CLI tool to interact with the firewalld service.
high risk
firewall-cmd --list-allSee the current zone configuration.firewall-cmd is the command-line client for firewalld. It supports rich rules for complex filtering (source IP + port + protocol), port forwarding, masquerading, and IP sets. Rich rules give you iptables-level power with firewalld's zone management.
| Flag | Meaning |
|---|---|
--add-rich-rule | Add a rich rule with complex matching |
--add-masquerade | Enable IP masquerading (NAT) |
--add-forward-port | Add port forwarding rule |
--query-service | Check if a service is enabled |
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.1.0/24 port port=22 protocol=tcp accept'Allow SSH only from specific subnet · explain & risk-check →firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.5 reject'Block a specific IP · explain & risk-check →firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080Forward port 80 to 8080 · explain & risk-check →firewall-cmd --permanent --zone=public --add-masqueradeEnable NAT masquerading · explain & risk-check →firewall-cmd --query-service=sshCheck if SSH service is allowed · explain & risk-check →Use rich rules for IP-based allow/deny instead of iptables — they integrate with zones and persist cleanly. Test with `--timeout=30` to auto-revert if you accidentally lock yourself out.
Reference text is hand-written and may be incomplete — check man firewall-cmd for your version. Test destructive commands on a non-production system first.