firewalld

Start firewalld daemon

$ sudo systemctl start firewalld

$ sudo systemctl enable firewalld

$ sudo systemctl status firewalld

$ sudo firewalld --debug

$ sudo firewalld --nofork

$ sudo firewalld --nopid

firewalld [--debug] [--debug-gc] [--nofork] [--nopid] [--system-config DIR] [--default-config DIR]

firewalld is a dynamic firewall daemon providing a frontend for nftables (or iptables as a legacy backend). It manages firewall rules dynamically, allowing changes without disrupting existing connections or requiring a full restart.
Firewalld uses the concept of zones to define trust levels for network connections (public, home, work, trusted, etc.). Each zone has predefined rules for allowed services and ports. Services define ports and protocols for common applications (ssh, http, https).
Users interact with firewalld primarily through firewall-cmd, the command-line client. Changes can be made at runtime (temporary) or permanently (persist across reboots). The daemon handles rule translation and manages the underlying packet filtering.

--debug

Set log level to debug and run in foreground.

Enable garbage collector leak information.

Do not fork into background (stay in foreground).

Disable writing PID file.

Path to system configuration directory.

Path to default configuration directory.

Display help message.

/etc/firewalld/firewalld.conf

Main daemon configuration including default zone, cleanup settings, and backend selection.

Zone definitions controlling network trust levels.

Service definitions for port and protocol mappings.

firewalld should not be used simultaneously with other firewall management tools like ufw or direct iptables manipulation. Running firewalld in debug mode generates verbose output and is intended for troubleshooting. The daemon requires root privileges and is typically managed via systemd.

firewalld was developed by Red Hat and introduced in Fedora 15 (2011) as a replacement for the static system-config-firewall tool. It provides dynamic management without requiring service restarts. In 2018, firewalld switched from iptables to nftables as its default backend, though iptables support remains for compatibility.

firewall-cmd(1), firewall-offline-cmd(1), nft(8), iptables(8)