firewalld Cheat Sheet: Firewall Commands for RHEL

A quick reference for firewalld — the dynamic Linux firewall manager. Bookmark this page.

Basic Commands

# Status
sudo firewall-cmd --state
sudo systemctl status firewalld

# Start/stop
sudo systemctl start firewalld
sudo systemctl enable firewalld

Zone Management

# List zones
sudo firewall-cmd --get-zones
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --get-default-zone

# Set default zone
sudo firewall-cmd --set-default-zone=public

# Assign interface to zone
sudo firewall-cmd --zone=trusted --add-interface=eth1 --permanent

Services and Ports

# List current rules
sudo firewall-cmd --list-all
sudo firewall-cmd --zone=public --list-all

# Add service
sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --add-service=https --permanent
sudo firewall-cmd --add-service={http,https,ssh} --permanent

# Remove service
sudo firewall-cmd --remove-service=http --permanent

# Add port
sudo firewall-cmd --add-port=8080/tcp --permanent
sudo firewall-cmd --add-port=3000-3100/tcp --permanent

# Remove port
sudo firewall-cmd --remove-port=8080/tcp --permanent

# Always reload after permanent changes
sudo firewall-cmd --reload

# List available services
sudo firewall-cmd --get-services

Rich Rules

# Allow from specific IP
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" accept' --permanent

# Allow port from specific subnet
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="5432" protocol="tcp" accept' --permanent

# Rate limit
sudo firewall-cmd --add-rich-rule='rule family="ipv4" service name="ssh" accept limit value="3/m"' --permanent

# Log and drop
sudo firewall-cmd --add-rich-rule='rule family="ipv4" source address="1.2.3.4" log prefix="BLOCKED: " drop' --permanent

# List rich rules
sudo firewall-cmd --list-rich-rules

Port Forwarding

# Forward port
sudo firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080 --permanent
sudo firewall-cmd --add-forward-port=port=80:proto=tcp:toaddr=10.0.0.5:toport=8080 --permanent

# Enable masquerading (required for forwarding)
sudo firewall-cmd --add-masquerade --permanent

Tips and Tricks

• Always use --permanent then --reload — runtime rules are lost on restart
• Use zones to apply different policies per network interface
• Use firewall-cmd --runtime-to-permanent to save current runtime rules
• Use firewall-cmd --panic-on to block all traffic in emergencies
• On RHEL/Rocky, firewalld is the default — use it instead of raw iptables

Related Resources

• iptables Cheat Sheet
• SELinux Cheat Sheet
• Linux Cheat Sheet