Skip to main content
To open a port with firewalld on AlmaLinux or Rocky Linux, run sudo firewall-cmd --permanent --add-port=8080/tcp, then apply it with sudo firewall-cmd --reload. For a known service, use its name instead, for example sudo firewall-cmd --permanent --add-service=https. Confirm the result with sudo firewall-cmd --list-all. firewalld is the default firewall on Red Hat based distributions. A firewall decides which network connections reach your server. firewalld groups rules into zones; on a new install the default zone is public, and it allows ssh, dhcpv6-client and cockpit (Red Hat documentation).

Before you start

  • You need root or a sudo user. Root users can leave out sudo.
  • Keep a way back in: the VNC console on a VPS, or open a ticket on a dedicated server.
  • On Ubuntu or Debian, use UFW instead. Do not run two firewall managers at once.
Never remove the ssh service (or your custom SSH port) from the zone your network interface uses. Without it you lose SSH access straight after the next reload.

How to check that firewalld is running

The output is running. If it says not running, install and start it:
See which zone your network interface uses:

Runtime vs permanent rules

A safe habit for risky changes: add the rule as runtime first, test it, then save all runtime rules with sudo firewall-cmd --runtime-to-permanent.

How to open a port in firewalld

1

Add the port permanently

For UDP or a range:
2

Reload firewalld

3

Check the zone

To add a rule to a zone other than the default, add --zone=, for example --zone=public.

How to open a service by name

firewalld ships definitions for common services, so you do not need to remember port numbers.
List every predefined service name:

How to allow one IP address only

Use a rich rule (a rule with source, port and action in one line) to allow a single address, for example a database port for your office IP:
To trust an address for every port, add it as a source of the trusted zone:

How to close a port

How to check it worked

Example output:
If you changed the SSH port, firewalld and SELinux both need to know. See change the SSH port and use SELinux.

Frequently asked questions

Why does my port still not work after firewall-cmd?

Check three things: you ran --reload after a --permanent rule, the program is listening (sudo ss -tulpn), and SELinux allows the program to use that port. A non-standard port for a web server or SSH often needs semanage port.

Should I remove cockpit from the public zone?

If you do not use the Cockpit web console, remove it: sudo firewall-cmd --permanent --remove-service=cockpit and reload. This leaves SSH untouched.

Can I add a temporary rule?

Yes. sudo firewall-cmd --add-port=8080/tcp --timeout=10m opens the port for 10 minutes. Timed rules are runtime only.

Does firewalld stop DDoS attacks?

No. It runs on your server, after the traffic has arrived. See apply DDoS filters for network-level filtering.

Does firewalld use iptables or nftables?

Current releases use nftables as the backend. Manage rules through firewall-cmd and avoid adding raw rules by hand alongside it.

VPS and dedicated server guides

Every guide in this section.

Set up UFW

Firewall for Ubuntu and Debian.

Use SELinux

Fix permission denied on AlmaLinux.

nftables and iptables

Rules without a front end.

Locked out after a firewall change

Get back into your server.

Security checklist

Harden the rest of your server.

Checked against the official firewall-cmd manual, firewalld rich language manual, Red Hat firewalld documentation and Rocky Linux firewalld guide on 4 November 2026. Commands can differ on other distributions or releases.

Need Extra Help?

If you encounter any issues, our support team is ready to assist:

Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!

Last Updated: November 2026