Home / Cheat Sheets / firewalld Cheat Sheet

Linux firewall quick reference

firewalld Cheat Sheet

Copy-friendly firewall-cmd commands for checking status, listing zones, allowing services, opening ports, saving permanent rules and troubleshooting Linux firewall issues.

Status checks

Check service status

systemctl status firewalld

Check firewalld state

firewall-cmd --state

Start and enable

sudo systemctl enable --now firewalld

Reload rules

sudo firewall-cmd --reload

Zones

Default zone

firewall-cmd --get-default-zone

Active zones

firewall-cmd --get-active-zones

List current zone

firewall-cmd --list-all

List a specific zone

firewall-cmd --zone=public --list-all

Set default zone

sudo firewall-cmd --set-default-zone=public

List all zones

firewall-cmd --get-zones

Services

List allowed services

firewall-cmd --list-services

List known services

firewall-cmd --get-services

Allow HTTP

sudo firewall-cmd --add-service=http

Allow HTTPS

sudo firewall-cmd --add-service=https

Allow SSH permanently

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

Remove service

sudo firewall-cmd --remove-service=http

Ports

List open ports

firewall-cmd --list-ports

Open TCP port

sudo firewall-cmd --add-port=8080/tcp

Open UDP port

sudo firewall-cmd --add-port=5353/udp

Open port range

sudo firewall-cmd --add-port=3000-3010/tcp

Open port permanently

sudo firewall-cmd --permanent --add-port=8443/tcp
sudo firewall-cmd --reload

Remove port

sudo firewall-cmd --remove-port=8080/tcp

Runtime vs permanent

Temporary rule

sudo firewall-cmd --add-service=https

Applies now, but may disappear after reload or reboot.

Permanent rule

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Save tested runtime rules

sudo firewall-cmd --runtime-to-permanent

Reload permanent config

sudo firewall-cmd --reload

Remove rules

Remove service now

sudo firewall-cmd --remove-service=https

Remove service permanently

sudo firewall-cmd --permanent --remove-service=https
sudo firewall-cmd --reload

Remove port now

sudo firewall-cmd --remove-port=8080/tcp

Remove port permanently

sudo firewall-cmd --permanent --remove-port=8080/tcp
sudo firewall-cmd --reload

Rich rules

List rich rules

firewall-cmd --list-rich-rules

Allow SSH from one IP

sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="203.0.113.10" service name="ssh" accept'

Permanent rich rule

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.10" service name="ssh" accept'
sudo firewall-cmd --reload

Remove rich rule

sudo firewall-cmd --remove-rich-rule='rule family="ipv4" source address="203.0.113.10" service name="ssh" accept'

Troubleshooting commands

Show firewall config

firewall-cmd --list-all

Check active zones

firewall-cmd --get-active-zones

Check listening ports

ss -tulpn

Check service logs

journalctl -u firewalld -n 100 --no-pager

Check application status

systemctl status nginx

Test web response

curl -I https://example.com

Common examples

Allow web traffic

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Allow custom app port

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

Check before opening a port

ss -tulpn | grep ':8080'

View full public zone

firewall-cmd --zone=public --list-all

Firewall workflows

Safe firewalld rule workflow

# Check active zones
firewall-cmd --get-active-zones

# List current zone rules
firewall-cmd --list-all

# Permanently allow HTTPS
firewall-cmd --permanent --add-service=https

# Reload and confirm
firewall-cmd --reload
firewall-cmd --list-services

Be careful when changing SSH access remotely. Confirm your current access path before reloading firewall rules.

FAQ

Frequently Asked Questions

What is a firewalld zone?

A zone is a trust level that controls which services and ports are allowed.

What does --permanent do?

It saves the rule so it persists after reloads and reboots.

Do I need to reload firewalld?

Yes, after permanent changes you generally run firewall-cmd --reload.

How do I list open services?

Use firewall-cmd --list-services.