Hands-on Lab·Red Hat Certified System Administrator
firewalld Zones, Services and Ports
This appears in two objectives - networking and security - and is one skill. The runtime/permanent split is the whole of it: `--permanent` writes the config without changing the running firewall, and without `--permanent` the change is lost at the next reload. Both halves are demonstrated failing.
Basic Networking Guide 51 of 67 Intermediate
- OSRHEL 10.0 (Coughlan)
- Kernel6.12.0-55.9.1.el10_0
- dnf4.20.0
- Flatpak1.16.0
- TimeAbout 16 min
- Reviewed23 August 2026
Written against the versions above. firewalld writes **nftables** rules underneath. Hand-written `nft` or `iptables` rules will be overwritten by the next `firewall-cmd --reload`, which is why the objective names firewalld and not the layer below it.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| RHCSA-A01 | 192.168.0.31 | RHEL 10.0 (Coughlan) | Practice node (graded) - spare /dev/sda | 2 Core | 4 GB | 50 GB + 15 GB |
Before you start
- A sudo-capable account.
- The
sshservice is never removed from any zone here. On a machine you reach over the network,--remove-service=ssh --permanent --reloadsucceeds and ends the session.
-
Zones, and what is open
-
Services are names, not numbers
-
Runtime and permanent are two different firewalls
-
Ports, and verifying by exit status
-
What it writes underneath
-
A zone of its own, and the one rule never to break