# Firewall Configuration

On RHEL 9, the default and recommended system firewall is **firewalld**. firewalld relies on the modern nftables kernel framework as its underlying packet-filtering backend (which completely replaces the legacy iptables). In almost all situations, you should manage your firewall via firewalld rather than writing raw nftables rules directly.

## Configuration

To configure firewalld using a configuration file rather than executing multiple CLI commands, you will want to leverage Zones.
By default, firewalld looks at XML configuration files located in /etc/firewalld/zones/. Any file placed here overrides the system defaults and takes effect as a permanent configuration.

By default, RHEL 9 assigns network interfaces to the public zone.
E.g. to restrict external access except SSH, one needs to create a custom XML configuration for the public zone - `/etc/firewalld/zones/public.xml`.

Example:

```xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="ssh"/>
</zone>
```



## Commandline Interface

Enable and start the firewalld service:

```bash
systemctl enable firewalld
systemctl start firewalld
```

Check the status of firewalld with the following command:

```bash
systemctl status firewalld
```

View your active zone and rules:

```bash
firewall-cmd --list-all
# Only show rules for the public zone
firewall-cmd --zone=public --list-all
```

Allow a predefined service permanently (e.g., HTTPS):

```bash
firewall-cmd --add-service=https --permanent
firewall-cmd --reload
```

Open a custom port permanently (e.g., TCP port 8080):  

```bash
firewall-cmd --add-port=8080/tcp --permanent
firewall-cmd --reload
```