firewalld Zones, Services and Ports
This appears in two objectives - networking and security - and is one skill. The runtime/permanent split is the whole of it: --permanent writes the config without changing the running firewall, and without --permanent the change is lost at the next reload. Both halves are demonstrated failing.
Basic Networking Guide 51 of 67 Intermediate
- OSRHEL 10.0
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 16 min
firewalld writes nftables rules underneath. Hand-written nft or iptables rules will be overwritten by the next firewall-cmd --reload, which is why the objective names firewalld and not the layer below it.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
This guide includes
Use this because it appears in two objectives at once. This matters because runtime and permanent are effectively two different firewalls - a rule added to one is not in the other, and a reload discards the difference.
- reading the zones, and what is currently open
- using services, which are names rather than port numbers
- separating runtime from permanent, which behave as two different firewalls
- adding ports, and verifying by exit status
- reading what it writes underneath, and building a zone of your own
Before you start
- A sudo-capable account.
- The
sshservice is never removed from any zone here. On a machine you reach over the network,--remove-service=ssh --permanent --reloadsucceeds and ends the session.
-
Zones, and what is open
-
Services are names, not numbers
-
Runtime and permanent are two different firewalls
-
Ports, and verifying by exit status
-
What it writes underneath
-
A zone of its own, and the one rule never to break