1. Understanding and updating firewall

firewalld is a firewall management tool provided by default in the CentOS operating system. firewalld supports both IPv4 and IPv6 networks, operates as defined in the profile area, and is highly reliable.

Original Korean article: firewall settings

• block: Connect only networks started within the system and reject all other connections
• dmz: Allows connections only from allowed ports and provides connections to incoming ports.
• drop: Block all incoming connections and only allow outgoing network connections
• public: Do not trust other servers or computers on the network and allow only necessary ports and services
• trusted: Allow connections to all zones
• home: Connects to a trusted PC on the local network and allows only selected TCP/IP ports

You can use friewall to allow or block traffic. Centos 8 provides a custom-based firewall with a dynamic interface.

A firewall forms a barrier between the system and external sources, preventing external damage from spreading and damaging valuable internal data. Therefore, you must use a firewall and you should not stop it just because the service is not working well.

sudo firewall-cmd --get-zones

sudo firewall-cmd --version

firewall settings

sudo systemctl status firewall

sudo systemctl start firewall

sudo systemctl stop firewall

sudo systemctl restart firewall

sudo systemctl enable firewall

sudo systemctl disable firewall

sudo firewall-cmd --reload

/etc/firewalld/firewalld.conf

firewall firewall port settings

sudo firewall-cmd --list-all

sudo firewall-cmd --list-services

OR

sudo firewall-cmd --list-services --zone=public

sudo firewall-cmd --remove-service=cockpit --permanent

sudo firewall-cmd --remove-service=dhcpv6-client --permanent

You can specify the port directly, but you can also use the service name to operate it.

sudo firewall-cmd --get-services
sudo firewall-cmd --get-services | grep [example example : http or mysql]

Service port information can be checked through the xml file in the link below.

sudo ls -l /usr/lib/firewalld/services/
sudo cat /usr/lib/firewalld/services/ssh.xml

The following is the command to permanently add an http port to the public zone. If you delete –permanent and enter it, it will be added temporarily and will disappear after rebooting. If you register a service and port, it must be reloaded.

sudo firewall-cmd --zone=public --add-service=http --permanent

OR

sudo firewall-cmd --zone=public --add-port=80/tcp --permanent

sudo firewall-cmd --reload

The following is the command to permanently delete the http port in the public zone. If you delete –permanent and then enter it, it will be temporarily deleted and will remain after rebooting. If you delete a service or port, it must be reloaded.

sudo firewall-cmd --zone=public --remove-service=http --permanent

OR

sudo firewall-cmd --zone=public --remove-port=80/tcp --permanent

sudo firewall-cmd --reload

The firewall can be updated through git. https://firewalld.org/

Good article to read together

• Install Nginx web server (Centos 8)
• Install Centos 8
• Activate Centos 8 RHEL & REMI Repository
• Install and enable Ubuntu firewall iptables
• Ubuntu firewall iptables setup and management

Related Reading

Continue with these related Thinknote English articles in the Server & Infrastructure cluster.

• Nextcloud installation and settings
• Install memory caching APCu, Redis, Memcached
• Free HTTPS setup (Let’s Encrypt, Cloudflare)
• Install OpenSSL
• Installing and managing MariaDB (MySQL)
• Setting up Nginx + Php8

FAQ

What is this article about?

This article is part of Thinknote’s English server and infrastructure archive. It focuses on practical Linux, Ubuntu, web-server, database, SSH, firewall, or hosting operations that readers can adapt to their own environment.

How should I use this guide?

Use it as a practical checklist and concept guide. Before applying commands on a live server, verify package names, OS versions, ports, and backup requirements for your own setup.

Where can I read the original Korean article?

The original Korean article is available here: Original Korean article.