adminFirewalld Service and Port Management Checklist for RHCSA
Firewalld is commonly used on Red Hat-based systems to manage firewall rules. RHCSA practice should include zones, services, ports, runtime changes, permanent changes and verification.
Core principle
A firewall rule controls network reachability. Runtime rules affect the current session. Permanent rules survive reload or reboot. Know which one you are changing.
Checklist
- Check firewalld status.
- Check active zones.
- List allowed services.
- List allowed ports.
- Add a service temporarily.
- Add a service permanently.
- Add a custom port if needed.
- Reload firewalld carefully.
- Verify external access.
- Remove rules that are no longer needed.
Reusable lesson
This applies to SSH, web servers, databases, APIs, Nginx, httpd, Cockpit, monitoring and cloud security design.
When to Use This Checklist
Use this checklist when practicing firewall management for RHCSA or securing Red Hat-based servers.
Required Tools
RHEL-compatible VM, firewalld, firewall-cmd, sudo access, test service, second terminal
Before You Start
Keep console or existing SSH access available before changing firewall rules on a remote system.
Structured Checklist Steps
- Check firewalld status.
- Check zones.
- List services.
- List ports.
- Add runtime service.
- Add permanent service.
- Add custom port.
- Reload firewalld.
- Verify access.
- Remove unused rules.
Verification Steps
- Firewalld is active if required.
- Correct zone is understood.
- Only required services or ports are open.
- Permanent rules survive reload.
- Remote access is not accidentally blocked.
Rollback Plan
If firewall changes block access, use console recovery or another active session to remove the latest rule and restore known-good access.
Common Mistakes
- Changing runtime rules but forgetting permanent rules.
- Opening ports globally without need.
- Reloading before verifying SSH access.
- Confusing service names with port numbers.
- No documentation of open services.
Related Commands
sudo systemctl status firewalld
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --list-all
sudo firewall-cmd --add-service=http
sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --add-port=8080/tcp --permanent
sudo firewall-cmd --reload