firewall-cmd

List all zones and rules

$ firewall-cmd --list-all-zones

$ firewall-cmd --permanent --zone block --change-interface enp1s0

$ firewall-cmd --permanent --zone public --add-service https

$ firewall-cmd --permanent --zone public --remove-service http

$ firewall-cmd --permanent --zone public --add-rich-rule 'rule family "ipv4" forward-port port "443" protocol "tcp" to-port "8443"'

$ firewall-cmd --reload

$ firewall-cmd --runtime-to-permanent

$ firewall-cmd --panic-on

firewall-cmd [OPTIONS]

firewall-cmd is the command-line interface for firewalld, providing dynamic management of the Linux firewall. It supports zones, services, port forwarding, masquerading, and rich rules with both runtime and permanent configurations.

--list-all-zones

List all available zones with their settings

Specify the zone to operate on

Add a service to the zone

Remove a service from the zone

Add a port to the zone

Make changes permanent (survives reboot)

Reload firewall configuration

Save runtime configuration to permanent

Enable/disable panic mode (drops all traffic)

**/etc/firewalld/zones/*.xml**

Zone definitions including allowed services, ports, and rich rules.

Service definitions mapping service names to ports and protocols.

Changes without --permanent are lost on reload or reboot. After permanent changes, use --reload to apply them. Zone changes may disconnect active sessions.

firewall-cmd is the client for firewalld, Red Hat's dynamic firewall management daemon used in RHEL, CentOS, and Fedora.

firewalld(1), iptables(8), nft(8)