-width: 986px) 100vw, 986px\" \/><\/a><\/figure>\n\n\n\n<p>You can find more details on these services in their associated <code>.xml<\/code> file in the <code>\/usr\/lib\/firewalld\/<\/code>services directory. For example, the MySQL service is defined as follows:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code lang=\"bash\" class=\"hljs language-bash\">cat \/usr\/lib\/firewalld\/services\/mysql.xml<\/code><\/span><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/describe-service.jpg\"><img decoding=\"async\" width=\"984\" height=\"270\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/describe-service.jpg\" alt=\"Describe service\" class=\"wp-image-50984\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/describe-service.jpg 984w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/describe-service-380x104.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/describe-service-768x211.jpg 768w\" sizes=\"(max-width: 984px) 100vw, 984px\" \/><\/a><\/figure>\n\n\n\n<p>Assume we want to enable the MySQL service. To accomplish this, we add the service name after <code>--add-service=<\/code> to the <code>firewalld-cmd<\/code> command and use the <code>--zone=<\/code> option to specify which zone to assign the service.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-9\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --add-service=mysql<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-9\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/enable-firewalld-service.jpg\"><img decoding=\"async\" width=\"984\" height=\"158\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/enable-firewalld-service.jpg\" alt=\"Enable Firewalld service\" class=\"wp-image-50981\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/enable-firewalld-service.jpg 984w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/enable-firewalld-service-380x61.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/enable-firewalld-service-768x123.jpg 768w\" sizes=\"(max-width: 984px) 100vw, 984px\" \/><\/a><\/figure>\n\n\n\n<p>Let&#8217;s now recheck the &#8220;public&#8221; zone details.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-10\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --<span class=\"hljs-keyword\">list<\/span>-all<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-10\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/describe-service-1.jpg\"><img decoding=\"async\" width=\"985\" height=\"447\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/describe-service-1.jpg\" alt=\"Get zone details\" class=\"wp-image-50985\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/describe-service-1.jpg 985w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/describe-service-1-380x172.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/describe-service-1-768x349.jpg 768w\" sizes=\"(max-width: 985px) 100vw, 985px\" \/><\/a><\/figure>\n\n\n\n<p>Great. We&#8217;ve added a firewall rule that allows incoming connections to the MySQL server. However, this rule is temporary. This means that the rule will not survive during a system reboot.<\/p>\n\n\n\n<p>To ensure the rule&#8217;s persistence, we must add the <code>--permanent<\/code> option to the command. This way, even after a reboot, Firewalld will automatically load it.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-11\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --add-service=mysql --permanent<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-11\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>We must note one important detail: adding a rule without the <code>--permanent<\/code> option makes it available and effective immediately. However, using <code>--permanent<\/code> will have no effect until the system is rebooted.<\/p>\n\n\n\n<p>So, to make our new permanent rule active immediately, we need to reload the Firewalld, executing:<\/p>\n\n\n<pre class=\"wp-block-code\"><span><code lang=\"bash\" class=\"hljs language-bash\">sudo firewall-cmd --reload<\/code><\/span><\/pre>\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>This way, we reload firewall rules while preserving state information. In other words, the current permanent configuration will become a new runtime configuration.<\/p>\n\n\n\n<p>Let&#8217;s look at how we can remove rules from our firewall now. The procedure is nearly identical to adding, but the option <code>--remove-service<\/code> is used this time.<\/p>\n\n\n\n<p>For example, to remove the MySQL service, we have to issue the following command:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-12\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --remove-service=mysql<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-12\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/remove-firewall-service.jpg\"><img decoding=\"async\" width=\"971\" height=\"159\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/remove-firewall-service.jpg\" alt=\"Remove Firewalld service\" class=\"wp-image-50987\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/remove-firewall-service.jpg 971w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/remove-firewall-service-380x62.