> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Open a Port with firewalld on AlmaLinux and Rocky

> To open a port with firewalld on AlmaLinux or Rocky, run sudo firewall-cmd --permanent --add-port=8080/tcp, then reload and check it with --list-all.

To open a port with firewalld on AlmaLinux or Rocky Linux, run `sudo firewall-cmd --permanent --add-port=8080/tcp`, then apply it with `sudo firewall-cmd --reload`. For a known service, use its name instead, for example `sudo firewall-cmd --permanent --add-service=https`. Confirm the result with `sudo firewall-cmd --list-all`.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 10 minutes | AlmaLinux 9 / 10, Rocky Linux 9 / 10, CentOS Stream 9, Oracle Linux 8 / 9, Fedora | Root or sudo access |

firewalld is the default firewall on Red Hat based distributions. A firewall decides which network connections reach your server. firewalld groups rules into **zones**; on a new install the default zone is `public`, and it allows `ssh`, `dhcpv6-client` and `cockpit` ([Red Hat documentation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/using-and-configuring-firewalld_firewall-packet-filters)).

## Before you start

* You need root or a sudo user. Root users can leave out `sudo`.
* Keep a way back in: the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) on a VPS, or [open a ticket](https://freakhosting.com/clientarea/submitticket.php) on a dedicated server.
* On Ubuntu or Debian, use [UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md) instead. Do not run two firewall managers at once.

> [!WARNING]
>
> Never remove the `ssh` service (or your custom SSH port) from the zone your network interface uses. Without it you lose SSH access straight after the next reload.

## How to check that firewalld is running

```bash theme={null}
sudo firewall-cmd --state
```

The output is `running`. If it says `not running`, install and start it:

```bash theme={null}
sudo dnf install firewalld
sudo systemctl enable --now firewalld
```

See which zone your network interface uses:

```bash theme={null}
sudo firewall-cmd --get-active-zones
```

```text theme={null}
public
  interfaces: eth0
```

## Runtime vs permanent rules

| Type | How you add it | Lasts after reload or reboot? |
| - | - | - |
| Runtime | `firewall-cmd --add-port=…` | No |
| Permanent | `firewall-cmd --permanent --add-port=…` then `--reload` | Yes |

A safe habit for risky changes: add the rule as runtime first, test it, then save all runtime rules with `sudo firewall-cmd --runtime-to-permanent`.

## How to open a port in firewalld

**1. Add the port permanently**

```bash theme={null}
sudo firewall-cmd --permanent --add-port=8080/tcp
```

For UDP or a range:

```bash theme={null}
sudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --permanent --add-port=27015-27020/udp
```

**2. Reload firewalld**

```bash theme={null}
sudo firewall-cmd --reload
```

**3. Check the zone**

```bash theme={null}
sudo firewall-cmd --list-all
```

To add a rule to a zone other than the default, add `--zone=`, for example `--zone=public`.

## How to open a service by name

firewalld ships definitions for common services, so you do not need to remember port numbers.

```bash theme={null}
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
```

List every predefined service name:

```bash theme={null}
sudo firewall-cmd --get-services
```

## How to allow one IP address only

Use a rich rule (a rule with source, port and action in one line) to allow a single address, for example a database port for your office IP:

```bash theme={null}
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="203.0.113.10/32" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload
```

To trust an address for every port, add it as a source of the `trusted` zone:

```bash theme={null}
sudo firewall-cmd --permanent --zone=trusted --add-source=203.0.113.10
sudo firewall-cmd --reload
```

## How to close a port

```bash theme={null}
sudo firewall-cmd --permanent --remove-port=8080/tcp
sudo firewall-cmd --permanent --remove-service=http
sudo firewall-cmd --reload
```

## How to check it worked

```bash theme={null}
sudo firewall-cmd --list-all
```

Example output:

```text theme={null}
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: cockpit dhcpv6-client http https ssh
  ports: 8080/tcp 51820/udp
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
	rule family="ipv4" source address="203.0.113.10/32" port port="3306" protocol="tcp" accept
```

If you changed the SSH port, firewalld and SELinux both need to know. See [change the SSH port](https://help.freakhosting.com/portals/other/how-to-change-the-ssh-port.md) and [use SELinux](https://help.freakhosting.com/portals/other/how-to-use-selinux-on-almalinux-and-rocky.md).

## Frequently asked questions

### Why does my port still not work after firewall-cmd?

Check three things: you ran `--reload` after a `--permanent` rule, the program is listening (`sudo ss -tulpn`), and SELinux allows the program to use that port. A non-standard port for a web server or SSH often needs `semanage port`.

### Should I remove cockpit from the public zone?

If you do not use the Cockpit web console, remove it: `sudo firewall-cmd --permanent --remove-service=cockpit` and reload. This leaves SSH untouched.

### Can I add a temporary rule?

Yes. `sudo firewall-cmd --add-port=8080/tcp --timeout=10m` opens the port for 10 minutes. Timed rules are runtime only.

### Does firewalld stop DDoS attacks?

No. It runs on your server, after the traffic has arrived. See [apply DDoS filters](https://help.freakhosting.com/portals/firewall/how-to-apply-ddos-filters.md) for network-level filtering.

### Does firewalld use iptables or nftables?

Current releases use nftables as the backend. Manage rules through `firewall-cmd` and avoid adding raw rules by hand alongside it.

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Set up UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md)
>
> Firewall for Ubuntu and Debian.

> [card] [Use SELinux](https://help.freakhosting.com/portals/other/how-to-use-selinux-on-almalinux-and-rocky.md)
>
> Fix permission denied on AlmaLinux.

> [card] [nftables and iptables](https://help.freakhosting.com/portals/other/how-to-use-nftables-and-iptables.md)
>
> Rules without a front end.

> [card] [Locked out after a firewall change](https://help.freakhosting.com/portals/other/how-to-fix-locked-out-after-firewall-change.md)
>
> Get back into your server.

> [card] [Security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> Harden the rest of your server.

***

> [!NOTE]
>
> **Checked against the official [firewall-cmd manual](https://firewalld.org/documentation/man-pages/firewall-cmd.html), [firewalld rich language manual](https://firewalld.org/documentation/man-pages/firewalld.richlanguage.html), [Red Hat firewalld documentation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/using-and-configuring-firewalld_firewall-packet-filters) and [Rocky Linux firewalld guide](https://docs.rockylinux.org/10/guides/security/firewalld-beginners/)** on 4 November 2026. Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.