firewalld

firewalld at its core is essentially a wrapper for iptables, but it does include some extra features and improved functionality.

• With iptables, when you reload a rule, connections can drop. This is a big problem on production servers. Firewalld uses in-place rule updates to prevent this.
• iptables doesn't natively support saving and persisting rules past reboot - firewalld has this functionality build-in.

Commands & Syntax

Firewalld is controlled using the firewall-cmd command.

firewall-cmd [options]

List available firewalld zones:

firewall-cmd --get-zones

View details about a specific zone:

firewall-cmd --zone=zone_name --list-all

Add an interface to a specified zone:

firewall-cmd --zone=zonename -change-interface=device_ID

Add a service to a zone:

firewall-cmd --zone=zone_name --add-service=http

Add a port to a zone:

firewall-cmd --zone=zone_name --add-port=21/tcp

Remove a port from a zone:

firewall-cmd --zone=zone_name --remove-port=21/tcp

Reload zone configuration

firewall-cmd --reload

Saving & Persisting Rules

By default, firewalld rules won't save and persist across reboots. In order to make permanent, persistent rule changes, you need to use the --permanent option.