Complete Guide to Allowing Services in firewalld

Master firewalld service management with zones, dynamic rules, and security best practices. Learn commands, troubleshooting, and advanced configuration.

Author:

Published:

Category: System Administration

Reading Time: 14

Complete Guide to Allowing Services in firewalld

Table of Contents

1. [Introduction to firewalld](#introduction-to-firewalld) 2. [Understanding firewalld Services](#understanding-firewalld-services) 3. [Basic Commands and Operations](#basic-commands-and-operations) 4. [Service Management](#service-management) 5. [Zones and Service Configuration](#zones-and-service-configuration) 6. [Practical Examples](#practical-examples) 7. [Advanced Configuration](#advanced-configuration) 8. [Troubleshooting](#troubleshooting) 9. [Best Practices](#best-practices) 10. [Reference Tables](#reference-tables)

Introduction to firewalld

firewalld is a dynamic firewall management tool that provides a flexible and feature-rich interface for managing Linux firewall rules. Unlike traditional iptables configurations, firewalld uses zones and services to organize firewall rules, making it easier to manage complex network security policies.

Key Features

- Dynamic Management: Rules can be changed without restarting the firewall service - Zone-based Configuration: Different security levels for different network interfaces - Service Definitions: Predefined service configurations for common applications - Runtime and Permanent Configuration: Separate handling of temporary and persistent rules - D-Bus Interface: Integration with system management tools - Rich Rules: Advanced rule syntax for complex scenarios

Architecture Overview

firewalld operates with two main configuration layers:

1. Runtime Configuration: Active rules that are immediately applied but lost on restart 2. Permanent Configuration: Persistent rules that survive system reboots

Understanding firewalld Services

Services in firewalld are predefined configurations that specify which ports and protocols should be opened for specific applications or services. Each service definition includes:

- Service name and description - TCP and UDP ports - Destination addresses (if applicable) - Helper modules (for complex protocols)

Service Definition Structure

Services are defined in XML files located in: - System services: /usr/lib/firewalld/services/ - User-defined services: /etc/firewalld/services/

Example service definition structure: `xml Service Name Service description `

Basic Commands and Operations

Installation and Setup

Most modern Linux distributions include firewalld by default. If not installed:

`bash

Red Hat/CentOS/Fedora

sudo dnf install firewalld

Debian/Ubuntu

sudo apt install firewalld

Enable and start firewalld

sudo systemctl enable firewalld sudo systemctl start firewalld `

Essential Commands

#### Checking firewalld Status

`bash

Check if firewalld is running

sudo firewall-cmd --state

Get detailed status information

sudo systemctl status firewalld

Check firewalld version

sudo firewall-cmd --version `

#### Basic Information Commands

`bash

List all available zones

sudo firewall-cmd --get-zones

Get default zone

sudo firewall-cmd --get-default-zone

List active zones

sudo firewall-cmd --get-active-zones

List all available services

sudo firewall-cmd --get-services `

Service Management

Listing Services

#### Current Zone Services

`bash

List services in default zone

sudo firewall-cmd --list-services

List services in specific zone

sudo firewall-cmd --zone=public --list-services

List all configuration for default zone

sudo firewall-cmd --list-all

List all configuration for specific zone

sudo firewall-cmd --zone=public --list-all `

Adding Services

#### Runtime Configuration (Temporary)

`bash

Add service to default zone (temporary)

sudo firewall-cmd --add-service=http

Add service to specific zone (temporary)

sudo firewall-cmd --zone=public --add-service=https

Add multiple services at once

sudo firewall-cmd --add-service=http --add-service=https --add-service=ssh `

#### Permanent Configuration

`bash

Add service permanently to default zone

sudo firewall-cmd --permanent --add-service=http

Add service permanently to specific zone

sudo firewall-cmd --permanent --zone=public --add-service=https

Add multiple services permanently

sudo firewall-cmd --permanent --add-service=http --add-service=https

Reload to apply permanent changes

sudo firewall-cmd --reload `

#### Combined Runtime and Permanent

`bash

Add service both runtime and permanent

sudo firewall-cmd --add-service=http sudo firewall-cmd --permanent --add-service=http

Alternative single command approach

sudo firewall-cmd --permanent --add-service=http sudo firewall-cmd --reload `

Removing Services

#### Runtime Removal

`bash

Remove service from default zone (temporary)

sudo firewall-cmd --remove-service=http

Remove service from specific zone (temporary)

sudo firewall-cmd --zone=public --remove-service=https `

#### Permanent Removal

`bash

Remove service permanently

sudo firewall-cmd --permanent --remove-service=http

Remove from specific zone permanently

sudo firewall-cmd --permanent --zone=public --remove-service=https

Reload to apply changes

sudo firewall-cmd --reload `

Verification Commands

`bash

Check if service is enabled in zone

sudo firewall-cmd --zone=public --query-service=http

List enabled services with details

sudo firewall-cmd --zone=public --list-services --verbose

Show complete zone configuration

sudo firewall-cmd --zone=public --list-all `

Zones and Service Configuration

Understanding Zones

Zones define different trust levels for network connections. Each zone has a predefined set of rules and can be assigned to network interfaces.

