Permanently Opening Firewall Ports on CentOS 7: A Comprehensive Guide to firewall-cmd

Introduction

In CentOS 7 systems, the firewall management tool has transitioned from traditional iptables to firewalld, bringing more flexible configuration options and enhanced functionality. However, many users encounter persistence issues during migration, particularly when port opening rules fail to survive system reboots. Based on real-world cases, this article provides an in-depth analysis of firewall-cmd command usage, focusing on solving configuration persistence problems.

Firewalld Fundamental Concepts

As the default firewall management tool in CentOS 7, firewalld employs the concept of zones to manage network traffic. Each zone defines a set of rules controlling access permissions in specific network environments. The system predefines multiple zones such as public, dmz, and home, each with different trust levels and security policies.

A crucial feature of firewalld is its dual storage mechanism for rules: runtime configuration and permanent configuration. Runtime configuration remains effective only during the current session and is lost after system reboot, while permanent configuration is saved in configuration files and automatically loaded during system startup. This design allows administrators to test new rules without immediately affecting permanent configurations, enhancing operational safety.

Identifying Active Zones

Before configuring firewall rules, it's essential to identify currently active zones. Different network interfaces may belong to different zones, requiring configuration targeting specific zones. Use the following command to view active zones:

firewall-cmd --get-active-zones

This command displays all active zones and their associated network interfaces. For example, output might show:

public
  interfaces: eth0 eth1

This indicates that eth0 and eth1 interfaces currently belong to the public zone. If multiple zones are active, select the appropriate zone based on actual requirements.

Port Opening Command Details

To permanently open specific ports, the --permanent parameter must be used. Taking TCP port 2888 as an example, the command format is:

firewall-cmd --zone=public --add-port=2888/tcp --permanent

Here's a detailed explanation of each parameter's function:

• --zone=public: Specifies the target zone, using public as an example
• --add-port=2888/tcp: Adds port rule, where 2888 is the port number and tcp is the protocol type
• --permanent: Makes configuration permanent - this is the critical parameter

For scenarios requiring multiple port openings, execute commands separately:

firewall-cmd --zone=public --add-port=2888/tcp --permanent
firewall-cmd --zone=public --add-port=3888/tcp --permanent

If the zone isn't public, replace it with the appropriate zone name based on --get-active-zones output.

Configuration Activation and Verification

After executing permanent configuration commands, reload the firewall to activate changes:

firewall-cmd --reload

This command reloads all permanent configurations while maintaining current network connections. After reloading, verify whether ports are correctly opened:

firewall-cmd --zone=public --list-ports

This command lists all open ports in the specified zone, with output expected to include 2888/tcp and 3888/tcp.

For further verification of configuration correctness, use netstat command to check port listening status:

netstat -lntu | grep 2888
netstat -lntu | grep 3888

Zone Management and Configuration

Understanding zone management is crucial for effective firewall configuration. Use the following command to view all available zones:

firewall-cmd --get-zones

To view detailed configuration of a specific zone, use:

firewall-cmd --zone=public --list-all

This displays all settings for the zone, including services, ports, protocols, etc. If interface switching between zones is needed, use:

firewall-cmd --zone=home --change-interface=eth0 --permanent

Service Definition and Usage

Beyond direct port opening, firewalld supports service-based configuration. Services are predefined combinations of ports and protocols, providing more semantic configuration methods. View all available services:

firewall-cmd --get-services

If required services aren't in the predefined list, create custom services. First copy template files:

cp /usr/lib/firewalld/services/ssh.xml /etc/firewalld/services/myservice.xml

Then edit the custom service file to define required ports and protocols. After completion, reload the firewall to use the newly defined service.

Troubleshooting and Best Practices

Various issues may arise during firewall configuration. Here are common troubleshooting methods:

• Configuration not effective: Check if --permanent parameter was used and --reload was executed
• Connection refused: Verify zone configuration correctness and interface assignment to proper zones
• Service inaccessible: Check port listening status and service configuration

Best practice recommendations:

• Test rules in runtime configuration before modifying permanent configuration
• Regularly backup firewall configurations
• Use descriptive service names instead of direct port numbers
• Follow principle of least privilege, opening only necessary ports

Advanced Configuration

For more complex network environments, firewalld provides rich configuration options:

Port range opening: Open consecutive port ranges in one operation

firewall-cmd --zone=public --add-port=2000-3000/tcp --permanent

Source IP restrictions: Use rich rules to limit access from specific source IPs

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="2888" protocol="tcp" accept' --permanent

These advanced features enable firewalld to adapt to various complex network scenarios.

Conclusion

Through detailed analysis in this article, we've understood the complete process of using firewall-cmd commands to permanently open firewall ports in CentOS 7 systems. The key is remembering to use the --permanent parameter to ensure configurations survive reboots, and executing --reload after modifications to activate changes. Firewalld's zone mechanism and service definitions provide flexible and powerful firewall management capabilities. Proper utilization of these features enables construction of both secure and efficient network environments.