firewalld is the standard firewall on Rocky Linux, AlmaLinux and other systems like Red Hat Enterprise Linux. It works with zones: each network interface belongs to a zone, and a zone says what may come in. This guide uses the default zone, public.
Install and turn on firewalld#
Cloud images often come without it. Check first:
sudo systemctl status firewalld
If it is not installed or not running:
sudo dnf install firewalld
sudo systemctl enable --now firewalld
See what is open#
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --list-all
The line services: shows what is allowed, for example cockpit dhcpv6-client ssh, and ports: shows single ports.
Open a service or a port#
firewalld knows many services by name. For a website:
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
For a port without a service name, for example a Minecraft Java server:
sudo firewall-cmd --permanent --add-port=25565/tcp
sudo firewall-cmd --reload
--permanent saves the rule, --reload applies it. Without --permanent a rule works right away but is gone after a reload or reboot. sudo firewall-cmd --get-services lists every service name.
Close what you do not use#
Rocky and AlmaLinux allow cockpit (a web panel on port 9090) and dhcpv6-client by default. If you do not use Cockpit:
sudo firewall-cmd --permanent --remove-service=cockpit
sudo firewall-cmd --reload
To close a port again:
sudo firewall-cmd --permanent --remove-port=25565/tcp
sudo firewall-cmd --reload
Allow a port from one address only#
To allow, say, a database port only from 203.0.113.10, use a rich rule:
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.10" port port="5432" protocol="tcp" accept'
sudo firewall-cmd --reload
Use this only with an address that does not change.
Docker and firewalld#
Docker adds its own zone, docker, and its own rules. A port that a container publishes is reachable even if you did not open it in the public zone. To keep it private, publish it on 127.0.0.1 only, for example -p 127.0.0.1:8080:80.
Block repeated failed logins with fail2ban#
fail2ban comes from the EPEL repository on these systems:
sudo dnf install epel-release
sudo dnf install fail2ban fail2ban-firewalld fail2ban-systemd
fail2ban-firewalld makes fail2ban block addresses through firewalld, and fail2ban-systemd lets it read the system journal. Turn on the SSH jail in /etc/fail2ban/jail.local:
[sshd]
enabled = true
backend = systemd
maxretry = 5
findtime = 10m
bantime = 1h
Then start it and check:
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd
More about fail2ban and SSH keys: Secure SSH on your server.
If you locked yourself out#
Log in through the web console of your provider and allow SSH again:
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload
Or stop the firewall until you have fixed the rules: sudo systemctl stop firewalld.
On Ubuntu or Debian, use ufw instead: Set up a firewall with ufw.