Enterprise Linux Firewall Administration: firewalld Zones, Services & Rich Rules | Linux Tutorial

Securing Linux hosts requires an active packet-filtering firewall at the network perimeter of every operating system. On enterprise distributions such as Red Hat Enterprise Linux (RHEL), Rocky Linux, AlmaLinux, and Fedora, firewalld serves as the default dynamic firewall daemon. Built as an abstraction layer above the Linux kernel's nftables framework (and historically iptables), firewalld allows administrators to modify filtering rules on the fly without dropping active network connections.

Unlike legacy firewall scripts that require flushing and re-creating entire rule tables during updates, firewalld dynamically updates state tables while categorizing network interfaces into distinct Zones based on trust levels.

The firewalld Zone Architecture

In firewalld, network interfaces and source IP ranges are bound to specific Zones. Each zone defines a policy for traffic originating from or passing through that network boundary:

Zone Name	Default Trust Level	Intended Network Context
`drop`	Lowest	All incoming packets are dropped immediately with no ICMP reply. Outgoing traffic is allowed.
`block`	Very Low	All incoming connection attempts are rejected with an ICMP host-prohibited message.
`public`	Low (Default)	Untrusted public networks. Only explicitly allowed ports and services (typically SSH) accept incoming connections.
`internal`	Moderate	Internal LAN networks. Accepts standard local services (DNS, DHCP, SSH, mDNS) based on peer trust.
`dmz`	Controlled	Demilitarized zone hosts accessible from the internet with restricted access to the internal network.
`trusted`	Highest	All incoming network traffic is completely accepted without inspection or restriction.

Runtime vs Permanent Configuration

One of the most critical operational concepts in firewalld is the distinction between runtime state and persistent configuration:

Runtime Configuration: Changes take effect immediately in the kernel but do not persist across server reboots or firewall daemon reloads.
Permanent Configuration (--permanent): Changes are written to persistent XML files in /etc/firewalld/zones/. They survive reboots but do not take effect immediately until the firewall is reloaded via firewall-cmd --reload.

The Golden Rule: Add --permanent, Then Reload

In production environments, always append --permanent to rule modifications and then run firewall-cmd --reload. Alternatively, apply rules at runtime first to test connectivity, then persist them using firewall-cmd --runtime-to-permanent once validated.

Essential `firewall-cmd` Workflows

1. Inspecting Active Zones and Open Ports

Bash (Query Commands)

# Check whether the daemon is actively running
sudo firewall-cmd --state

# Identify active zones and the network interfaces bound to them
sudo firewall-cmd --get-active-zones

# Print complete rule configuration for the default zone
sudo firewall-cmd --list-all

# Print complete rule configuration for a specific zone
sudo firewall-cmd --zone=internal --list-all

2. Managing Allowed Services and Raw TCP/UDP Ports

firewalld provides pre-packaged service definitions (stored in /usr/lib/firewalld/services/) that bundle protocol, port, and helper configurations into readable names:

Bash (Opening Services & Ports)

# Allow standard HTTP and HTTPS services permanently
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https

# Allow a custom application port (e.g. backend API on TCP 8080)
sudo firewall-cmd --permanent --zone=public --add-port=8080/tcp

# Apply changes to active kernel filtering tables without breaking connections
sudo firewall-cmd --reload

Advanced Filtering: Implementing Rich Rules

When administrators need granular traffic filtering—such as allowing access to a port only from a specific management IP subnet—standard port rules are insufficient. Rich Rules provide fine-grained expression syntax:

Bash (Rich Rules Syntax)

# Allow SSH access ONLY from the trusted management subnet 192.168.10.0/24
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.10.0/24" service name="ssh" accept'

# Block and log dropped traffic from a suspicious external IP
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="203.0.113.55" log prefix="[FIREWALL DROP] " level="notice" drop'

# Port forward incoming TCP 80 traffic to an internal container on 8080
sudo firewall-cmd --permanent --zone=public --add-forward-port=port=80:proto=tcp:toport=8080

# Reload to activate the rich rules
sudo firewall-cmd --reload

Verifying and Troubleshooting firewalld

When legitimate traffic is blocked or expected services fail to respond, follow these diagnostic steps:

Bash (Diagnostics)

# Validate configuration files for XML syntax or rule formatting errors
sudo firewall-cmd --check-config

# Temporarily enable log-denied packets to diagnose dropped connections
sudo firewall-cmd --set-log-denied=all

# Monitor dropped kernel packets in real time
sudo journalctl -k -f | grep -i firewalld

Summary

firewalld provides modern Linux systems with dynamic, non-disruptive firewall management. By binding network interfaces to appropriate trust zones, managing services rather than raw port numbers, distinguishing between runtime and permanent states, and leveraging rich rules for granular IP whitelisting, administrators maintain a robust host-based defense across enterprise Linux infrastructure.