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/remove-firewall-service-768x126.jpg 768w\" sizes=\"(max-width: 971px) 100vw, 971px\" \/><\/a><\/figure>\n\n\n\n<p>Again, to remove the access permanently, we need to add the <code>--permanent<\/code> option and then reload the rules for the change to take effect immediately.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-13\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --remove-service=mysql --permanent\nsudo firewall-cmd --reload<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-13\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/remove-firewall-service-permanent.jpg\"><img decoding=\"async\" width=\"1009\" height=\"206\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/remove-firewall-service-permanent.jpg\" alt=\"Remove Firewalld service permanently\" class=\"wp-image-50990\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/remove-firewall-service-permanent.jpg 1009w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/remove-firewall-service-permanent-380x78.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/remove-firewall-service-permanent-768x157.jpg 768w\" sizes=\"(max-width: 1009px) 100vw, 1009px\" \/><\/a><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"Allow_and_Deny_by_Port_Number\">Allow and Deny by Port Number<\/h3>\n\n\n\n<p>However, sometimes we have to allow access by specifying a <a href=\"https:\/\/linuxiac.com\/common-network-ports\/\">port number<\/a>. For example, suppose you have a service listening on the non-standard TCP port 10069. So, we will need something other than predefining services by name.<\/p>\n\n\n\n<p>Fortunately, Firewalld offers a way of allowing access by port and protocol that is entirely identical to that of service names. For example, to allow traffic to port 10069 on TCP, run:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-14\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --add-port=<span class=\"hljs-number\">10069<\/span>\/tcp<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-14\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>We check the allowed ports, executing:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-15\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --<span class=\"hljs-keyword\">list<\/span>-ports<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-15\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/allow-traffic-by-port-number.jpg\"><img decoding=\"async\" width=\"951\" height=\"205\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/allow-traffic-by-port-number.jpg\" alt=\"Allow traffic by port number\" class=\"wp-image-50993\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/allow-traffic-by-port-number.jpg 951w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/allow-traffic-by-port-number-380x82.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/allow-traffic-by-port-number-768x166.jpg 768w\" sizes=\"(max-width: 951px) 100vw, 951px\" \/><\/a><\/figure>\n\n\n\n<p>Of course, we can also get an overview of the big picture for the entire zone in a familiar way:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-16\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --<span class=\"hljs-keyword\">list<\/span>-all<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-16\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-zone-info.jpg\"><img decoding=\"async\" width=\"956\" height=\"447\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-zone-info.jpg\" alt=\"Get zone information\" class=\"wp-image-50995\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-zone-info.jpg 956w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-zone-info-380x178.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/get-zone-info-768x359.jpg 768w\" sizes=\"(max-width: 956px) 100vw, 956px\" \/><\/a><\/figure>\n\n\n\n<p>The same persistence rules apply here as they do when using service names. As a result, to ensure that our firewall rule survives between reboots, we need to execute the following:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-17\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --add-port=<span class=\"hljs-number\">10069<\/span>\/tcp --permanent\nsudo firewall-cmd --reload<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-17\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>In addition, if the port you want to enable uses the UDP protocol instead of TCP, you must replace <code>tcp<\/code> with <code>udp<\/code> in the <code>firewall-cmd<\/code> line.<\/p>\n\n\n\n<p>The approach for removing a port from the list of rules is identical, with the only difference being the replacement of <code>--add-port=<\/code> with the <code>--remove-port=<\/code> option.