firewalld port helper
Choose a port or service and who may connect; get the firewall-cmd commands, how to check them and how to undo them.
Last updated
In short: To open a port for everyone with firewalld, run sudo firewall-cmd --permanent --zone=public --add-port=8080/tcp and then sudo firewall-cmd --reload. To allow only your LAN, use a rich rule: --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" accept'. Check with sudo firewall-cmd --list-all, and use sudo ss -tulpn to confirm a program really listens on that port.
Your input never leaves your browser. Everything is calculated on your device; nothing you type is sent to a server.
- A rich rule only adds access. If --list-all already shows this port under ports:, it is open to everyone anyway: remove that entry once the rich rule works.
Step 1: find the zone of your network connection
firewalld puts every network connection in a zone, and each zone has its own rules. The commands use the public zone; if your connection is in another zone, change the zone field above.
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=public --list-all--get-active-zones- Lists the zones in use and which network interfaces (eth0, enp3s0, wlan0...) belong to each.
--zone=public --list-all- Shows what that zone allows now, under services:, ports: and rich rules:.
Step 2: open it permanently
Opens port 8080/tcp only for machines in 192.168.1.0/24, and keeps it after a reboot.
sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" accept'
sudo firewall-cmd --reload--permanent- Saves the rule in the configuration on disk. It becomes active only after --reload or a reboot.
--zone=public- Adds the rule to the public zone. Without --zone, firewalld uses the default zone.
--add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" accept'- A rich rule: accept 8080/tcp only when the sender's address is in 192.168.1.0/24. family="ipv4" means IPv4. Everyone else stays blocked.
sudo firewall-cmd --reload- Loads the saved configuration, so the new rule is active now. Open connections stay up.
Step 3: check it
sudo firewall-cmd --zone=public --list-all
sudo ss -tulpn--list-all- The rule appears under rich rules:.
sudo ss -tulpn- Lists the programs that listen, with their ports (t = TCP, u = UDP, l = listening, p = program, n = numbers); look for :8080. If the address is 127.0.0.1 or [::1], the program only accepts connections from this machine itself, and no firewall rule changes that: fix the program's listen address instead.
Or: try it first, until the next reload
Without --permanent a rule works at once but disappears at the next reload or reboot, which makes it a safe test. When everything works, save the running rules.
sudo firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" accept'
sudo firewall-cmd --runtime-to-permanent(no --permanent)- Changes only the running firewall; nothing is saved.
--runtime-to-permanent- Saves everything that is running now as the permanent configuration. Run it only when you are happy with the result.
Close it again
sudo firewall-cmd --permanent --zone=public --remove-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" accept'
sudo firewall-cmd --reload--remove-rich-rule- Removes exactly the rule that was added; the text must match.
On Debian or Ubuntu with ufw instead
Ubuntu uses ufw rather than firewalld. ufw rules are permanent at once, no reload needed. If ufw is not enabled yet, allow SSH first (sudo ufw allow 22/tcp) and only then run sudo ufw enable, or you cut off your own SSH session.
sudo ufw allow from 192.168.1.0/24 to any port 8080 proto tcp
sudo ufw status verbosesudo ufw allow from 192.168.1.0/24 to any port 8080 proto tcp- Allows the port only from 192.168.1.0/24; "to any" means any address of this machine.
sudo ufw status verbose- Lists the rules and the default policy.
Review generated files before you use them. Provided as-is — see Terms.
How does the firewalld port helper work?
firewalld is the firewall on openSUSE, Fedora, RHEL and their relatives, controlled with
firewall-cmd. It blocks incoming connections unless a rule allows them. Rules live in
zones: every network connection belongs to one zone (usually public on a
server), and a zone lists the services and ports it accepts. A service
is a named set of ports, such as https for 443/tcp; firewall-cmd --get-services
lists them all (firewall-cmd(1), firewalld.zone(5)).
