I opened a port for ftp but I want to close it. I tried

firewall-cmd --zone=public --remove-port=21/tcp --permanent

firewall-cmd --runtime-to-permanent

firewall-cmd --reload

For the first command, I also tried firewall-cmd --zone=public --service=ftp --remove-port=21/tcp --permanent

But I stll get

  # firewall-cmd --list-all

public (active)

  target: default

  icmp-block-inversion: no

  interfaces: enp1s0


  services: ssh dhcpv6-client ftp

  ports: 21/tcp


  masquerade: no




  rich rules:

=========== What am I doing wrong?

Thanks /j


In your first firewalld command, you change the permanent configuration and not the running configuration.

In your second command, you then undo your change by overwriting the permanent configuration with the running configuration.

Because of this, at no time did the allowed port ever get removed from the running configuration.

You may solve this by removing the port from the running configuration, by not using --permanent, and then making it permanent with --runtime-to-peramnent as you had done.

  • Unfortunately, that comment without --permanent yields an error "option can be used only with --permanent'. But I get what you say. So I tried only the first and 3rd commands. No luck though. It says "warning: NOT_ENABLED 21:tcp", but I still get the same result from list-all and the port still works. [I had tried a number of different ways of doing this but didn't post all of them - something else is going on?] – jeffw_00 Dec 16 '17 at 20:54
  • That should certainly work without --permanent. Exactly what did you attempt to run? – Michael Hampton Dec 16 '17 at 20:59

Correct solution to remove the port

firewall-cmd --remove-port=21/tcp --permanent firewall-cmd --reload

ftp is a built-in service so can't remove it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.