Control network traffic by using firewalld

The firewalld package installs a large number of predefined service files and you can add more or customize them. You can then use these service definitions to open or close ports for services without knowing the protocol and port numbers they use.

Control traffic with predefined services using the CLI
Copy link

The most straightforward method to control traffic is to add a predefined service to firewalld. This opens all necessary ports and modifies other settings according to the service definition file.

Before you begin
Copy link

  • The firewalld service is running.

Procedure
Copy link

  1. Check that the service in firewalld is not already allowed: 
    # firewall-cmd --list-services
     
    ssh dhcpv6-client

    The command lists the services that are enabled in the default zone.

  2. List all predefined services in firewalld: 
    # firewall-cmd --get-services
     
    RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry ...

    The command displays a list of available services for the default zone.

  3. Add the service to the list of services that firewalld allows: 
    # firewall-cmd --add-service=<service_name>

    The command adds the specified service to the default zone.

  4. Make the new settings persistent: 
    # firewall-cmd --runtime-to-permanent

    The command applies these runtime changes to the permanent configuration of the firewall. By default, it applies these changes to the configuration of the default zone.

Results
Copy link

  • List all permanent firewall rules: 
    # firewall-cmd --list-all --permanent
     
    public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: cockpit dhcpv6-client ssh
  ports:
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

    The command displays complete configuration with the permanent firewall rules of the default firewall zone (public).

Enable services on the firewall by using the web console
Copy link

By default, services are added to the default firewall zone. If you use more firewall zones on multiple network interfaces, you must select a zone first and then add the service with its corresponding port.

Before you begin
Copy link

About this task
Copy link

The RHEL 10 web console displays predefined firewalld services, and you can add them to active firewall zones.

Important

The RHEL 10 web console configures the firewalld service.

The web console does not allow generic firewalld rules that are not listed in the web console.

Procedure
Copy link

  1. Log in to the RHEL 10 web console.
  2. Click Networking.
  3. Click the Edit rules and zones button.
  4. In the Firewall section, select a zone for which you want to add the service and click Add Services.
  5. In the Add Services dialog box, find the service you want to enable in the firewall.
  6. Enable services according to your scenario:
  7. Click Add Services.

Configure custom ports by using the web console
Copy link

You can add custom ports for services through the RHEL web console.

Before you begin
Copy link

Procedure
Copy link

  1. Log in to the RHEL 10 web console.
  2. Click Networking.
  3. Click the Edit rules and zones button.

    If you do not see the Edit rules and zones button, log in to the web console with the administrative privileges.

  4. In the Firewall section, select a zone for which you want to configure a custom port and click Add Services.
  5. In the Add services dialog box, click the Custom Ports radio button.
  6. In the TCP and UDP fields, add ports according to examples. You can add ports in the following formats:
    • Port numbers such as 22
    • Range of port numbers such as 5900-5910
    • Aliases such as nfs, rsync
    Note
    You can add multiple values into each field. You must separate values with a comma and without a space, for example: 8080,8081,http
  7. After adding the port number in the TCP field, the UDP field, or both, verify the service name in the Name field.

    The Name field displays the name of the service for which this port is reserved. You can rewrite the name if you are sure that this port is free to use and no server requires it to communicate on this port.

  8. In the Name field, add a name for the service including defined ports.
  9. Click Add Ports button.