26

Had a port opened up to for public use using firewall-cmd, I wanted to limit this port to a specific IP which I found the answer for on this SITE.

I used the following to open it:

$ firewall-cmd --permanent --zone=public --add-port=10050/tcp
$ firewall-cmd --reload

Now using the information from the information I found I wanted to restrict access to this port to a specific IP address. Do I need to first remove this port from public access?

Or Can I just just add the new rule as follows and that will take care of the problem for me?

$ firewall-cmd --new-zone=special
$ firewall-cmd --permanent --zone=special --add-rich-rule='
  rule family="ipv4"
  source address=”123.1.1.1"
  port protocol="tcp" port="10050" accept'

I have tried the following:

$ firewall-cmd --zone=public --remove-port=10050/tcp
$ firewall-cmd --reload

But when I run the following:

$ firewall-cmd --list-ports 

10050/tcp is still displayed.

Please understand I'm not overly familiar with Sever side configurations.

Soultion: Do not forget the --runtime-to-permanent

$ firewall-cmd --zone=public --remove-port=10050/tcp
$ firewall-cmd --runtime-to-permanent
$ firewall-cmd --reload 
4
  • Ah I forgot the --permanent
    – mcv
    Dec 6, 2016 at 13:11
  • 1
    You should post this as an answer (and accept it). It is perfectly acceptable to accept your own answers, this way the question is marked as solved. Dec 6, 2016 at 13:18
  • 1
    It's better to not use --permanent, in case you make a mistake with a firewall rule. If you used --permanent and locked yourself out, you will find it quite difficult to get back in, since you have no way to recover. Instead, don't use --permanent, and when you are happy with the rules, use firewall-cmd --runtime-to-permanent to commit the rules. If you get locked out, reloading the firewall or rebooting will go back. Dec 7, 2016 at 1:56
  • So can this firewall-cmd --runtime-to-permanent is applied after the firewall-cmd --reload or does it replace it entirely? I am going to definitely try this.
    – mcv
    Dec 7, 2016 at 17:04

5 Answers 5

48

Solution: Do not forget the --runtime-to-permanent

$ firewall-cmd --zone=public --remove-port=10050/tcp
$ firewall-cmd --runtime-to-permanent 
$ firewall-cmd --reload 
2
  • 1
    I still had to follow with systemctl restart firewalld.
    – JaKu
    Oct 13, 2017 at 10:20
  • This did not work for me. systemctl is version 219 and firewall-cmd is version 0.5.3 on CentOS 7.5 64bit.
    – FilBot3
    Mar 1, 2019 at 23:18
13
# firewall-cmd --zone=public --remove-port=12345/tcp --permanent
# firewall-cmd --reload

Replace 12345 with the port you want to remove.

2
  • 1
    I read somewhere that in Fedora doc, it suggests to put --permanent as the first option. But yes, --permanent is the key.
    – WesternGun
    Dec 14, 2017 at 15:12
  • I usually keep it as the last option to ensure that if the rule is incorrect for whatever reason, I can simply reboot without making the rule permanent. If it does what I want, I can up-arrow and add --permanent to the end.
    – Justin E
    Feb 10, 2018 at 2:04
3

Follow these steps, you will be fine:

$ firewall-cmd --zone=public --remove-port=10050/tcp
$ firewall-cmd --runtime-to-permanent 
$ firewall-cmd --reload 
$ systemctl restart firewalld
$ firewall-cmd --zone=public --list-ports
3
  • I don't think you need to restart firewalld, firewalld was actually designed to avoid restarting all the services every time you change a configuration.
    – vdegenne
    Apr 25, 2018 at 23:08
  • actually for me only restart helped. Jun 8, 2020 at 18:39
  • For me firewall-cmd --zone=public --remove-port=1883/tcp --permanent followed by a rfirewall-cmd --reload was the effective sequence
    – djna
    Jul 19, 2020 at 10:00
2

Please Running these step

  1. firewall-cmd --permanent --remove-service=telnet
  2. firewall-cmd --reload
  3. systemctl restart firewalld.service
  4. firewall-cmd --list-all
  5. iptables -nvL

your iptables firewalld willbe not showed service telnet

Regards

1

All those answers were wrong on my fedora server. My solution was:

firewall-cmd --remove-port=8081/tcp --permanent
firewall-cmd --reload
firewall-cmd --list-all

Please note that the command firewall-cmd --permanent --remove-port=8081/tcp was throwing an error "firewall-cmd: error: unrecognized arguments: –-remove-port=8081/tcp".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .