---
title: 'firewall-cmd examples'
url: 'https://mo.homelinux.net/home/firewalld'
markdown: 'https://mo.homelinux.net/home/firewalld.md'
date: '2017-03-06'
description: 'The command-line tool firewall-cmd is part of the firewalld application. It can be used to make permanent and non-permanent runtime changes. List'
taxonomy:
  category:
    - blog
  tag:
    - network
    - firewall
  archives_month:
    - mar_2017
  archives_year:
    - '2017'
---

[ Home ](https://mo.homelinux.net/)      firewall-cmd examples    

## [firewall-cmd examples](https://mo.homelinux.net/home/firewalld)

    6th Mar 2017   [network](https://mo.homelinux.net/tag:network#body-wrapper) [firewall](https://mo.homelinux.net/tag:firewall#body-wrapper)  

The command-line tool firewall-cmd is part of the firewalld application. It can be used to make permanent and non-permanent runtime changes.

 **List all zones**

Use following command to list all zones.

```
# firewall-cmd --list-all-zones
..
internal
  target: default
  icmp-block-inversion: no
  interfaces: 
  sources: 
  services: ssh mdns samba-client dhcpv6-client
  ports: 
  protocols:
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: smtp http ssh https
  ports: 
  protocols: 
  masquerade: no 
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
..
```

Public is the default zone, if it wasn't changed. To check the current default zone use:

```
# firewall-cmd --get-default-zone
public
```

 **List allowed service and ports on the system**

To show allowed service on your system use the following command.

```
# firewall-cmd --list-services
smtp http ssh https
```

To list open ports:

```
# firewall-cmd --list-ports
123/tcp 123/udp 3306/tcp 68/udp 9981-9982/tcp
```

You would normally see no ports listed here when not configured.

 **Enable a Service**

You can open the required ports for a service by using the --add-service option. To allow access by HTTP clients:

```
# firewall-cmd --add-service=http
success
```

To list allowed services use the above command.

 **Enable a port**

You can also open the ports directly whith the --add-port option

```
# firewall-cmd --add-port=80/tcp
success
```

To list allowed ports use the previous mentioned command.
Don't forget to add --permanent to make your changes permanent

 **Show config**

```
# firewall-cmd --list-all --permanent
public
  target: default
  icmp-block-inversion: no
  interfaces: 
  sources: 
  services: smtp http ssh https
  ports: 
  protocols: tcp
  masquerade: no
  forward-ports: 
  source-ports:
  icmp-blocks: 
  rich rules: 
```

 **Add a Service**

There are different ways to a add a new service. A new service will only be visible in permanent configuration after it has been added. To make it active in the runtime environment you need to reload firewalld.

 ***using firewall-cmd***

To add a new and empty service, use the --new-service altogether with the --permanent option:

```
# firewall-cmd --permanent --new-service=ftpes
```

Configure the service:

```
# firewall-cmd --permanent --service=myservice --set-description="Explicit FTP over SSL/TLS"
# firewall-cmd --permanent --service=myservice --set-short="FTPES"
# firewall-cmd --permanent --service=myservice --add-port=20/tcp
# firewall-cmd --permanent --service=myservice --add-port=21/tcp
# firewall-cmd --permanent --service=myservice --add-port=21090-21100/tcp
# firewall-cmd --permanent --service=myservice --add-module=nf_conntrack_ftp
```

Alternatively you can configure a new service using an existing file:

```
# firewall-cmd --permanent --new-service-from-file=ftp.xml
```

This adds a new service using all settings from the file including the service name.

```
# firewall-cmd --permanent --new-service-from-file=ftp.xml --name=ftpes
```

This adds a new service using the service settings from the file. But the new service will have the name ftpes.

 ***Copy a file from the services directory /usr/lib/firewalld/services/ to /etc/firewalld/services/***

As root copy the file:

```
# cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services/ftpes.xml
```

and edit it to your needs or create one from scratch

```
# nano /etc/firewalld/services/ftps.xml
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>FTPES</short>
  <description>Explicit FTP over SSL/TLS</description>
  <port protocol="tcp" port="21"/>
  <module name="nf_conntrack_ftp"/>
  <port protocol="tcp" port="20"/>
  <port protocol="tcp" port="21090-21100"/>
</service>
```

After you have copied the file into /etc/firewalld/services it takes about 5 seconds till the new service will be visible in firewalld.

