Dynamic firewall daemon managing zones, services, and ports.
high risk
firewall-cmd --list-allReview the active configuration first.firewall-cmd --runtime-to-permanentTest at runtime, then persist.firewalld is the default firewall management tool on RHEL/CentOS/Fedora and their derivatives. It organizes rules into zones (public, trusted, internal, dmz) and uses services/ports instead of raw iptables chains. Changes with --permanent persist across reboots; without it, changes are runtime-only.
| Flag | Meaning |
|---|---|
--zone | Target zone (default: active zone) |
--permanent | Make change persistent (survives reboot) |
--runtime-to-permanent | Save all runtime rules to permanent |
--reload | Reload permanent rules into runtime |
--list-all | List all settings for a zone |
firewall-cmd --stateCheck if firewalld is running · explain & risk-check →firewall-cmd --list-allShow all rules in active zone · explain & risk-check →firewall-cmd --permanent --add-service=https && firewall-cmd --reloadOpen HTTPS permanently · explain & risk-check →firewall-cmd --permanent --add-port=8080/tcp && firewall-cmd --reloadOpen custom port 8080/tcp permanently · explain & risk-check →firewall-cmd --permanent --remove-service=http && firewall-cmd --reloadBlock HTTP permanently · explain & risk-check →firewall-cmd --get-active-zonesShow active zones and their interfaces · explain & risk-check →firewall-cmd --permanent --zone=trusted --add-source=10.0.0.0/8Trust entire 10.x.x.x network · explain & risk-check →Always pair `--permanent` with `--reload` in a single operation — setting permanent without reload leaves runtime unchanged, leading to a 'why didn't my rule apply?' confusion.
Reference text is hand-written and may be incomplete — check man firewalld for your version. Test destructive commands on a non-production system first.