Essential firewalld Commands Every Linux Admin Should Know

Prerequisites

Linux operating system installed and running
Access to a terminal or command line
Root or sudo privileges
firewalld package installed
Basic knowledge of firewall concepts

Introduction

In this guide, we’ll walk you through the essentials of firewalld, from installation and configuration to managing zones and firewall rules. Whether you're securing a single server or managing multiple systems, these practical insights will help you get the most out of firewalld and ensure your network traffic is properly controlled.

Linux distributions

firewalld is pre-installed and the default firewall management tool in most Red Hat-based distributions (Fedora, RHEL, CentOS, AlmaLinux, Rocky Linux) and openSUSE. On Debian-based distributions (Ubuntu, Debian), it's not installed by default but can be easily installed via the package manager.

To install it on Ubuntu

1. Update package index
   • First, update your package index to ensure you're installing the latest version of firewalld available in the repository.
     • apt update
2. Install firewalld
   • apt install firewalld
3. Start and enable firewalld
   • after installation, you need to start the firewalld service and enable it to start automatically on boot.
     • systemctl start firewalld
   • to enable it to start on boot
     • systemctl boot firewalld
4. Check the status of firewalld
   • Verify that firewalld is running by checking its status
     • systemctl status firewalld
5. Verify firewalld installation
   • This should return running, indicating that the firewall is active.
     • firewall-cmd --state

Check the firewall status

firewall-cmd --state

Only shows whether firewalld is running or not, focusing on its operational state.

systemctl status firewalld

Gives a detailed report of the firewalld service status, including logs and system-level information.

Start/Stop firewalld

systemctl start firewalld

systemctl stop firewalld

Get active zones

firewall-cmd --get-active-zones

Get default zone

firewall-cmd --get-default-zone

List all rules

firewall-cmd --list-all

List the configuration of all zones

firewall-cmd --list-all-zones

Add a service to a zone

firewall-cmd --zone=public --add-service=http --permanent

firewall-cmd --zone=public --add-service=http --permanent

Remove a service from a zone

firewall-cmd --zone=public --remove-service=http --permanent

firewall-cmd --zone=public --remove-service=http --permanent

Add a port to a zone

firewall-cmd --permanent --zone=public --add-port=80/tcp

firewall-cmd --permanent --zone=public --add-port=443/tcp

Remove a port from a zone

firewall-cmd --zone=public --remove-port=80/tcp --permanent

firewall-cmd --zone=public --remove-port=443/tcp --permanent

List all ports (for all zones)

firewall-cmd --list-ports

List available services

firewall-cmd --get-services

Allow a specific IP addresss

firewall-cmd --zone=public --add-source=192.168.100.0 --permanent

Remove a IP address from the whitelist

firewall-cmd --zone=public --remove-source=192.168.100.0 --permanent

Block a specific IP address

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.100" reject' --permanent

Remove a rich text rule

firewall-cmd --zone=public --remove-rich-rule='rule family="ipv4" source address="192.168.1.100" reject' --permanent

List rich rules

firewall-cmd --zone=public --list-rich-rules

List sources in a specific zone

firewall-cmd --zone=public --list-sources

Replace public with the zone you want to check.

Permanent changes

After making permanent changes, reload firewalld to apply the changes

firewall-cmd --reload

Common service ports

• 22 - SFTP/SSH
• 80 - HTTP
• 443 - HTTPS
• 3306 - MySQL

Final Thoughts

In this post, we've explored the essential aspects of configuring and managing firewalld on a Linux system. From setting up zones to adding services and blocking IP addresses, firewalld provides a powerful and flexible way to control network traffic and ensure your system is secure. Whether you're a beginner or an experienced Linux user, mastering firewalld is crucial for maintaining a secure environment.

If you're interested in learning more about firewalld, including advanced configurations and troubleshooting tips, be sure to check out the official documentation on their website. The firewalld official site provides comprehensive resources, including a detailed guide and best practices for managing your firewall settings.

Stay secure, and happy configuring!