#### Default Zones

| Zone Name | Trust Level | Description | Default Services | |-----------|-------------|-------------|------------------| | drop | Lowest | All incoming connections dropped | None | | block | Very Low | Incoming connections rejected | None | | public | Low | Public networks, untrusted | ssh, dhcpv6-client | | external | Low-Medium | External networks with masquerading | ssh | | dmz | Medium | DMZ networks, limited access | ssh | | work | Medium-High | Work networks, trusted | ssh, dhcpv6-client | | home | High | Home networks, mostly trusted | ssh, mdns, dhcpv6-client | | internal | High | Internal networks, trusted | ssh, mdns, dhcpv6-client | | trusted | Highest | All connections accepted | All |

Zone Management

#### Setting Default Zone

`bash

Set default zone

sudo firewall-cmd --set-default-zone=public

Verify default zone

sudo firewall-cmd --get-default-zone `

#### Interface Assignment

`bash

Assign interface to zone (runtime)

sudo firewall-cmd --zone=public --change-interface=eth0

Assign interface to zone (permanent)

sudo firewall-cmd --permanent --zone=public --change-interface=eth0

List interfaces in zone

sudo firewall-cmd --zone=public --list-interfaces `

Service Configuration in Different Zones

#### Web Server Configuration Example

`bash

Configure web server in public zone

sudo firewall-cmd --zone=public --permanent --add-service=http sudo firewall-cmd --zone=public --permanent --add-service=https

Configure SSH access in internal zone only

sudo firewall-cmd --zone=internal --permanent --add-service=ssh sudo firewall-cmd --zone=public --permanent --remove-service=ssh

Apply changes

sudo firewall-cmd --reload `

#### Database Server Configuration Example

`bash

Allow database access only from internal zone

sudo firewall-cmd --zone=internal --permanent --add-service=mysql sudo firewall-cmd --zone=internal --permanent --add-service=postgresql

Verify configuration

sudo firewall-cmd --zone=internal --list-services `

Practical Examples

Example 1: Web Server Setup

Setting up a web server with HTTP and HTTPS access:

`bash

Step 1: Check current configuration

sudo firewall-cmd --list-all

Step 2: Add HTTP service (temporary for testing)

sudo firewall-cmd --add-service=http echo "HTTP service added temporarily"

Step 3: Test web server accessibility

(Test your web server here)

Step 4: Make changes permanent if working correctly

sudo firewall-cmd --permanent --add-service=http sudo firewall-cmd --permanent --add-service=https

Step 5: Reload to apply permanent configuration

sudo firewall-cmd --reload

Step 6: Verify final configuration

sudo firewall-cmd --list-services `

Example 2: Mail Server Configuration

Setting up a complete mail server:

`bash

Add mail services permanently

sudo firewall-cmd --permanent --add-service=smtp sudo firewall-cmd --permanent --add-service=smtps sudo firewall-cmd --permanent --add-service=submission sudo firewall-cmd --permanent --add-service=imap sudo firewall-cmd --permanent --add-service=imaps sudo firewall-cmd --permanent --add-service=pop3 sudo firewall-cmd --permanent --add-service=pop3s

Reload configuration

sudo firewall-cmd --reload

Verify mail services

sudo firewall-cmd --list-services | grep -E "(smtp|imap|pop3)" `

Example 3: Database Server with Restricted Access

Setting up database access only from internal networks:

`bash

Remove database service from public zone if present

sudo firewall-cmd --permanent --zone=public --remove-service=mysql

Add database service to internal zone only

sudo firewall-cmd --permanent --zone=internal --add-service=mysql

Add specific source networks to internal zone

sudo firewall-cmd --permanent --zone=internal --add-source=192.168.1.0/24 sudo firewall-cmd --permanent --zone=internal --add-source=10.0.0.0/8

Reload configuration

sudo firewall-cmd --reload

Verify configuration

sudo firewall-cmd --zone=internal --list-all `

Example 4: FTP Server Configuration

Setting up FTP server with both standard and secure FTP:

`bash

Add FTP services

sudo firewall-cmd --permanent --add-service=ftp sudo firewall-cmd --permanent --add-service=tftp

For passive FTP, you might need additional ports

This is typically handled by the ftp service definition

but can be customized if needed

Reload and verify

sudo firewall-cmd --reload sudo firewall-cmd --list-services `

Advanced Configuration

Creating Custom Services

#### Custom Service Definition

Create a custom service file at /etc/firewalld/services/myapp.xml:

`xml MyApp My Custom Application `

#### Using Custom Services

`bash

Reload firewalld to recognize new service

sudo firewall-cmd --reload

Add custom service

sudo firewall-cmd --permanent --add-service=myapp

Verify custom service is available

sudo firewall-cmd --get-services | grep myapp `

Rich Rules for Advanced Service Control

Rich rules provide more granular control over service access:

`bash

Allow HTTP only from specific subnet

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" service name="http" accept'

Allow SSH with rate limiting

sudo firewall-cmd --permanent --add-rich-rule='rule service name="ssh" accept limit value="3/m"'

Allow HTTPS with logging

sudo firewall-cmd --permanent --add-rich-rule='rule service name="https" log prefix="HTTPS Access" level="info" accept'

Reload to apply rich rules

sudo firewall-cmd --reload `

Port Forwarding with Services

`bash

Forward external port to internal service

sudo firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=192.168.1.100

Enable masquerading for forwarding to work

sudo firewall-cmd --permanent --add-masquerade

Reload configuration

sudo firewall-cmd --reload `

Time-based Service Access

Using rich rules for time-based access:

`bash

Allow web access only during business hours (requires additional scripting)

This is a conceptual example - actual implementation requires cron jobs or systemd timers

Create scripts to enable/disable services at specific times

echo '#!/bin/bash firewall-cmd --add-service=http firewall-cmd --add-service=https' > /usr/local/bin/enable-web.sh

echo '#!/bin/bash firewall-cmd --remove-service=http firewall-cmd --remove-service=https' > /usr/local/bin/disable-web.sh

chmod +x /usr/local/bin/enable-web.sh /usr/local/bin/disable-web.sh `

Troubleshooting

Common Issues and Solutions

#### Service Not Working After Adding

Problem: Service added to firewalld but still not accessible

Diagnosis Steps: `bash

Check if service is actually enabled

sudo firewall-cmd --list-services

Check if service is in correct zone

sudo firewall-cmd --get-active-zones sudo firewall-cmd --zone=public --list-services

Verify service definition

sudo firewall-cmd --info-service=http

Check if permanent rules are loaded

sudo firewall-cmd --permanent --list-services `

Solutions: `bash

Reload firewalld

sudo firewall-cmd --reload

Make sure service is added to correct zone

sudo firewall-cmd --zone=public --add-service=http

Restart firewalld if needed

sudo systemctl restart firewalld `

#### Permanent Changes Not Applied

Problem: Permanent changes not taking effect

Diagnosis: `bash

Compare runtime vs permanent configuration

sudo firewall-cmd --list-services sudo firewall-cmd --permanent --list-services `

Solution: `bash

Reload to apply permanent changes

sudo firewall-cmd --reload

Or restart firewalld service

sudo systemctl restart firewalld `

#### Service Conflicts

Problem: Custom service conflicts with existing services

Diagnosis: `bash

Check all services using specific port

sudo firewall-cmd --get-services | xargs -I {} firewall-cmd --info-service={} | grep -B5 "port.*80"

List all active ports

sudo firewall-cmd --list-ports `

Debugging Commands

#### Verbose Output

`bash

Enable verbose logging

sudo firewall-cmd --set-log-denied=all

Check logs

sudo journalctl -u firewalld -f

View detailed zone information

sudo firewall-cmd --list-all-zones `

#### Testing Connectivity

`bash

Test from client machine

telnet server_ip service_port

Check if port is listening on server

sudo ss -tlnp | grep :80 sudo netstat -tlnp | grep :80

Use nmap to scan ports

nmap -p 80,443 server_ip `

Best Practices

Security Best Practices

#### Principle of Least Privilege

`bash

Only enable services that are actually needed

Review enabled services regularly

sudo firewall-cmd --list-services

Remove unused services

sudo firewall-cmd --permanent --remove-service=unused_service `

#### Zone-based Security

`bash

Use appropriate zones for different network segments

Public zone for internet-facing services

sudo firewall-cmd --zone=public --add-service=http

Internal zone for administrative access

sudo firewall-cmd --zone=internal --add-service=ssh

Assign interfaces to appropriate zones

sudo firewall-cmd --permanent --zone=internal --change-interface=eth1 `

#### Regular Auditing

`bash

Create audit script

cat > /usr/local/bin/firewall-audit.sh << 'EOF' #!/bin/bash echo "=== Firewall Audit Report ===" echo "Date: $(date)" echo "Default Zone: $(firewall-cmd --get-default-zone)" echo "Active Zones:" firewall-cmd --get-active-zones echo "Services by Zone:" for zone in $(firewall-cmd --get-zones); do echo "Zone: $zone" firewall-cmd --zone=$zone --list-services echo "---" done EOF

chmod +x /usr/local/bin/firewall-audit.sh `

Operational Best Practices

#### Change Management

`bash

Always test changes in runtime before making permanent

sudo firewall-cmd --add-service=new_service

Test functionality

sudo firewall-cmd --permanent --add-service=new_service sudo firewall-cmd --reload `