 **IPset Blacklist**

Create the blacklist

```
# firewall-cmd --permanent --new-ipset=blacklist --type=hash:net --option=family=inet --option=hashsize=4096 --option=maxelem=200000
success
```

Populate the blacklist

```
# wget -q https://lists.blocklist.de/lists/all.txt
# firewall-cmd --permanent --ipset=blacklist --add-entries-from-file=./all.txt
success
```

Redirect the blacklist to the drop zone

```
# firewall-cmd --permanent --zone=drop --add-source=ipset:blacklist
success
# firewall-cmd --reload
success
```

 [ Previous Post](https://mo.homelinux.net/home/ip-cmd) [Next Post ](https://mo.homelinux.net/home/check-ssl)

#### Random Article

 [ I'm Feeling Lucky!](https://mo.homelinux.net/random)

#### Popular Tags

#### Archives

- [ 1 June 2006  ](https://mo.homelinux.net/archives_month:jun_2006)
- [ 1 August 2007  ](https://mo.homelinux.net/archives_month:aug_2007)
- [ 1 November 2007  ](https://mo.homelinux.net/archives_month:nov_2007)
- [ 2 February 2008  ](https://mo.homelinux.net/archives_month:feb_2008)
- [ 1 March 2008  ](https://mo.homelinux.net/archives_month:mar_2008)
- [ 1 July 2008  ](https://mo.homelinux.net/archives_month:jul_2008)
- [ 2 August 2008  ](https://mo.homelinux.net/archives_month:aug_2008)
- [ 1 September 2008  ](https://mo.homelinux.net/archives_month:sep_2008)
- [ 1 November 2008  ](https://mo.homelinux.net/archives_month:nov_2008)
- [ 1 February 2009  ](https://mo.homelinux.net/archives_month:feb_2009)
- [ 1 October 2009  ](https://mo.homelinux.net/archives_month:oct_2009)
- [ 1 August 2013  ](https://mo.homelinux.net/archives_month:aug_2013)
- [ 1 November 2014  ](https://mo.homelinux.net/archives_month:nov_2014)
- [ 2 March 2015  ](https://mo.homelinux.net/archives_month:mar_2015)
- [ 1 October 2015  ](https://mo.homelinux.net/archives_month:oct_2015)
- [ 1 December 2015  ](https://mo.homelinux.net/archives_month:dec_2015)
- [ 1 January 2016  ](https://mo.homelinux.net/archives_month:jan_2016)
- [ 1 March 2017  ](https://mo.homelinux.net/archives_month:mar_2017)
- [ 1 August 2017  ](https://mo.homelinux.net/archives_month:aug_2017)
- [ 2 June 2020  ](https://mo.homelinux.net/archives_month:jun_2020)
- [ 1 November 2020  ](https://mo.homelinux.net/archives_month:nov_2020)
- [ 1 December 2020  ](https://mo.homelinux.net/archives_month:dec_2020)
- [ 1 January 2021  ](https://mo.homelinux.net/archives_month:jan_2021)
- [ 1 February 2021  ](https://mo.homelinux.net/archives_month:feb_2021)
- [ 1 March 2021  ](https://mo.homelinux.net/archives_month:mar_2021)
- [ 1 April 2021  ](https://mo.homelinux.net/archives_month:apr_2021)
- [ 1 May 2021  ](https://mo.homelinux.net/archives_month:may_2021)
- [ 1 October 2021  ](https://mo.homelinux.net/archives_month:oct_2021)
- [ 1 February 2022  ](https://mo.homelinux.net/archives_month:feb_2022)
- [ 1 March 2022  ](https://mo.homelinux.net/archives_month:mar_2022)
- [ 1 May 2023  ](https://mo.homelinux.net/archives_month:may_2023)
- [ 1 December 2024  ](https://mo.homelinux.net/archives_month:dec_2024)
- [ 1 March 2025  ](https://mo.homelinux.net/archives_month:mar_2025)
- [ 1 March 2026  ](https://mo.homelinux.net/archives_month:mar_2026)

---

## Navigation

- Parent: [Home](https://mo.homelinux.net/index.md)
- Previous: [Check SSL Certificate](https://mo.homelinux.net/home/check-ssl.md)
- Next: [ip Commands](https://mo.homelinux.net/home/ip-cmd.md)