81

I would like to open port 4567 for the IP address 1.2.3.4 with the firewall-cmd command on a CentOS 7.1 server.

How can I achieve this, as the documentation I could find was too specific on this?

Improve this question
1
  • First install and start firewalld service sudo yum install -y firewalld && sudo systemctl start firewalld. Then open port 80 and 443 (and ssh 22 for remote shell if needed) (use --permanent flag to keep changes after system reboot) sudo firewall-cmd --zone=public --permanent --add-port=80/tcp && sudo firewall-cmd --zone=public --permanent --add-port=443/tcp && sudo firewall-cmd --zone=public --permanent --add-port=22/tcp. Then reload firewalld service to activate new configuration sudo systemctl reload firewalld.
    – Takman
    Mar 15, 2021 at 7:47

2 Answers 2

Reset to default
102

Try this command

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  source address="1.2.3.4/32"
  port protocol="tcp" port="4567" accept'

Check the zone file later to inspect the XML configuration

cat /etc/firewalld/zones/public.xml

Reload the firewall

firewall-cmd --reload
Improve this answer
8
  • 1
    That's exactly what I was looking for, thanks for your useful and simple answer!
    – Michaël Perrin
    Apr 22, 2015 at 10:10
  • 1
    The change won't take place immediately unless you subsequently run filewall-cmd reload
    – Mike S
    May 11, 2016 at 15:37
  • 3
    The correct way to reload is actually: firewall-cmd --reload
    – k00k
    May 19, 2016 at 22:50
  • 3
    While this solution will work, @michael-hampton's solution is the most firewalld-esque way to do this. In my opinion, rich rules should be used as a last resort when there are no better ways to do something.
    – totokaka
    Oct 10, 2017 at 19:10
  • 5
    I completed the RHCSA much after this answer, and I agree. Avoiding rich rules would lead to a more maintainable configuration down the line.
    – Vasili Syrakis
    Oct 10, 2017 at 20:13
88

Create a new zone to accommodate this configuration. FirewallD zones are defined by source addresses and by interfaces.

firewall-cmd --new-zone=special --permanent
firewall-cmd --reload
firewall-cmd --zone=special --add-source=192.0.2.4/32
firewall-cmd --zone=special --add-port=4567/tcp

Add --permanent of course to the latter two commands to make them permanent.

Improve this answer
8
  • 7
    This should be the accepted answer.
    – Achilles
    Aug 30, 2018 at 22:50
  • 3
    Agreed, this is the best answer IMHO. In order to list that zone, use firewall-cmd --list-all-zones. Also, you may want to add --permanent to both --add statements.
    – Orsiris de Jong
    May 28, 2019 at 14:10
  • I agree with this as well, this should be the accepted answer.
    – sykez
    Jun 12, 2020 at 9:46
  • This is perfect!
    – Jesús Cota
    Aug 31, 2020 at 21:39
  • this should be the accepted answer
    – Abdennour TOUMI
    Nov 19, 2021 at 9:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.