Skip to main content
Imagine a server connected to a network where any open service can be reached by anyone on that network. Without a firewall, services such as SSH, web servers, or databases can be exposed to attacks. Firewalld helps you control which network traffic is allowed or blocked on your system so only the intended services are reachable.
A dark-themed presentation slide titled "Firewalld — Introduction" with two highlighted points: "Control network traffic" and "Secure server access." The layout shows the title on the left and two rounded dark boxes with the points on the right.
A firewall is like security at a building entrance: it decides which visitors are allowed in and which are denied. firewalld is the firewall service used on Red Hat Enterprise Linux and compatible distributions. It provides a higher-level, zone-based abstraction over low-level packet filtering so you can manage access more easily. Zones let you express how much trust you place in network traffic from different sources. Think of zones as security profiles for network connections: traffic from your internal network may be trusted, while traffic from the public Internet should be restricted. Each zone contains rules that permit or block specific services, ports, and protocols.
The image shows a protected Linux server icon at the center of concentric colored rings representing network trust zones. Each ring is labeled (Trusted, Internal, Public, Untrusted) with brief notes about allowed or blocked traffic.
When you assign a network interface to a zone, that zone’s rules apply to all traffic on that interface. For example, the public zone typically allows a few essential services (like SSH) while blocking most incoming traffic. A trusted zone might allow nearly all connections. Assigning interfaces and sources to appropriate zones simplifies firewall management—you don’t need to write many low-level rules; pick the right zone and firewalld enforces the policy. To understand firewalld, focus on its four main building blocks: zones, services, ports, and interfaces. The following table summarizes their purpose and examples.
A slide titled "Firewalld Architecture" showing four dark panels labeled Zones, Services, Ports, and Interfaces. Each panel gives a short definition (e.g., zones = network trust levels; services = predefined ports/protocols like SSH/HTTP; ports = specific endpoints like 8080/tcp; interfaces = assign zones to eth0/ens33).
Below are the common commands you will use to inspect and modify the firewall. Commands without --permanent modify the runtime configuration and are lost on reboot. Use --permanent to change the saved configuration and run firewall-cmd --reload to apply permanent changes to the current runtime. Commands quick reference: Common changes (runtime vs. permanent)
  • Allow a service (runtime only):
  • Remove a service (runtime only):
  • Make a service change permanent:
  • Add a specific port (example: 8080/tcp):
  • Remove a port:
  • Assign an interface to a zone:
  • Reload to apply permanent configuration to the runtime:
By default, commands without --permanent change only the runtime configuration and are lost on reboot. Using --permanent modifies the saved configuration, and firewall-cmd --reload applies those permanent changes to the current runtime.
With zones, services, ports, and interfaces, firewalld gives you a flexible, higher-level way to control network access without composing complex, low-level iptables rules. Links and references

Watch Video