1.8 KiB
Firewall Configuration
On RHEL 9, the default and recommended system firewall is firewalld. firewalld relies on the modern nftables kernel framework as its underlying packet-filtering backend (which completely replaces the legacy iptables). In almost all situations, you should manage your firewall via firewalld rather than writing raw nftables rules directly.
Configuration
To configure firewalld using a configuration file rather than executing multiple CLI commands, you will want to leverage Zones. By default, firewalld looks at XML configuration files located in /etc/firewalld/zones/. Any file placed here overrides the system defaults and takes effect as a permanent configuration.
By default, RHEL 9 assigns network interfaces to the public zone.
E.g. to restrict external access except SSH, one needs to create a custom XML configuration for the public zone - /etc/firewalld/zones/public.xml.
Example:
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Public</short>
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
<service name="ssh"/>
</zone>
Commandline Interface
Enable and start the firewalld service:
systemctl enable firewalld
systemctl start firewalld
Check the status of firewalld with the following command:
systemctl status firewalld
View your active zone and rules:
firewall-cmd --list-all
# Only show rules for the public zone
firewall-cmd --zone=public --list-all
Allow a predefined service permanently (e.g., HTTPS):
firewall-cmd --add-service=https --permanent
firewall-cmd --reload
Open a custom port permanently (e.g., TCP port 8080):
firewall-cmd --add-port=8080/tcp --permanent
firewall-cmd --reload