Had a port opened up to for public use using firewall-cmd, I wanted to limit this port to a specific IP which I found the answer for on this SITE.

I used the following to open it:

$ firewall-cmd --permanent --zone=public --add-port=10050/tcp
$ firewall-cmd --reload

Now using the information from the information I found I wanted to restrict access to this port to a specific IP address. Do I need to first remove this port from public access?

Or Can I just just add the new rule as follows and that will take care of the problem for me?

$ firewall-cmd --new-zone=special
$ firewall-cmd --permanent --zone=special --add-rich-rule='
  rule family="ipv4"
  source address=”"
  port protocol="tcp" port="10050" accept'

I have tried the following:

$ firewall-cmd --zone=public --remove-port=10050/tcp
$ firewall-cmd --reload

But when I run the following:

$ firewall-cmd --list-ports 

10050/tcp is still displayed.

Please understand I'm not overly familiar with Sever side configurations.

Soultion: Do not forget the --runtime-to-permanent

$ firewall-cmd --zone=public --remove-port=10050/tcp
$ firewall-cmd --runtime-to-permanent
$ firewall-cmd --reload 
  • Ah I forgot the --permanent – mcv Dec 6 '16 at 13:11
  • 1
    You should post this as an answer (and accept it). It is perfectly acceptable to accept your own answers, this way the question is marked as solved. – Gerald Schneider Dec 6 '16 at 13:18
  • 1
    It's better to not use --permanent, in case you make a mistake with a firewall rule. If you used --permanent and locked yourself out, you will find it quite difficult to get back in, since you have no way to recover. Instead, don't use --permanent, and when you are happy with the rules, use firewall-cmd --runtime-to-permanent to commit the rules. If you get locked out, reloading the firewall or rebooting will go back. – Michael Hampton Dec 7 '16 at 1:56
  • So can this firewall-cmd --runtime-to-permanent is applied after the firewall-cmd --reload or does it replace it entirely? I am going to definitely try this. – mcv Dec 7 '16 at 17:04

Solution: Do not forget the --runtime-to-permanent

$ firewall-cmd --zone=public --remove-port=10050/tcp
$ firewall-cmd --runtime-to-permanent 
$ firewall-cmd --reload 
  • 1
    I still had to follow with systemctl restart firewalld. – JaKu Oct 13 '17 at 10:20
  • This did not work for me. systemctl is version 219 and firewall-cmd is version 0.5.3 on CentOS 7.5 64bit. – FilBot3 Mar 1 '19 at 23:18
# firewall-cmd --zone=public --remove-port=12345/tcp --permanent
# firewall-cmd --reload

Replace 12345 with the port you want to remove.

  • 1
    I read somewhere that in Fedora doc, it suggests to put --permanent as the first option. But yes, --permanent is the key. – WesternGun Dec 14 '17 at 15:12
  • I usually keep it as the last option to ensure that if the rule is incorrect for whatever reason, I can simply reboot without making the rule permanent. If it does what I want, I can up-arrow and add --permanent to the end. – Justin E Feb 10 '18 at 2:04

Follow these steps, you will be fine:

  1. $ firewall-cmd --zone=public --remove-port=10050/tcp
  2. $ firewall-cmd --runtime-to-permanent
  3. $ firewall-cmd --reload
  4. $ systemctl restart firewalld
  5. $ firewall-cmd --zone=public --list-ports
  • I don't think you need to restart firewalld, firewalld was actually designed to avoid restarting all the services every time you change a configuration. – vdegenne Apr 25 '18 at 23:08
  • actually for me only restart helped. – Boris Ivanov Jun 8 '20 at 18:39
  • For me firewall-cmd --zone=public --remove-port=1883/tcp --permanent followed by a rfirewall-cmd --reload was the effective sequence – djna Jul 19 '20 at 10:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.