Configure firewalld on AlmaLinux and Rocky Linux

AlmaLinux and Rocky Linux use firewalld. It groups rules into zones; your network interface is normally in the public zone, which blocks incoming traffic except for the services you allow.

1. Make sure it is running

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --state

2. See what is allowed

sudo firewall-cmd --get-active-zones
sudo firewall-cmd --list-all

services: should include ssh. If you changed the SSH port, ports: must include it.

Runtime vs permanent

firewalld keeps two configurations:

• Runtime rules apply immediately and vanish on reload or reboot.
• Permanent rules (with --permanent) are saved but only apply after --reload.

The usual pattern is to add a permanent rule and reload:

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Open a port

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

To try a rule without committing to it, add it at runtime with a timeout. It disappears by itself after 10 minutes:

sudo firewall-cmd --add-port=8080/tcp --timeout=10m

Allow a port from one IP only

A rich rule lets you open, for example, MariaDB only to your office address:

sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="198.51.100.7" port port="3306" protocol="tcp" accept'
sudo firewall-cmd --reload

Remove what you do not need

sudo firewall-cmd --permanent --remove-service=cockpit
sudo firewall-cmd --permanent --remove-port=8080/tcp
sudo firewall-cmd --reload

Remove cockpit only if you do not use the Cockpit web console.

Troubleshooting

• Port is open but the service still cannot be reached: check the service listens publicly with sudo ss -tlnp. SELinux can also block non-standard ports; sudo ausearch -m avc -ts recent shows recent denials.
• Rule works until reboot: you added it without --permanent. Save the current runtime rules with sudo firewall-cmd --runtime-to-permanent.
• Which zone am I editing? Rules without --zone go to the default zone: sudo firewall-cmd --get-default-zone.

Next steps

• Change the SSH port safely
• Protect SSH with Fail2ban