AlmaLinux Administration Basics - Firewalld

Firewalld is the firewall in AlmaLinux. It controls which network traffic gets through. By default, it blocks everything and only lets through what you explicitly allow.

If your services aren’t working when you think they should be, the firewall is usually the culprit. Here’s how to manage it.

How firewalld thinks

#

Firewalld uses zones. Your home lab network interface is probably in the “public” zone. That’s where you add rules to control what comes in.

Basic rule: deny everything by default, allow only what you need.

Open a port by service

#

This is the easy way. Firewalld knows what ports services use. If you want HTTP through, just ask for it by name:

firewall-cmd --zone=public --add-service=http --permanent

The --permanent flag means it survives a reboot. Without it, the change disappears when you restart.

Open a port by number

#

If there’s no service name, use the port number. Opening 8080 for TCP:

firewall-cmd --zone=public --add-port=8080/tcp --permanent

Check what you’ve opened

#

See services:

firewall-cmd --zone=public --list-services

See ports:

firewall-cmd --zone=public --list-ports

See everything:

firewall-cmd --list-all

Reload the firewall

#

After you change things, reload to make it active:

firewall-cmd --reload

Close ports you don’t need

#

Remove HTTP:

firewall-cmd --zone=public --permanent --remove-service=http

Then reload.

Common home lab ports

#

# HTTP and HTTPS
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --zone=public --add-service=https --permanent

# SSH (might already be open)
firewall-cmd --zone=public --add-service=ssh --permanent

# Databases
firewall-cmd --zone=public --add-service=mysql --permanent
firewall-cmd --zone=public --add-service=postgresql --permanent

# DNS
firewall-cmd --zone=public --add-service=dns --permanent

Security stuff

#

Only open ports you actually use. Every open port is a potential problem.

If a service needs authentication, use strong passwords.

Keep your system updated. Patches close security holes.

Check your logs occasionally. Look for repeated failed connection attempts.