75

I would like to open port 4567 for the IP address 1.2.3.4 with the firewall-cmd command on a CentOS 7.1 server.

How can I achieve this, as the documentation I could find was too specific on this?

91

Try this command

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  source address="1.2.3.4/32"
  port protocol="tcp" port="4567" accept'

Check the zone file later to inspect the XML configuration

cat /etc/firewalld/zones/public.xml

Reload the firewall

firewall-cmd --reload
| improve this answer | |
  • 1
    That's exactly what I was looking for, thanks for your useful and simple answer! – Michaël Perrin Apr 22 '15 at 10:10
  • 1
    The change won't take place immediately unless you subsequently run filewall-cmd reload – Mike S May 11 '16 at 15:37
  • 3
    The correct way to reload is actually: firewall-cmd --reload – k00k May 19 '16 at 22:50
  • 3
    While this solution will work, @michael-hampton's solution is the most firewalld-esque way to do this. In my opinion, rich rules should be used as a last resort when there are no better ways to do something. – totokaka Oct 10 '17 at 19:10
  • 4
    I completed the RHCSA much after this answer, and I agree. Avoiding rich rules would lead to a more maintainable configuration down the line. – Vasili Syrakis Oct 10 '17 at 20:13
80

Create a new zone to accommodate this configuration. FirewallD zones are defined by source addresses and by interfaces.

firewall-cmd --new-zone=special --permanent
firewall-cmd --reload
firewall-cmd --zone=special --add-source=192.0.2.4/32
firewall-cmd --zone=special --add-port=4567/tcp

Add --permanent of course to the latter two commands to make them permanent.

| improve this answer | |
  • 5
    This should be the accepted answer. – Achilles Aug 30 '18 at 22:50
  • 2
    Agreed, this is the best answer IMHO. In order to list that zone, use firewall-cmd --list-all-zones. Also, you may want to add --permanent to both --add statements. – Orsiris de Jong May 28 '19 at 14:10
  • I agree with this as well, this should be the accepted answer. – sykez Jun 12 at 9:46
  • This is perfect! – jesuscc29 Aug 31 at 21:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.