How to use firewall-cmd tool

Here in this article we will try to enable the firewalld service and use the firewall-cmd command line utility to configure zones.

Table of Contents

Test Environment

CentOS 7

Process

1. Checking the status of firewall daemon

[root@CentOS1 ~]# systemctl status firewalld

firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Sun 2016-07-10 21:49:13 IST; 6min ago
 Main PID: 866 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─866 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Jul 10 21:49:06 CentOS1 systemd[1]: Starting firewalld - dynamic firewall daemon...
Jul 10 21:49:13 CentOS1 systemd[1]: Started firewalld - dynamic firewall daemon.

2. Checking the state of firewall service

[root@CentOS1 ~]# firewall-cmd --state

running

3. Listing the zones that are currently available in the system

[root@CentOS1 ~]# firewall-cmd --get-zones

block dmz drop external home internal public trusted work

4. Listing the zone information

[root@CentOS1 ~]# firewall-cmd --zone=public --list-all

public (default, active)
  interfaces: eno16777736
  sources:
  services: dhcpv6-client ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules:

5. Checking the default zone that is currently active

[root@CentOS1 ~]# firewall-cmd --get-default-zone

public

6. Listing the services that are currently enable for a zone

[root@CentOS1 ~]# firewall-cmd --list-services

dhcpv6-client ssh

7. Adding a service to zone permanently

[root@CentOS1 ~]# firewall-cmd --zone=public --add-service=http --permanent

success

[root@CentOS1 ~]# firewall-cmd --reload

success

8. Removing a service enabled in zone permanently

[root@CentOS1 ~]# firewall-cmd --zone=public --remove-service=http --permanent

success

[root@CentOS1 ~]# firewall-cmd --reload

success

9. Adding a port to zone permanently

[root@CentOS1 bin]# firewall-cmd --zone=public --add-port=9000/tcp --permanent

success

[root@CentOS1 bin]# firewall-cmd --reload

success

10. Removing a port from zone permanently

[root@CentOS1 bin]# firewall-cmd --zone=public --remove-port=9000/tcp --permanent

success

[root@CentOS1 bin]# firewall-cmd --reload

success

11. Adding a range of ports to zone permanently

[root@CentOS1 bin]# firewall-cmd --zone=public --add-port=9000-9999/tcp --permanent

success

[root@CentOS1 bin]# firewall-cmd --reload

success

12. Listing the ports that are currently active

[root@CentOS1 bin]# firewall-cmd --zone=public --list-ports

9000-9999/tcp

Hope you enjoyed reading this article. Thank you..