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-18\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --remove-port=<span class=\"hljs-number\">10069<\/span>\/tcp --permanent\nsudo firewall-cmd --reload<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-18\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h3 class=\"wp-block-heading\" id=\"Firewalld_Rich_Rules\">Firewalld Rich Rules<\/h3>\n\n\n\n<p>Those familiar with iptables will be at ease using firewalld rich rules. As the name implies, they enable you to construct complex rules with multiple criteria that cannot be achieved using a name or port-based rules.<\/p>\n\n\n\n<p>In other words, the Firewall rich rules&nbsp;provide a much greater level of control through more custom granular options. Furthermore, they can also configure logging, masquerading, port forwarding, and rate limitation.<\/p>\n\n\n\n<p>Their use can have countless variations, so if you want to learn more about them, you should consult the <a href=\"https:\/\/firewalld.org\/documentation\/man-pages\/firewalld.richlanguage.html\" target=\"_blank\" rel=\"noreferrer noopener\">official documentation<\/a>. Here, we&#8217;ll provide some simplified examples to give you a sense of what you can do with the Firewalld rich rules.<\/p>\n\n\n\n<p>For example, assume we want to allow access to the MySQL server, which, as we know, listens on port 3306 from IP address 192.168.1.69. The rule would look like this:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-19\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --add-rich-rule <span class=\"hljs-string\">'rule family=\"ipv4\" source address=\"192.168.1.69\" port port=3306 protocol=tcp accept'<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-19\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-large\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/add-rich-rule.jpg\"><img decoding=\"async\" width=\"1024\" height=\"473\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/add-rich-rule-1024x473.jpg\" alt=\"Add Firewalld rich rules\" class=\"wp-image-50998\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/add-rich-rule-1024x473.jpg 1024w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/add-rich-rule-380x176.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/add-rich-rule-768x355.jpg 768w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/add-rich-rule.jpg 1108w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/figure>\n\n\n\n<p>As with name and port-based rules, Firewalld&#8217;s rich rules are not persistent unless the <code>--permanent<\/code> flag is specified.<\/p>\n\n\n\n<p>The command to remove this rule is identical to the one above, except that the <code>--add-rich-rule<\/code> option should be replaced with <code>--remove-rich-rule<\/code>.<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-20\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --remove-rich-rule <span class=\"hljs-string\">'rule family=\"ipv4\" source address=\"192.168.1.69\" port port=\"3306\" protocol=\"tcp\" accept'<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-20\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>If we want to do the opposite and block access to the MySQL server from IP address 192.168.1.69, our rule would be:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-21\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --add-rich-rule <span class=\"hljs-string\">'rule family=\"ipv4\" source address=\"192.168.1.69\" port port=\"3306\" protocol=\"tcp\" reject'<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-21\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>As a final example, we want to redirect all inbound traffic from port 80 to port 8080 on host 192.168.1.200, where we have installed a <a href=\"https:\/\/linuxiac.com\/install-apache-tomcat-on-almalinux-9-rocky-linux-9\/\">Tomcat server<\/a>. To achieve this, our Firewalld rich rule should be:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-22\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --add-rich-rule <span class=\"hljs-string\">'rule family=ipv4 forward-port port=80 protocol=tcp to-port=8080 to-addr=192.168.1.200'<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-22\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p>You can review the rich rules by running the following:<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-23\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code lang=\"bash\" class=\"hljs language-php language-bash\">sudo firewall-cmd --zone=<span class=\"hljs-keyword\">public<\/span> --<span class=\"hljs-keyword\">list<\/span>-rich-rules<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-23\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<figure class=\"wp-block-image size-full\"><a