This question already has an answer here:

I would like to open port 4567 for the IP address with the firewall-cmd command on a CentOS 7.1 server.

How can I achieve this, as the documentation I could find was too specific on this?

marked as duplicate by Michael Hampton centos Feb 24 '17 at 21:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Try this command

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  source address=""
  port protocol="tcp" port="4567" accept'

Check the zone file later to inspect the XML configuration

cat /etc/firewalld/zones/public.xml

Reload the firewall

firewall-cmd --reload
  • 1
    That's exactly what I was looking for, thanks for your useful and simple answer! – Michaël Perrin Apr 22 '15 at 10:10
  • 1
    The change won't take place immediately unless you subsequently run filewall-cmd reload – Mike S May 11 '16 at 15:37
  • 3
    The correct way to reload is actually: firewall-cmd --reload – k00k May 19 '16 at 22:50
  • 1
    I think you should be using single quotes after --add-rich-rule='rule family="ipv4" source address="" port protocol="tcp" port="4567" accept' – Basil A Jun 17 '16 at 19:40
  • 2
    I completed the RHCSA much after this answer, and I agree. Avoiding rich rules would lead to a more maintainable configuration down the line. – Vasili Syrakis Oct 10 '17 at 20:13

Create a new zone to accommodate this configuration. FirewallD zones are defined by source addresses and by interfaces.

firewall-cmd --new-zone=special --permanent
firewall-cmd --zone=special --add-source=
firewall-cmd --zone=special --add-port=4567/tcp

Add --permanent of course to the latter two commands to make them permanent.

  • This should be the accepted answer. – Achilles Aug 30 '18 at 22:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.