Zones, services and ports

The idea

firewalld manages the kernel’s packet filter (nftables on RHEL 10) through a simpler model. You do not write packet rules; you decide what is allowed in for each part of the network.

Zones

A zone is a trust level with its own list of allowed services and ports. Network interfaces and source addresses are assigned to zones; a packet is judged by the rules of its zone.

Zone	Meaning (default behaviour)
drop	Silently discard everything incoming
block	Reject everything incoming with a message
public	Untrusted network; only selected services (ssh, cockpit, dhcpv6-client). The default zone
internal, work, home	More trusted networks; a few more services
trusted	Allow everything

Each interface belongs to exactly one zone; an interface not otherwise assigned uses the default zone.

Services and ports

• A service is a named bundle of ports and protocols: ssh is TCP 22, http is TCP 80, https is TCP 443, nfs is TCP 2049. firewall-cmd --get-services lists them and --info-service=NAME shows what one contains.
• A port rule is PORT/PROTOCOL such as 8081/tcp for something without a service name.

Prefer services when one exists (clearer, and covers multiple ports), and a port when it doesn’t.

Runtime and permanent

firewalld keeps two configurations:

Configuration	Changed with	Survives reload / reboot
Runtime	Commands without --permanent	No
Permanent	Commands with --permanent	Yes, but not active until --reload

The classic mistake is adding a rule without --permanent (works now, gone after a reboot) or with it and no --reload (saved, but not yet active). Two safe patterns:

1. firewall-cmd --permanent --add-service=http then firewall-cmd --reload
2. firewall-cmd --add-service=http (test it) then firewall-cmd --runtime-to-permanent

Nothing is allowed until you say so, except what the zone already includes. Remember the service itself must be running and listening: the firewall only decides whether packets reach it.

Try it

sudo systemctl enable --now firewalld
firewall-cmd --state
firewall-cmd --list-all

running
public (default, active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: cockpit dhcpv6-client ssh
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

Allow a service

sudo dnf install -y httpd
echo 'hello from node1' | sudo tee /var/www/html/index.html
sudo systemctl enable --now httpd
curl -s -m3 http://node1 || echo "blocked"     # from node2
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload
curl -s http://node1                             # from node2

blocked
success
success
hello from node1

A blocked packet is dropped without a reply, so curl waits and times out (-m3 limits the wait to 3 seconds). If instead you see Connection refused, the firewall let the packet through and nothing is listening: check ss -tlnp.

Open and close a port

sudo firewall-cmd --permanent --add-port=8081/tcp
sudo firewall-cmd --reload
firewall-cmd --list-ports
sudo firewall-cmd --permanent --remove-port=8081/tcp
sudo firewall-cmd --reload

success
success
8081/tcp
success
success

Runtime versus permanent

sudo firewall-cmd --add-service=https
firewall-cmd --list-services
sudo firewall-cmd --permanent --list-services
sudo firewall-cmd --runtime-to-permanent

success
cockpit dhcpv6-client http https ssh
cockpit dhcpv6-client http ssh
success

Zones for interfaces

firewall-cmd --get-active-zones
sudo firewall-cmd --permanent --zone=internal --change-interface=eth1
sudo firewall-cmd --permanent --zone=internal --add-service=nfs
sudo firewall-cmd --reload
firewall-cmd --get-active-zones

public
  interfaces: eth0
success
success
success
internal
  interfaces: eth1
public
  interfaces: eth0

firewall-cmd --set-default-zone=internal changes the zone for all interfaces without an explicit assignment, immediately and permanently. If a connection is managed by NetworkManager, the zone is best stored in the connection: nmcli connection modify NAME connection.zone internal.

Going further

firewall-cmd --list-all-zones shows every zone, and --get-zones lists the names. --add-service accepts a timeout for temporary rules: --add-service=http --timeout=5m. --panic-on drops all traffic including established connections (and --panic-off ends it). firewall-cmd --check-config validates permanent files, and the files themselves live in /etc/firewalld/zones/ as XML. firewall-cmd --direct and nft list ruleset expose the underlying nftables rules, useful for debugging but not for normal configuration. Custom services are described in /etc/firewalld/services/NAME.xml.