sudo firewall-cmd --permanent --add-port=8080/tcp, then apply it with sudo firewall-cmd --reload. For a known service, use its name instead, for example sudo firewall-cmd --permanent --add-service=https. Confirm the result with sudo firewall-cmd --list-all.
firewalld is the default firewall on Red Hat based distributions. A firewall decides which network connections reach your server. firewalld groups rules into zones; on a new install the default zone is
public, and it allows ssh, dhcpv6-client and cockpit (Red Hat documentation).
Before you start
- You need root or a sudo user. Root users can leave out
sudo. - Keep a way back in: the VNC console on a VPS, or open a ticket on a dedicated server.
- On Ubuntu or Debian, use UFW instead. Do not run two firewall managers at once.
How to check that firewalld is running
running. If it says not running, install and start it:
Runtime vs permanent rules
A safe habit for risky changes: add the rule as runtime first, test it, then save all runtime rules with
sudo firewall-cmd --runtime-to-permanent.
How to open a port in firewalld
1
Add the port permanently
2
Reload firewalld
3
Check the zone
--zone=, for example --zone=public.
How to open a service by name
firewalld ships definitions for common services, so you do not need to remember port numbers.How to allow one IP address only
Use a rich rule (a rule with source, port and action in one line) to allow a single address, for example a database port for your office IP:trusted zone:
How to close a port
How to check it worked
Frequently asked questions
Why does my port still not work after firewall-cmd?
Check three things: you ran--reload after a --permanent rule, the program is listening (sudo ss -tulpn), and SELinux allows the program to use that port. A non-standard port for a web server or SSH often needs semanage port.
Should I remove cockpit from the public zone?
If you do not use the Cockpit web console, remove it:sudo firewall-cmd --permanent --remove-service=cockpit and reload. This leaves SSH untouched.
Can I add a temporary rule?
Yes.sudo firewall-cmd --add-port=8080/tcp --timeout=10m opens the port for 10 minutes. Timed rules are runtime only.
Does firewalld stop DDoS attacks?
No. It runs on your server, after the traffic has arrived. See apply DDoS filters for network-level filtering.Does firewalld use iptables or nftables?
Current releases use nftables as the backend. Manage rules throughfirewall-cmd and avoid adding raw rules by hand alongside it.
Related guides
VPS and dedicated server guides
Every guide in this section.
Set up UFW
Firewall for Ubuntu and Debian.
Use SELinux
Fix permission denied on AlmaLinux.
nftables and iptables
Rules without a front end.
Locked out after a firewall change
Get back into your server.
Security checklist
Harden the rest of your server.
Checked against the official firewall-cmd manual, firewalld rich language manual, Red Hat firewalld documentation and Rocky Linux firewalld guide on 4 November 2026. Commands can differ on other distributions or releases.
Need Extra Help?
If you encounter any issues, our support team is ready to assist:- Live Chat: Quick assistance via our website.
- Support Ticket: Open a Ticket
- Discord: Join our Community
- Email: support@freakhosting.com
Last Updated: November 2026