Firewalld Cheatsheet & Quick Reference

firewalld.md

firewalld

---

Check/Reload

# Check Firewalld
sudo firewall-cmd --state

# Reload configuration without dropping active connections
sudo firewall-cmd --reload

# Complete reload (drops state information; active connections will break)
sudo firewall-cmd --complete-reload

Managing Zones

# List all available zones
sudo firewall-cmd --get-zones

# Get the default zone
sudo firewall-cmd --get-default-zone

# Set the default zone (e.g., to 'drop')
sudo firewall-cmd --set-default-zone=drop

# View active zones (zones that have an interface or source assigned)
sudo firewall-cmd --get-active-zones

# View complete configuration of all active zones
sudo firewall-cmd --list-all-zones

# View configuration of a specific zone
sudo firewall-cmd --zone=public --list-all

Assigning Interfaces & Sources to Zones

# Assign an interface to a zone (temporary)
sudo firewall-cmd --zone=public --add-interface=eth0

# Change an interface's zone permanently
sudo firewall-cmd --permanent --zone=internal --change-interface=eth0

# Remove an interface from a zone
sudo firewall-cmd --permanent --zone=public --remove-interface=eth0

# Assign an IP/Subnet source to a zone
sudo firewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24

# Remove an IP source from a zone
sudo firewall-cmd --permanent --zone=trusted --remove-source=192.168.1.0/24

Managing Ports & Services

Note: Always add the --permanent flag if you want rules to survive a reboot/reload. To apply permanent rules immediately, run sudo firewall-cmd --reload afterward.

# Get a list of all predefined services
sudo firewall-cmd --get-services

# Allow a service (temporary)
sudo firewall-cmd --zone=public --add-service=http

# Allow a service permanently
sudo firewall-cmd --permanent --zone=public --add-service=https

# Remove an allowed service
sudo firewall-cmd --permanent --zone=public --remove-service=https

# List services allowed in the current default zone
sudo firewall-cmd --list-services

Opening & Closing Raw Ports

# Open a specific port (TCP/UDP)
sudo firewall-cmd --permanent --zone=public --add-port=8080/tcp

# Open a range of ports
sudo firewall-cmd --permanent --zone=public --add-port=5000-5010/udp

# Remove/Close an open port
sudo firewall-cmd --permanent --zone=public --remove-port=8080/tcp

# List allowed ports
sudo firewall-cmd --list-ports

Port Forwarding & NAT (Masquerading)

Enable Masquerading

# Check if masquerading is enabled
sudo firewall-cmd --zone=public --query-masquerade

# Enable masquerading (Required for NAT/Forwarding)
sudo firewall-cmd --permanent --zone=public --add-masquerade

Set Up Forwarding Rules

# Local Port Forwarding: Forward local port 80 to local port 8080
sudo firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toport=8080

# Forward port 80 to a different IP address on port 8080
sudo firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=192.168.1.50

# Remove a port forwarding rule
sudo firewall-cmd --permanent --zone=public --remove-forward-port=port=80:proto=tcp:toport=8080

Rich Rules (Granular & Advanced Matching)

# Allow SSH access ONLY from a specific IP range
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" service name="ssh" accept'

# Reject traffic from a malicious IP with logging
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.100" log prefix="BLOCKED IP: " level="warning" drop'

# Block port 22 (SSH) for a specific IP while leaving it open for others
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="10.0.0.50" port port="22" protocol="tcp" reject'

# List all active rich rules in a zone
sudo firewall-cmd --zone=public --list-rich-rules

# Remove a rich rule
sudo firewall-cmd --permanent --zone=public --remove-rich-rule='rule family="ipv4" source address="10.0.0.50" port port="22" protocol="tcp" reject'

Emergency & Panic Commands

Useful during suspected security incidents or lockouts.

# Enable Panic Mode (Blocks ALL incoming and outgoing network traffic instantly)
sudo firewall-cmd --panic-on

# Disable Panic Mode
sudo firewall-cmd --panic-off

# Query Panic Mode status
sudo firewall-cmd --query-panic

Managing Large IP Blocklists

# Create an IP set
sudo firewall-cmd --permanent --new-ipset=blocklist --type=hash:ip

# Add IPs to the set
sudo firewall-cmd --permanent --ipset=blocklist --add-entry=192.168.1.200
sudo firewall-cmd --permanent --ipset=blocklist --add-entry=10.0.0.15

# Drop all traffic originating from any IP in the set using a rich rule
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source ipset="blocklist" drop'

# Reload to apply changes
sudo firewall-cmd --reload