firewall-cmd(1)
Control the firewalld daemon and manage firewall rules dynamically without restarting the service.
Synopsis
firewall-cmd [OPTIONS] [ZONE]Description
firewall-cmd is the command-line interface to firewalld, the dynamic firewall manager for Linux systems. It allows you to manage firewall rules, zones, and services in real-time without requiring a restart of the firewall daemon.
Changes made with firewall-cmd are temporary by default. Use the --permanent flag to make changes persistent across reboots. After adding permanent rules, reload the firewall with --reload to apply them immediately.
firewalld uses zones to define trust levels for network connections, and supports both predefined services and custom rules for granular control over inbound and outbound traffic.
Common options
| Flag | What it does |
|---|---|
--permanent | Make the rule persistent; without this flag, changes are temporary until reboot |
--reload | Reload firewall rules from disk, applying all permanent changes |
--add-service=SERVICE | Allow traffic for a named service (e.g., http, ssh, https) |
--remove-service=SERVICE | Remove a previously allowed service |
--add-port=PORT/PROTOCOL | Allow traffic on a specific port (e.g., 8080/tcp) |
--remove-port=PORT/PROTOCOL | Deny traffic on a specific port |
--list-services | List all available predefined services |
--list-all | Show all rules, services, and settings for the active zone |
--get-active-zones | Display zones currently bound to network interfaces |
--set-default-zone=ZONE | Change the default zone for unassigned interfaces |
--add-source=CIDR --zone=ZONE | Allow all traffic from a source IP address or subnet |
--state | Check if firewalld is running |
Examples
Check if the firewall daemon is currently running
sudo firewall-cmd --stateDisplay which zones are currently active and their assigned interfaces
sudo firewall-cmd --get-active-zonesShow all firewall rules and services for the default zone
sudo firewall-cmd --list-allTemporarily allow HTTP and HTTPS traffic (until reboot)
sudo firewall-cmd --add-service=http --add-service=httpsPermanently allow SSH, then reload to apply the change immediately
sudo firewall-cmd --permanent --add-service=ssh && sudo firewall-cmd --reloadTemporarily allow TCP traffic on port 8080 in the public zone
sudo firewall-cmd --add-port=8080/tcp --zone=publicPermanently trust all traffic from the 192.168.1.0/24 subnet
sudo firewall-cmd --permanent --add-source=192.168.1.0/24 --zone=trustedDisplay all available predefined services that can be quickly enabled
sudo firewall-cmd --list-services