Complete quick reference for daily and advanced administration.
dnf install firewalld
systemctl enable --now firewalld
systemctl status firewalld
firewall-cmd --state
firewall-cmd --reload
systemctl restart firewalld
firewall-cmd --add-service=http
firewall-cmd --add-service=http --permanent
firewall-cmd --reload
firewall-cmd --get-zones
firewall-cmd --get-default-zone
firewall-cmd --set-default-zone=public
firewall-cmd --get-active-zones
firewall-cmd --zone=internal --change-interface=eth1 --permanent
firewall-cmd --zone=trusted --add-source=192.168.10.0/24 --permanent
firewall-cmd --get-services
firewall-cmd --zone=public --list-services
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --zone=public --remove-service=http --permanent
firewall-cmd --zone=public --add-port=8080/tcp --permanent
firewall-cmd --zone=public --add-port=53/udp --permanent
firewall-cmd --zone=public --remove-port=8080/tcp --permanent
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.0.0.5" service name="ssh" accept'
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="1.2.3.4" drop'
firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="5.6.7.8" log prefix="FW-DROP " level="info" drop'
firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=192.168.1.10
firewall-cmd --zone=external --add-masquerade --permanent
sysctl -w net.ipv4.ip_forward=1
firewall-cmd --permanent --new-ipset=blacklist --type=hash:ip
firewall-cmd --permanent --ipset=blacklist --add-entry=1.2.3.4
firewall-cmd --permanent --zone=public --add-rich-rule='rule source ipset="blacklist" drop'
firewall-cmd --get-ipsets
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -s 10.10.10.10 -j DROP
firewall-cmd --direct --get-all-rules
firewall-cmd --lockdown-on
firewall-cmd --permanent --add-lockdown-whitelist-command=/usr/bin/firewall-cmd
firewall-cmd --get-icmptypes
firewall-cmd --permanent --add-icmp-block=echo-request
vi /etc/firewalld/services/myapp.xml
<service>
<short>MyApp</short>
<description>Custom App</description>
<port protocol="tcp" port="9000"/>
</service>
firewall-cmd --reload
firewall-offline-cmd --add-service=http
firewall-offline-cmd --add-port=8443/tcp
firewall-cmd --set-log-denied=all
nft list ruleset
journalctl -xeu firewalld
cp -r /etc/firewalld /root/firewalld.backup
rm -rf /etc/firewalld
systemctl restart firewalld
--permanent in production./etc/firewalld before major changes.