A one-page reference for firewall-cmd and firewalld on Red Hat Enterprise Linux, AlmaLinux, Rocky Linux, Oracle Linux and CentOS Stream. firewalld uses the nftables backend by default on EL8, EL9 and EL10, and the commands below work on all three. For a real-world use, see Configure Central rsyslog Logging on RHEL, AlmaLinux, Rocky and Oracle Linux .
Run as root or with sudo. Changes without --permanent apply only to the running firewall and are lost at reload or reboot; changes with --permanent only take effect after --reload.
Service and state
Command What it does dnf install firewalldInstall firewalld (already present on most installs) systemctl enable --now firewalldStart now and at boot firewall-cmd --statePrint running or not running firewall-cmd --reloadLoad permanent config into runtime, keeping existing connections firewall-cmd --complete-reloadFull reload, drops connection state firewall-cmd --runtime-to-permanentSave the current runtime config as permanent firewall-cmd --check-configCheck permanent XML config for errors firewall-cmd --versionShow firewalld version journalctl -u firewalld -eRecent firewalld log messages
Zones
Command What it does firewall-cmd --get-zonesList all zones firewall-cmd --get-default-zoneShow the default zone firewall-cmd --set-default-zone=internalChange the default zone (runtime and permanent) firewall-cmd --get-active-zonesZones in use, with their interfaces and sources firewall-cmd --list-allEverything allowed in the default zone firewall-cmd --zone=public --list-allEverything allowed in one zone firewall-cmd --list-all-zonesFull config of every zone firewall-cmd --get-zone-of-interface=eth0Which zone an interface is in firewall-cmd --permanent --zone=internal --change-interface=eth1Move an interface to a zone firewall-cmd --permanent --zone=trusted --add-source=10.0.0.0/8Put a source network in a zone firewall-cmd --permanent --new-zone=mgmtCreate a custom zone (reload afterwards) firewall-cmd --permanent --zone=mgmt --set-target=DROPSet what happens to unmatched traffic
For interfaces managed by NetworkManager, setting the zone on the connection is more persistent: nmcli connection modify eth1 connection.zone internal.
Services
Command What it does firewall-cmd --get-servicesList all predefined services firewall-cmd --info-service=httpsShow ports and modules for a service firewall-cmd --list-servicesServices allowed in the default zone firewall-cmd --permanent --add-service=http --add-service=httpsAllow services permanently firewall-cmd --permanent --remove-service=cockpitRemove a service firewall-cmd --query-service=sshCheck if a service is allowed (yes/no) firewall-cmd --add-service=http --timeout=10mAllow temporarily; removed after the timeout firewall-cmd --permanent --new-service=myappCreate a custom service firewall-cmd --permanent --service=myapp --add-port=8443/tcpAdd a port to a custom service ls /usr/lib/firewalld/services/ /etc/firewalld/services/Built-in and custom service XML files
Ports and protocols
Command What it does firewall-cmd --list-portsOpen ports in the default zone firewall-cmd --permanent --add-port=8080/tcpOpen one TCP port firewall-cmd --permanent --add-port=60000-61000/udpOpen a port range firewall-cmd --permanent --remove-port=8080/tcpClose a port firewall-cmd --permanent --add-protocol=vrrpAllow a whole protocol (for example for keepalived) firewall-cmd --permanent --add-source-port=53/udpAllow traffic by source port
Rich rules
Command What it does firewall-cmd --list-rich-rulesShow rich rules in the default zone firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" service name="ssh" accept'Allow SSH from one subnet only firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.7" drop'Drop all traffic from one address firewall-cmd --permanent --add-rich-rule='rule service name="ssh" log prefix="ssh " level="info" limit value="3/m" accept'Allow and log SSH, rate-limited log firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.1.1.0/24" port port="5432" protocol="tcp" accept'Allow PostgreSQL from one network firewall-cmd --permanent --remove-rich-rule='rule ...'Remove a rich rule (paste it exactly as listed)
NAT, masquerading and port forwarding
Command What it does firewall-cmd --permanent --zone=external --add-masqueradeEnable source NAT (masquerade) in a zone firewall-cmd --zone=external --query-masqueradeCheck whether masquerading is on firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080Redirect a port locally firewall-cmd --permanent --add-forward-port=port=443:proto=tcp:toport=443:toaddr=10.0.0.20Forward a port to another host (needs masquerade) firewall-cmd --list-forward-portsList port forwards sysctl net.ipv4.ip_forwardCheck kernel IP forwarding (firewalld enables it for masquerade)
Policies (firewalld 0.9 and later: EL9, EL10)
Command What it does firewall-cmd --get-policiesList policies firewall-cmd --permanent --new-policy=int-to-extCreate a policy for traffic between zones firewall-cmd --permanent --policy=int-to-ext --add-ingress-zone=internalSet where traffic comes from firewall-cmd --permanent --policy=int-to-ext --add-egress-zone=externalSet where traffic goes firewall-cmd --permanent --policy=int-to-ext --set-target=ACCEPTAllow forwarded traffic matching the policy firewall-cmd --info-policy=int-to-extShow a policy
IP sets
Command What it does firewall-cmd --permanent --new-ipset=blocklist --type=hash:netCreate an IP set firewall-cmd --permanent --ipset=blocklist --add-entry=198.51.100.0/24Add an entry firewall-cmd --permanent --ipset=blocklist --add-entries-from-file=bad.txtAdd many entries from a file firewall-cmd --permanent --zone=drop --add-source=ipset:blocklistDrop everything from the set firewall-cmd --info-ipset=blocklistShow a set and its entries
ICMP, logging and emergencies
Command What it does firewall-cmd --get-icmptypesList ICMP types firewall-cmd --permanent --add-icmp-block=echo-requestBlock ping firewall-cmd --permanent --add-icmp-block-inversionTurn ICMP blocks into an allow list firewall-cmd --get-log-deniedShow denied-packet logging setting firewall-cmd --set-log-denied=allLog denied packets (see journalctl -k) firewall-cmd --panic-onDrop all traffic immediately (careful over SSH) firewall-cmd --panic-offLeave panic mode firewall-cmd --query-panicCheck panic mode
Offline, files and backend
Command What it does firewall-offline-cmd --add-service=httpChange permanent config while firewalld is stopped (kickstart, images) ls /etc/firewalld/zones/Your permanent zone XML files grep FirewallBackend /etc/firewalld/firewalld.confShow the backend (nftables on EL8 and later) nft list rulesetView the nftables rules firewalld generated firewall-cmd --permanent --zone=public --add-interface=eth0 && firewall-cmd --reloadTypical pattern: permanent change, then reload
Distro notes
RHEL, AlmaLinux, Rocky Linux, Oracle Linux and CentOS Stream ship the same firewalld package for each major release, so the commands are identical across them.
EL8 has firewalld 0.8/0.9 (policies appear in later EL8 minor releases), EL9 has 1.x and EL10 has 2.x. Direct rules (--direct) are deprecated; use rich rules or policies.
Oracle Linux on OCI images often relies on cloud security lists as well as firewalld; open ports in both.
CentOS 7 used the iptables backend; on EL8 and later, iptables commands go through iptables-nft and do not show firewalld rules.
Related posts
Put these commands to use in the central rsyslog logging guide and the Postfix and Dovecot server build .