href=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/list-rich-rules.jpg\"><img decoding=\"async\" width=\"972\" height=\"246\" src=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/list-rich-rules.jpg\" alt=\"List rich rules\" class=\"wp-image-50999\" srcset=\"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/list-rich-rules.jpg 972w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/list-rich-rules-380x96.jpg 380w, https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/list-rich-rules-768x194.jpg 768w\" sizes=\"(max-width: 972px) 100vw, 972px\" \/><\/a><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"Conclusion\">Conclusion<\/h2>\n\n\n\n<p>This concludes our guide. I hope you found it helpful. You should now have a good understanding of what Firewalld is and how to use it to secure your computers and network. Knowledge of it will allow you to use the tool&#8217;s flexibility and power.<\/p>\n\n\n\n<p>For a more in-depth overview of Firewalld, visit the <a href=\"https:\/\/firewalld.org\/documentation\/\" target=\"_blank\" rel=\"noreferrer noopener\">official documentation<\/a> or look at <a href=\"https:\/\/access.redhat.com\/documentation\/en-us\/red_hat_enterprise_linux\/9\/html\/configuring_firewalls_and_packet_filters\/using-and-configuring-firewalld_firewall-packet-filters\" target=\"_blank\" rel=\"noreferrer noopener\">this article<\/a> on the Red Hat website, who are authors of Firewalld.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This guide will teach you all you need to know to get started with firewalld to add, change, and remove rules from your firewall zones.<\/p>\n","protected":false},"author":10,"featured_media":50841,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,4417],"tags":[4155,4152,3374],"class_list":["post-50838","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tips","category-linux-knowledge","tag-firewall","tag-firewalld","tag-security"],"blocksy_meta":{"post_title_panel":"","has_hero_section":"default","9ae0b156ea778ebbdd07b9a17e4b6525":"","hero_section":"type-2","hero_elements":[{"id":"custom_title","enabled":true,"heading_tag":"h1","title":"Home","__id":"OdD9UOz2M1AzxHMIGSd_I"},{"id":"custom_description","enabled":false,"description_visibility":{"desktop":true,"tablet":true,"mobile":false},"__id":"dr_ekmuTEcYamYr7OwlVV"},{"id":"custom_meta","enabled":true,"meta_elements":[{"id":"author","enabled":true,"label":"By","has_author_avatar":"no","avatar_size":25,"__id":"Iqw9BSuUk7rXDjcyRAm_1"},{"id":"post_date","enabled":true,"label":"On","date_format_source":"default","date_format":"M j, Y","__id":"AZvGBx8cbFvGoId29h_Af"},{"id":"updated_date","enabled":false,"label":"On","date_format_source":"default","date_format":"M j, Y","__id":"Ii118QBu6dPbJxJjDd1yW"},{"id":"categories","enabled":false,"label":"In","style":"simple","__id":"uV80ueMatC9PzR9cH_ND3"},{"id":"comments","enabled":true,"__id":"louffbB93YiXPzldRU9LI"}],"page_meta_elements":{"joined":true,"articles_count":true,"comments":true},"__id":"Oxqk8FzzMLb0O4-QOmh5i","meta_type":"label","meta_divider":"circle"},{"id":"breadcrumbs","enabled":false,"__id":"DPrduFcIfPTsW-aX7SIv8"}],"2552baac1898d94a7c47b5f1e02d6001":"","hero_alignment1":"CT_CSS_SKIP_RULE","hero_margin":40,"hero_alignment2":"center","hero_vertical_alignment":"center","d0c02dde559cd3b8284f37d677946165":"","hero_structure":"normal","037007ff1ffa133959dee6aa4976838e":"","page_title_bg_type":"custom_image","custom_hero_background":{"attachment_id":50844,"url":"https:\/\/linuxiac.com\/wp-content\/uploads\/2022\/11\/firewalld-header-1024x237.jpg"},"page_title_image_size":"full","parallax":{"desktop":false,"tablet":false,"mobile":false},"3cc4105949427197ed846e5a4d497978":"","hero_height":"250px","pageTitleFont":{"family":"Default","variation":"Default","size":{"desktop":"2.8em","tablet":"2.8em","mobile":"2.8em","__changed":[]},"line-height":"CT_CSS_SKIP_RULE","letter-spacing":"CT_CSS_SKIP_RULE","text-transform":"CT_CSS_SKIP_RULE","text-decoration":"CT_CSS_SKIP_RULE"},"pageTitleFontColor":{"default":{"color":"CT_CSS_SKIP_RULEDEFAULT"}},"pageMetaFont":{"family":"Default","variation":"n6","size":"12px","line-height":"1.3","letter-spacing":"CT_CSS_SKIP_RULE","text-transform":"uppercase","text-decoration":"CT_CSS_SKIP_RULE"},"pageMetaFontColor":{"default":{"color":"CT_CSS_SKIP_RULEDEFAULT"},"hover":{"color":"CT_CSS_SKIP_RULEDEFAULT"}},"page_meta_button_type_font_colors":{"default":{"color":"CT_CSS_SKIP_RULEDEFAULT"},"hover":{"color":"CT_CSS_SKIP_RULEDEFAULT"}},"page_meta_button_type_background_colors":{"default":{"color":"CT_CSS_SKIP_RULEDEFAULT"},"hover":{"color":"CT_CSS_SKIP_RULEDEFAULT"}},"pageExcerptFont":{"family":"Default","variation":"Default","size":"CT_CSS_SKIP_RULE","line-height":"CT_CSS_SKIP_RULE","letter-spacing":"CT_CSS_SKIP_RULE","text-transform":"CT_CSS_SKIP_RULE","text-decoration":"CT_CSS_SKIP_RULE"},"pageExcerptColor":{"default":{"color":"CT_CSS_SKIP_RULEDEFAULT"}},"breadcrumbsFont":{"family":"Default","variation":"Default","size":"CT_CSS_SKIP_RULE","line-height":"CT_CSS_SKIP_RULE","letter-spacing":"CT_CSS_SKIP_RULE","text-transform":"CT_CSS_SKIP_RULE","text-decoration":"CT_CSS_SKIP_RULE"},"breadcrumbsFontColor":{"default":{"color":"CT_CSS_SKIP_RULEDEFAULT"},"initial":{"color":"CT_CSS_SKIP_RULEDEFAULT"},"hover":{"color":"CT_CSS_SKIP_RULEDEFAULT"}},"pageTitleOverlay":{"background_type":"color","background_pattern":"type-1","background_image":{"attachment_id":null,"x":0,"y":0},"gradient":"linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%)","background_repeat":"repeat","background_size":"auto","background_attachment":"scroll","patternColor":{"default":{"color":"#e5e7ea"}},"overlayColor":{"default":{"color":"CT_CSS_SKIP_RULE"}},"backgroundColor":{"default":{"color":"CT_CSS_SKIP_RULE"}}},"pageTitleBackground":{"background_type":"color","background_pattern":"type-1","background_image":{"attachment_id":null,"x":0,"y":0},"gradient":"linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%)","background_repeat":"repeat","background_size":"auto","background_attachment":"scroll","patternColor":{"default":{"color":"#e5e7ea"}},"overlayColor":{"default":{"color":"CT_CSS_SKIP_RULE"}},"backgroundColor":{"default":{"color":"var(--theme-palette-color-6)"}}},"pageTitlePadding":{"top":"50px","bottom":"50px","left":"auto","right":"auto","linked":true},"c1c451f3f7fc111dac4c2cede3a24de6":"","page_structure_type":"default","54a05f579164ac0e76e160995c5ebdf2":"","content_style_source":"inherit","content_style":"wide","02e9519ea14d1be4903ea44c4fc6e31b":"","vertical_spacing_source":"inherit","content_area_spacing":"both","background":{"background_type":"color","background_pattern":"type-1","background_image":{"attachment_id":null,"x":0,"y":0},"gradient":"linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%)","background_repeat":"repeat","background_size":"auto","background_attachment":"scroll","patternColor":{"default":{"color":"#e5e7ea"}},"overlayColor":{"default":{"color":"CT_CSS_SKIP_RULE"}},"backgroundColor":{"default":{"color":"CT_CSS_SKIP_RULE"}}},"content_background":{"background_type":"color","background_pattern":"type-1","background_image":{"attachment_id":null,"x":0,"y":0},"gradient":"linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%)","background_repeat":"repeat","background_size":"auto","background_attachment":"scroll","patternColor":{"default":{"color":"#e5e7ea"}},"overlayColor":{"default":{"color":"CT_CSS_SKIP_RULE"}},"backgroundColor":{"default":{"color":"var(--theme-palette-color-8)"}}},"content_boxed_shadow":{"inherit":false,"blur":18,"spread":-6,"v_offset":12,"h_offset":0,"inset":false,"enable":true,"color":{"color":"rgba(34, 56, 101, 0.04)"}},"content_boxed_border":{"width":1,"style":"none","color":{"color":"rgba(44,62,80,0.2)"}},"content_boxed_radius":{"top":"3px","bottom":"3px","left":"3px","right":"3px","linked":true},"boxed_content_spacing":{"desktop":{"top":"40px","bottom":"40px","left":"40px","right":"40px","linked":true},"tablet":{"top":"35px","bottom":"35px","left":"35px","right":"35px","linked":true},"mobile":{"top":"20px","bottom":"20px","left":"20px","right":"20px","linked":true}},"2c048bab8956ab6da7bd59f100112c8b":"","disable_featured_image":"no","disable_post_tags":"no","disable_share_box":"no","disable_author_box":"no","disable_posts_navigation":"no","c974f8caafa05a7a8f6d2268c86efe7d":"","disable_related_posts":"no","disable_header":"no","disable_footer":"no","9706d206e55cced64e93bd0348fa888b":"","header_footer_scripts_panel":"","header_scripts":"","b5ab55f24c3d581c338612417fbdbdeb":"","header_after_body_scripts":"","030f7a82ec34c7c3f09cce5e0c5a3c70":"","footer_scripts":"","styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":6},"a31998425536d1224ccac5515e3170ea":"","f2debdbb014d110e6a0c95065f1e38df":"","4156e1b74b9eda9d469d77eb774560b1":"","019e7bfd3789ad6319a2172b8f44db5a":"","bcc2b4cd0faba4085a205431beb039d6":"","e9e4918b04dedef6ad5728462d7c0356":"","0d1265205feb0a0e27adccc87496f353":"","7e1a8e1a8bc2a31012db2706ff708c1b":"","939de967e18242795f9a2489be99956a":"","943fd5f5263988474af6244b6804e472":"","8a50710a53d1453a8284be912745dc5e":"","74a1648f2aa420a78b9b688d6c8f040d":"","11264509ea7de90e8f4bb47726427f27":""},"_links":{"self":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts\/50838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/comments?post=50838"}],"version-history":[{"count":0,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/posts\/50838\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/media\/50841"}],"wp:attachment":[{"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/media?parent=50838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/categories?post=50838"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/linuxiac.com\/wp-json\/wp\/v2\/tags?post=50838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}