firewall-cmd — Manage firewalld rules

Linux / Network and Firewall / firewall-cmd.html

Inspects and applies firewalld zones, services and port rules from the command line.

Basic Information

What is this command?

firewall-cmd is the client that queries and changes rules in the firewalld daemon.

Rules exist at runtime and in permanent configuration; permanent ones apply after a reload.

What problems does it solve?

• Open a port or service for allowed traffic.
• List every rule in the active zone.
• Persist runtime rules into the permanent configuration.
• Allow only one source network.

Key features

Runtime rules

Without --permanent a change applies at once and disappears on restart.

• When to use: For a temporary opening.
• What you get: Traffic passes immediately.
• Limitations: It is lost after restart or reload.

Permanent rules

Save with --permanent, then apply with --reload.

• When to use: When the rule must survive reboots.
• What you get: The rule is written to configuration and persists.
• Limitations: It does not affect traffic until reloaded.

Zone management

Assign interfaces and sources to zones to separate policies.

• When to use: When internal and external networks differ.
• What you get: Each zone enforces its own rules.
• Limitations: Wrong zone priority applies unintended rules.

Installation and usage

Check whether it is installed

firewall-cmd --version

sudo apt install firewalld

Real-world examples

Check state

Show daemon state and default zone.

firewall-cmd --state && firewall-cmd --get-default-zone

Open a port

Open 8080/tcp permanently.

firewall-cmd --permanent --add-port=8080/tcp && firewall-cmd --reload

List rules

List allowed services and ports in the zone.

firewall-cmd --list-all