---
title: "Open or close a port with firewalld"
description: "Open or close incoming and outgoing ports on a Linux node with firewalld, open a port to one address, and block an address."
content_type: "how-to"
product: "node"
platform: "MyAccount"
url: "/myaccount/node/how-to/open-or-close-a-port-with-firewalld/"
topic: ["access-and-security"]
---

# Open or close a port with firewalld

<!-- cspell:ignore firewalld dport mariadb -->

Open or close ports in firewalld on a Linux node. The rules cover incoming and outgoing traffic, for
everyone or for one address.

firewalld is a Linux firewall that you control with the `firewall-cmd` command. The commands
work on any Linux node that runs firewalld, such as CentOS, Rocky Linux, or Ubuntu 18
and later with firewalld installed.

A port has to be open in both firewalld and the node's security group before traffic gets
through. E2E suggests using security groups on their own, since rules in firewalld can conflict
with them. While you sort out a conflict, the node's **Security Group** tab offers **Allow All
Traffic**. **Allow All Traffic** attaches a security group that opens every port. Detach it as soon
as you have found the conflict. See [Security Group](/myaccount/security-group/).

Firewall is a different product: an appliance your traffic passes through, not rules inside one
node. See [Firewall](/myaccount/firewall/).

## Before you begin

You need:

- A Linux node with firewalld installed and running, such as CentOS, Rocky Linux, or Ubuntu 18 or
  later.
- A user with sudo access, signed in to the node over SSH. See
  [Connect to a Linux node](/myaccount/node/how-to/connect-to-a-linux-node/).

Every command in these steps that changes a rule uses `--permanent`, which saves the rule. A saved
rule takes effect once you reload firewalld:

```bash
sudo firewall-cmd --reload
```

If a rule cuts off your SSH session, you can still sign in from the node's console. See
[Open a node's console](/myaccount/node/how-to/open-the-node-console/).

## Open an incoming port

To open a port, such as port 80 for HTTP, run:

```bash
sudo firewall-cmd --add-port=80/tcp --permanent
```

To open another port, change the number. For a UDP port, write `udp` instead of `tcp`. The
general form is:

```bash
sudo firewall-cmd --add-port=<port>/tcp --permanent
```

For example, to open UDP port 514:

```bash
sudo firewall-cmd --add-port=514/udp --permanent
```

Reload firewalld for the change to take effect:

```bash
sudo firewall-cmd --reload
```

## Open a port to one address only

A zone is a named set of rules that firewalld applies to the addresses in it. To let only one
address reach a port, put that address in a zone of its own and open the port in that zone. This
example lets one address reach MariaDB on port 3306. It creates a zone named `mariadb-access`, adds
the address to it, opens port 3306 in it, and reloads firewalld. Put the address you allow in place
of `<ip-address>`, such as `203.0.113.10`:

```bash
sudo firewall-cmd --new-zone=mariadb-access --permanent

sudo firewall-cmd --zone=mariadb-access --add-source=<ip-address> --permanent

sudo firewall-cmd --zone=mariadb-access --add-port=3306/tcp --permanent

sudo firewall-cmd --reload
```

## Allow an outgoing port

To allow all outgoing connections to a port, such as port 25, run this, with your port number in
place of `25`:

```bash
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p tcp -m tcp --dport=25 -j ACCEPT
```

Reload firewalld for the change to take effect:

```bash
sudo firewall-cmd --reload
```

## Close an incoming port

To close a port you opened, remove it from the list of open ports. Put the port number in place
of `<port>`. To close a UDP port, write `udp` in place of `tcp`:

```bash
sudo firewall-cmd --remove-port=<port>/tcp --permanent
```

For example, to stop all incoming traffic to port 80:

```bash
sudo firewall-cmd --remove-port=80/tcp --permanent
```

Reload firewalld to apply the change:

```bash
sudo firewall-cmd --reload
```

### Close a port in one zone

firewalld keeps open ports per zone. To close a port in a named zone, first list the active
zones:

```bash
sudo firewall-cmd --get-active-zones
```

Then remove the port from that zone, such as `public`, with the port number in place of
`<port>`:

```bash
sudo firewall-cmd --zone=public --remove-port=<port>/tcp --permanent
```

Reload firewalld to apply the change:

```bash
sudo firewall-cmd --reload
```

## Block an outgoing port

To block all outgoing connections to a port, such as port 25, run these, with your port number in
place of `25`:

```bash
sudo firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -p tcp -m tcp --dport=25 -j REJECT

sudo firewall-cmd --reload
```

## Block an address

To refuse all traffic from one address, run this, with that address in place of `<ip-address>`,
such as `203.0.113.10`:

```bash
sudo firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='<ip-address>' reject"
```

Reload firewalld for the change to take effect:

```bash
sudo firewall-cmd --reload
```

## Check the rules

To see the rules firewalld uses now, run:

```bash
sudo firewall-cmd --list-all
```

A port you opened shows in the list of ports, and a port you closed is gone from it. Run the
command after every reload to confirm the change.

To see the outgoing port rules you added, run:

```bash
sudo firewall-cmd --direct --get-all-rules
```

The node now accepts and sends only the traffic you chose. Traffic reaches those ports once the
node's security group allows them as well; see [Security Group](/myaccount/security-group/) and,
for help with a port that does not answer,
[Troubleshooting node networking and connectivity](/myaccount/node/troubleshooting/networking-and-connectivity/).