Open or close a port with firewalld

Open or close ports in firewalld on a Linux node. The rules cover incoming and outgoing traffic, for everyone or for one address.

firewalld is a Linux firewall that you control with the firewall-cmd command. The commands work on any Linux node that runs firewalld, such as CentOS, Rocky Linux, or Ubuntu 18 and later with firewalld installed.

A port has to be open in both firewalld and the node’s security group before traffic gets through. E2E suggests using security groups on their own, since rules in firewalld can conflict with them. While you sort out a conflict, the node’s Security Group tab offers Allow All Traffic. Allow All Traffic attaches a security group that opens every port. Detach it as soon as you have found the conflict. See Security Group.

Firewall is a different product: an appliance your traffic passes through, not rules inside one node. See Firewall.

Before you begin

You need:

• A Linux node with firewalld installed and running, such as CentOS, Rocky Linux, or Ubuntu 18 or later.
• A user with sudo access, signed in to the node over SSH. See Connect to a Linux node.

Every command in these steps that changes a rule uses --permanent, which saves the rule. A saved rule takes effect once you reload firewalld:

sudo firewall-cmd --reload

If a rule cuts off your SSH session, you can still sign in from the node’s console. See Open a node’s console.

Open an incoming port

To open a port, such as port 80 for HTTP, run:

sudo firewall-cmd --add-port=80/tcp --permanent

To open another port, change the number. For a UDP port, write udp instead of tcp. The general form is:

sudo firewall-cmd --add-port=<port>/tcp --permanent

For example, to open UDP port 514:

sudo firewall-cmd --add-port=514/udp --permanent

Reload firewalld for the change to take effect:

sudo firewall-cmd --reload

Open a port to one address only

A zone is a named set of rules that firewalld applies to the addresses in it. To let only one address reach a port, put that address in a zone of its own and open the port in that zone. This example lets one address reach MariaDB on port 3306. It creates a zone named mariadb-access, adds the address to it, opens port 3306 in it, and reloads firewalld. Put the address you allow in place of <ip-address>, such as 203.0.113.10:

sudo firewall-cmd --new-zone=mariadb-access --permanent

sudo firewall-cmd --zone=mariadb-access --add-source=<ip-address> --permanent

sudo firewall-cmd --zone=mariadb-access --add-port=3306/tcp --permanent

sudo firewall-cmd --reload

Allow an outgoing port

To allow all outgoing connections to a port, such as port 25, run this, with your port number in place of 25:

sudo firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p tcp -m tcp --dport=25 -j ACCEPT

Reload firewalld for the change to take effect:

sudo firewall-cmd --reload

Close an incoming port

To close a port you opened, remove it from the list of open ports. Put the port number in place of <port>. To close a UDP port, write udp in place of tcp:

sudo firewall-cmd --remove-port=<port>/tcp --permanent

For example, to stop all incoming traffic to port 80:

sudo firewall-cmd --remove-port=80/tcp --permanent

Reload firewalld to apply the change:

sudo firewall-cmd --reload

Close a port in one zone

firewalld keeps open ports per zone. To close a port in a named zone, first list the active zones:

sudo firewall-cmd --get-active-zones

Then remove the port from that zone, such as public, with the port number in place of <port>:

sudo firewall-cmd --zone=public --remove-port=<port>/tcp --permanent

Reload firewalld to apply the change:

sudo firewall-cmd --reload

Block an outgoing port

To block all outgoing connections to a port, such as port 25, run these, with your port number in place of 25:

sudo firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -p tcp -m tcp --dport=25 -j REJECT

sudo firewall-cmd --reload

Block an address

To refuse all traffic from one address, run this, with that address in place of <ip-address>, such as 203.0.113.10:

sudo firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='<ip-address>' reject"

Reload firewalld for the change to take effect:

sudo firewall-cmd --reload

Check the rules

To see the rules firewalld uses now, run:

sudo firewall-cmd --list-all

A port you opened shows in the list of ports, and a port you closed is gone from it. Run the command after every reload to confirm the change.

To see the outgoing port rules you added, run:

sudo firewall-cmd --direct --get-all-rules

The node now accepts and sends only the traffic you chose. Traffic reaches those ports once the node’s security group allows them as well; see Security Group and, for help with a port that does not answer, Troubleshooting node networking and connectivity.