In CentOS 6 I could type setup from the command line and I would be presented with a set of tools, one of them being Firewall configuration. I can still do this in CentOS 7, except the list no longer includes Firewall configuration as an option.

Does anyone know where I can find it now and why it has been moved?

This is where I used to go to allow incoming traffic via HTTP and HTTPS. If there's a better way, I'd gladly take the advice. Thanks.


Since the release of RedHat/CentOS 7, the previous firewall system has been replaced with firewalld.

At the time of writing there is no curses-like console interface similar to system-config-firewall. If you don't mind using a GUI you could use firewall-config instead.

If you need something for the console you will have to use firewall-cmd instead.

For more information and full documentation about firewalld: 4.5. Using Firewalls

I hope this might help you!

| improve this answer | |
  • 7
    If you want to go back to using iptables, see this: serverfault.com/questions/470287/… – fuero Jul 29 '14 at 22:52
  • And if you just want to disable the firewall, use: sudo service firewalld stop; sudo chkconfig firewalld off – Dawngerpony Dec 22 '14 at 21:18
  • 3
    @DuffJ On RHEL 7 it's systemctl stop firewalld.service and systemctl disable firewalld.service – Winter Jan 10 '15 at 3:12
  • Oh yes! One place where RHEL and CentOS differ. Thanks. – Dawngerpony Jan 13 '15 at 14:22
  • 2
    @DuffJ RHEL 7 and CentOS 7 don't differ in this regard. – ste Jun 29 '15 at 0:34

Here are some commands with descriptions below that I came across and were helpful

firewall-cmd --state
  view status of firewalld service (systemctl status firewalld)
firewall-cmd --zone=public --list-all
  gets all info for the “public” zone
firewall-cmd --list-all-zones
  shows all info for all zones
firewall-cmd --zone=public --add-port=80/tcp --permanent
  adds port 80 to public zone
firewall-cmd --zone=public --add-service=http --permanent
  adds service http to public zone
firewall-cmd --reload
  run this after making changes
firewall-cmd --zone=public --remove-port=80/tcp --permanent
  to remove port 80 from public zone
firewall-cmd --get-default-zone
  shows default zone for firewall
firewall-cmd --get-active-zones
  zones where network interfaces or sources are assigned
| improve this answer | |

A quicker way of disabling firewalld is the following.

 systemctl disable firewalld

this removes the .service so you should get something similar to

rm '/etc/systemd/system/basic.target.wants/firewalld.service'
rm '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'
| improve this answer | |
  • Doesn't add much to the accepted answer, though. – Deer Hunter Jan 3 '15 at 7:24
  • You also need to stop firewalld or reboot: :) – user277307 Mar 19 '15 at 22:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.