Command linux firewalld-cmd: A Comprehensive Guide to Managing Linux Firewalls

When it comes to securing your Linux system, setting up an effective firewall is one of the most critical tasks you can perform. Whether you’re managing a personal machine or a server, a well-configured firewall can protect your system from unwanted network traffic and potential security threats. One powerful tool for managing firewalls on Linux is the firewalld utility, and more specifically, the firewalld-cmd command.

What is the Command linux firewalld-cmd?

The firewalld-cmd command is a part of the firewalld package in Linux, which provides a front-end interface for managing firewall rules. firewalld is an alternative to the traditional iptables system and offers an easier and more dynamic way to configure the firewall on modern Linux systems. It uses zones and services to define rules, making it more user-friendly compared to iptables.

The firewalld-cmd command allows administrators to interact with the firewall, allowing them to set up rules, open or close ports, manage services, and even configure rich language rules to fine-tune the firewall. It can be used to both view the current firewall settings and modify them dynamically without requiring a reboot.

How Does firewalld Work?

Before diving deeper into the firewalld-cmd command, it’s important to understand a bit about how firewalld operates. It uses the concept of zones to define different levels of trust for network connections. Each zone represents a set of rules that apply to a certain type of network interface or connection. By assigning network interfaces or connections to zones, you can easily control the level of security for different types of networks, such as home, public, or work networks.

Some of the default zones in firewalld include:

• public – A zone for untrusted networks.
• trusted – A zone for highly trusted networks.
• home – A zone for home networks.
• internal – A zone for internal networks.
• dmz – A zone for demilitarized zones (used for isolating servers).

Each zone has its own set of firewall rules, which you can modify using the firewalld-cmd command.

Basic Syntax of Command linux firewalld-cmd

The syntax for using the firewalld-cmd command is simple and can be broken down into the following format:

firewalld-cmd [options] [command]

Some of the most commonly used options and commands with firewalld-cmd include:

• --zone – Specifies the zone to apply a command to.
• --add-port – Opens a specific port on the firewall.
• --remove-port – Closes a specific port on the firewall.
• --add-service – Opens a specific service (such as HTTP or SSH).
• --remove-service – Closes a specific service.
• --permanent – Makes changes permanent (applies after reboot).

Common firewalld-cmd Commands and Examples

Now that we understand the basics of the firewalld-cmd command, let’s look at some practical examples of how you can use it to manage your firewall settings.

1. Checking the Current Firewall Status

Before making any changes, it’s important to know the current status of your firewall. You can check the status with the following command:

firewalld-cmd --state

This command will tell you whether the firewalld service is running (either running or not running). It’s essential to ensure that the firewall is active before making changes to it.

2. Listing All Active Zones

To see all the zones that are currently active on your system, you can use the following command:

firewalld-cmd --get-active-zones

This will list all active zones and the network interfaces assigned to them. You can then modify the settings for each zone as needed.

3. Adding a Port to a Zone

If you need to allow traffic on a specific port (e.g., for web services), you can use the --add-port option. For example, to allow traffic on port 8080 (commonly used for web applications), use the following command:

firewalld-cmd --zone=public --add-port=8080/tcp

This opens port 8080 for TCP traffic in the public zone. If you want to make this change permanent, add the --permanent flag:

firewalld-cmd --zone=public --add-port=8080/tcp --permanent

4. Removing a Port from a Zone

To close a port, simply use the --remove-port option. For example, to close port 8080 in the public zone, use the following command:

firewalld-cmd --zone=public --remove-port=8080/tcp --permanent

This command will stop all traffic on port 8080 in the public zone permanently.

5. Adding a Service to a Zone

Services like HTTP (port 80) or SSH (port 22) are predefined in firewalld. To allow a service, such as HTTP, to be accessible, you can use the --add-service command:

firewalld-cmd --zone=public --add-service=http

This command opens the HTTP service in the public zone, allowing traffic to flow freely on port 80. To make this change permanent, again use the --permanent option:

firewalld-cmd --zone=public --add-service=http --permanent

6. Removing a Service from a Zone

If you want to remove a service (like SSH), you can do so with the --remove-service command:

firewalld-cmd --zone=public --remove-service=ssh --permanent

This will prevent SSH traffic from being allowed in the public zone. It’s a good way to block unwanted services when not needed.

7. Reloading the Firewall

Whenever you make changes to the firewall, it’s a good idea to reload the settings to apply the changes. You can reload the firewall using the following command:

firewalld-cmd --reload

This command applies all pending changes, whether they are permanent or not.

8. Setting Default Zone

To set a default zone for your system, which is used if no other zone is explicitly specified, use the following command:

firewalld-cmd --set-default-zone=home

This sets the default zone to home, so any network interface or connection not explicitly assigned to a different zone will automatically use the home zone.

Conclusion

The firewalld-cmd command is an essential tool for managing your Linux firewall. It offers an intuitive and dynamic way to control network traffic, allowing you to make real-time adjustments to your system’s security settings. By using zones, services, and ports, you can create a tailored firewall configuration that matches your needs.

With the examples provided in this article, you should now be well-equipped to start using the firewalld-cmd command effectively. Whether you're opening ports for services, managing firewall zones, or tweaking your system’s security, firewalld-cmd is an indispensable tool for every Linux administrator!