Firewalld is the default firewall module on newer Linux distributions that replaced its ancestor iptables.
One of its biggest advantage is firewall-cmd tool that makes easy to configure your own policies/zones through command line.
When installed, firewalld should be enabled and started.
systemctl enable firewalld; systemctl start firewalld
The default zone that is configured after installation is public on which the default network interface is added.
You can get a list of services allowed with the command:
firewall-cmd --zone=public --list-all
For the sake of the article we will create a new zone and allow some services on it.
Create a new zone with:
firewall-cmd --permanent --new-zone=custom
Make custom zone your default:
firewall-cmd --set-default-zone=custom
Reload firewalld module so that changes take place. Everytime you need to change a firewall setting a reload must take place.
systemctl reload firewalld
Add a custom ssh or application port on your created zone
firewall-cmd --permanent --add-port=11233/tcp --zone=custom
Add a build in service with a known port:
firewall-cmd --permanent --add-service=https --zone=custom
Add an IP address that could access your zone:
firewall-cmd --permanent --zone=custom --add-source=192.168.1.254
