How to use firewall-cmd tool – centos7

Purpose – Enabling the firewalld service and using the firewall-cmd command line utility to configure zones

1. Checking the status of firewall daemon

[root@CentOS1 ~]# systemctl status firewalld
firewalld.service – firewalld – dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2016-07-10 21:49:13 IST; 6min ago
 Main PID: 866 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─866 /usr/bin/python -Es /usr/sbin/firewalld –nofork –nopid

Jul 10 21:49:06 CentOS1 systemd[1]: Starting firewalld – dynamic firewall daemon…
Jul 10 21:49:13 CentOS1 systemd[1]: Started firewalld – dynamic firewall daemon.

2/ Checking the state of firewall service

[root@CentOS1 ~]# firewall-cmd –state
running

3. Listing the zones that are currently available in the system

[root@CentOS1 ~]# firewall-cmd –get-zones
block dmz drop external home internal public trusted work

4. Listing the zone information

[root@CentOS1 ~]# firewall-cmd –zone=public –list-all
public (default, active)
  interfaces: eno16777736
  sources:
  services: dhcpv6-client ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

5. Checking the default zone that is currently active

[root@CentOS1 ~]# firewall-cmd –get-default-zone
public

6. Listing the services that are currently enable for a zone

[root@CentOS1 ~]# firewall-cmd –list-services
dhcpv6-client ssh

7. Adding a service to zone permanently

[root@CentOS1 ~]# firewall-cmd –zone=public –add-service=http –permanent
success
[root@CentOS1 ~]# firewall-cmd –reload
success

8. Removing a service enabled in zone permanently

[root@CentOS1 ~]# firewall-cmd –zone=public –remove-service=http –permanent
success
[root@CentOS1 ~]# firewall-cmd –reload
success

9. Adding a port to zone permanently

[root@CentOS1 bin]# firewall-cmd –zone=public –add-port=9000/tcp –permanent
success
[root@CentOS1 bin]# firewall-cmd –reload
success

10. Removing a port from zone permanently

[root@CentOS1 bin]# firewall-cmd –zone=public –remove-port=9000/tcp –permanent
success
[root@CentOS1 bin]# firewall-cmd –reload
success

11. Adding a range of ports to zone permanently

[root@CentOS1 bin]# firewall-cmd –zone=public –add-port=9000-9999/tcp –permanent
success
[root@CentOS1 bin]# firewall-cmd –reload
success

12. Listing the ports that are currently active

[root@CentOS1 bin]# firewall-cmd –zone=public –list-ports
9000-9999/tcp

Hope you enjoyed reading this article. Thank you.