--add-port and --add-service open something for every machine that can reach
yours. To allow only your home network or one address, you need a rich rule, a small
sentence such as rule family="ipv4" source address="192.168.1.0/24" port port="8080"
protocol="tcp" accept (firewalld.richlanguage(5)). A rich rule only adds access, so check that the
same port is not also opened for everyone.
firewalld keeps two configurations. The runtime one is active now; the
permanent one is saved and loaded at boot. Commands with --permanent change
the saved one and need firewall-cmd --reload to take effect; commands without it work at once
and vanish at the next reload, which makes them a safe way to test.
A firewall rule is only half the story: a program must also listen on the port, on an address other than
127.0.0.1. ss -tulpn shows exactly that. Debian and Ubuntu use ufw instead of
firewalld, so every result includes the matching ufw commands. All commands are built in your
browser; nothing you type is sent anywhere.
Worked examples
A web app on port 8080, only for the home network
Input Port 8080/tcp, only my network 192.168.1.0/24, zone public gives sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" accept'
The rich rule accepts port 8080 only from senders whose address is in 192.168.1.0/24, so phones and laptops at home can reach the app but the rest of the world cannot, even if the router forwards the port by mistake. --permanent saves it, and the following sudo firewall-cmd --reload activates it.
HTTPS for everyone, for a reverse proxy
Input Service https, everyone, zone public gives sudo firewall-cmd --permanent --zone=public --add-service=https
The https service is firewalld's name for 443/tcp, which reads better in --list-all than a bare number. Everyone still only includes the internet if your router forwards port 443 to this machine. For HTTP/3 you would also open 443/udp.
SSH only from one admin laptop
Input Service ssh, only 192.168.1.50 gives rule family="ipv4" source address="192.168.1.50" service name="ssh" accept
The rich rule lets 192.168.1.50 in, but the public zone allows ssh for everyone by default, so on its own it changes nothing. After logging in from the laptop, remove the general entry with --remove-service=ssh. The helper warns about this order, because doing it the other way round locks you out.
Frequently asked questions
What is the difference between --permanent and runtime rules in firewalld?
firewalld keeps two configurations. The runtime configuration is what is active now; the permanent one is saved on disk and loaded at boot and at every firewall-cmd --reload. A command without --permanent changes only the runtime, so it works at once and is gone after a reload or reboot, which is handy for testing. A command with --permanent changes only the saved configuration, so you need --reload to activate it. sudo firewall-cmd --runtime-to-permanent saves what is running now.
How do I allow a port only from my local network with firewalld?
Use a rich rule with a source address: sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="8080" protocol="tcp" accept', then sudo firewall-cmd --reload. Make sure the port is not also listed under ports: in --list-all, because a plain --add-port opens it for everyone and the rich rule then adds nothing. The alternative is to bind your LAN range to its own zone with --add-source, which is tidier when you allow many services from the same network.
Which firewalld zone should I use?
The zone your network connection is in, shown by sudo firewall-cmd --get-active-zones. On openSUSE and Fedora servers that is usually public, the default zone. If you put the rule in a zone that has no interface or source bound to it, the command succeeds but nothing changes, which is a common reason for 'I opened the port and it is still closed'.
I opened the port but still cannot connect. What now?
Check three things in order. Does a program listen: sudo ss -tulpn must show the port, and the address must be 0.0.0.0, [::] or the server's LAN address, not 127.0.0.1, which only accepts local connections. Is the rule active in the right zone: check sudo firewall-cmd --get-active-zones and --list-all for that zone, and whether you ran --reload after --permanent. From outside your home: does the router forward the port to this machine? Test from another machine with nc -zv followed by the server's address and the port.
What is the ufw equivalent of firewall-cmd --add-port?
On Debian and Ubuntu, sudo ufw allow 8080/tcp opens a port for everyone and sudo ufw allow from 192.168.1.0/24 to any port 8080 proto tcp only for the LAN; ufw rules are saved at once, without a reload. Before sudo ufw enable, allow SSH with sudo ufw allow 22/tcp, or you cut off your own session. Note that Docker publishes container ports past ufw's rules, a known limitation described in Docker's own documentation.