#### Backup and Recovery

`bash

Backup firewalld configuration

sudo cp -r /etc/firewalld /etc/firewalld.backup.$(date +%Y%m%d)

Export zone configuration

sudo firewall-cmd --permanent --zone=public --list-all > public-zone-backup.txt

Create restoration script

cat > restore-firewall.sh << 'EOF' #!/bin/bash

Restore firewalld configuration

sudo systemctl stop firewalld sudo cp -r /etc/firewalld.backup.YYYYMMDD/* /etc/firewalld/ sudo systemctl start firewalld EOF `

#### Documentation

Maintain documentation of firewall changes:

`bash

Create change log template

cat > firewall-changes.log << 'EOF' Date: $(date) Change: Added HTTP service to public zone Command: firewall-cmd --permanent --zone=public --add-service=http Reason: New web server deployment Tested: Yes Approved by: Administrator EOF `

Reference Tables

Common Services and Ports

| Service Name | Protocol | Port(s) | Description | |--------------|----------|---------|-------------| | http | TCP | 80 | HTTP Web Server | | https | TCP | 443 | HTTPS Web Server | | ssh | TCP | 22 | Secure Shell | | ftp | TCP | 21 | File Transfer Protocol | | smtp | TCP | 25 | Simple Mail Transfer Protocol | | smtps | TCP | 465 | SMTP over SSL | | submission | TCP | 587 | Mail Submission | | imap | TCP | 143 | Internet Message Access Protocol | | imaps | TCP | 993 | IMAP over SSL | | pop3 | TCP | 110 | Post Office Protocol v3 | | pop3s | TCP | 995 | POP3 over SSL | | mysql | TCP | 3306 | MySQL Database | | postgresql | TCP | 5432 | PostgreSQL Database | | dns | TCP/UDP | 53 | Domain Name System | | ntp | UDP | 123 | Network Time Protocol | | snmp | UDP | 161 | Simple Network Management Protocol | | ldap | TCP | 389 | Lightweight Directory Access Protocol | | ldaps | TCP | 636 | LDAP over SSL | | samba | TCP/UDP | 137-139, 445 | Samba File Sharing | | nfs | TCP/UDP | 2049 | Network File System |

firewall-cmd Command Reference

| Command Category | Command | Description | |------------------|---------|-------------| | Status | --state | Check firewalld state | | | --get-default-zone | Get default zone | | | --get-active-zones | List active zones | | | --get-zones | List all zones | | Services | --get-services | List all available services | | | --list-services | List enabled services | | | --add-service=SERVICE | Add service | | | --remove-service=SERVICE | Remove service | | | --query-service=SERVICE | Check if service is enabled | | Information | --list-all | Show complete zone configuration | | | --info-service=SERVICE | Show service details | | | --list-all-zones | Show all zones configuration | | Configuration | --reload | Reload permanent configuration | | | --complete-reload | Complete reload (breaks connections) | | | --permanent | Make changes permanent | | Zones | --zone=ZONE | Specify zone for command | | | --set-default-zone=ZONE | Set default zone | | | --change-interface=INTERFACE | Assign interface to zone |

Zone Trust Levels and Use Cases

| Zone | Trust Level | Network Type | Typical Use Cases | |------|-------------|--------------|-------------------| | trusted | Maximum | Fully trusted | Internal management networks | | internal | High | Internal networks | Corporate LANs, private networks | | home | High | Home networks | Home LANs, trusted devices | | work | Medium-High | Work networks | Office networks, business LANs | | dmz | Medium | DMZ networks | Public-facing servers, isolated services | | external | Low-Medium | External networks | VPN connections, external access | | public | Low | Public networks | Internet connections, WiFi hotspots | | block | Very Low | Untrusted | Blocked networks, rejected connections | | drop | Minimum | Hostile | Completely untrusted, dropped packets |

Service Definition XML Elements

| Element | Description | Example | |---------|-------------|---------| | | Short service name | HTTP | | | Service description | HTTP Server | | | Port specification | | | | Protocol specification | | | | Source port | | | | Netfilter helper module | | | | Destination address | |

This comprehensive guide provides detailed information about managing services in firewalld, from basic operations to advanced configurations. The examples and reference tables serve as practical resources for implementing and maintaining firewall security policies effectively.

Tags

  • firewall-management
  • firewalld
  • linux security
  • network-configuration
  • system-administration

Related Articles

Popular Technical Articles & Tutorials

Explore our comprehensive collection of technical articles, programming tutorials, and IT guides written by industry experts:

Browse all 8+ technical articles | Read our IT blog

Complete Guide to Allowing Services in firewalld