63

This question already has an answer here:

I would like to open port 4567 for the IP address 1.2.3.4 with the firewall-cmd command on a CentOS 7.1 server.

How can I achieve this, as the documentation I could find was too specific on this?

marked as duplicate by Michael Hampton centos Feb 24 '17 at 21:23

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

85

Try this command

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  source address="1.2.3.4/32"
  port protocol="tcp" port="4567" accept'

Check the zone file later to inspect the XML configuration

cat /etc/firewalld/zones/public.xml

Reload the firewall

firewall-cmd --reload
  • 1
    That's exactly what I was looking for, thanks for your useful and simple answer! – Michaël Perrin Apr 22 '15 at 10:10
  • 1
    The change won't take place immediately unless you subsequently run filewall-cmd reload – Mike S May 11 '16 at 15:37
  • 3
    The correct way to reload is actually: firewall-cmd --reload – k00k May 19 '16 at 22:50
  • 2
    While this solution will work, @michael-hampton's solution is the most firewalld-esque way to do this. In my opinion, rich rules should be used as a last resort when there are no better ways to do something. – totokaka Oct 10 '17 at 19:10
  • 3
    I completed the RHCSA much after this answer, and I agree. Avoiding rich rules would lead to a more maintainable configuration down the line. – Vasili Syrakis Oct 10 '17 at 20:13
59

Create a new zone to accommodate this configuration. FirewallD zones are defined by source addresses and by interfaces.

firewall-cmd --new-zone=special --permanent
firewall-cmd --reload
firewall-cmd --zone=special --add-source=192.0.2.4/32
firewall-cmd --zone=special --add-port=4567/tcp

Add --permanent of course to the latter two commands to make them permanent.

  • 2
    This should be the accepted answer. – Achilles Aug 30 '18 at 22:50
  • Agreed, this is the best answer IMHO. In order to list that zone, use firewall-cmd --list-all-zones. Also, you may want to add --permanent to both --add statements. – Orsiris de Jong May 28 at 14:10

Not the answer you're looking for? Browse other questions tagged or ask your own question.