Biblioteca de cunoștințe

firewalld is the default firewall management tool on AlmaLinux and Rocky Linux, using a zone-based model that differs conceptually from UFW's simpler allow/deny approach used on Ubuntu/Debian.

Understanding Zones

firewalld organizes rules into zones, each representing a level of trust for network connections. The default zone for most VPS deployments is typically public.

Checking firewalld Status

sudo firewall-cmd --state

Enabling firewalld

sudo systemctl enable --now firewalld

Checking the Active Zone

sudo firewall-cmd --get-active-zones

Viewing All Rules in the Default Zone

sudo firewall-cmd --list-all

Allowing a Service by Name

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

--permanent makes the rule persist across reboots; without it, changes only apply to the current session.

Applying Permanent Changes

sudo firewall-cmd --reload

Permanent rules require a reload to take effect immediately — without reloading, they'll only apply after the next reboot.

Allowing a Specific Port

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

Removing a Rule

sudo firewall-cmd --permanent --remove-service=http
sudo firewall-cmd --reload

Listing Available Predefined Services

firewall-cmd --get-services

Restricting a Port to a Specific Source IP

sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="203.0.113.10" port protocol="tcp" port="22" accept'
sudo firewall-cmd --reload

Blocking a Specific IP

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.50" reject'
sudo firewall-cmd --reload

Enabling Rate Limiting

sudo firewall-cmd --permanent --add-rich-rule='rule service name="ssh" limit value="3/m" accept'
sudo firewall-cmd --reload

Checking If a Specific Port Is Open

sudo firewall-cmd --query-port=8080/tcp

Working with a Custom SSH Port

If you changed the default SSH port, you can't simply use --add-service=ssh (which assumes port 22); instead add the specific port directly:

sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

Quick Reference: UFW vs firewalld

Common Errors

Rule added but not working — forgot --reload after a --permanent change; run it now.

Locked out after a firewall change — use your provider's console access to fix via firewall-cmd, same recovery pattern as any other firewall lockout scenario.

Best Practices

• Always use --permanent for lasting rules, and remember to --reload
• Prefer named services (--add-service) over raw ports where a predefined service matches your need, for clarity
• Test firewall changes in a way that lets you recover if something goes wrong

Continue Reading

• How to Get Started with AlmaLinux/Rocky Linux on a VPS
• How to Harden SSH and Security on AlmaLinux/Rocky Linux
• Understanding SELinux Basics on AlmaLinux/Rocky Linux

Browse more articles in AlmaLinux & Rocky Linux.