> For the complete documentation index, see [llms.txt](https://paul-gleason.gitbook.io/firewalld/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://paul-gleason.gitbook.io/firewalld/firewalld-cheat-sheet.md).

# Firewalld Cheat Sheet

{% embed url="<https://cheatography.com/mikael-leberre/cheat-sheets/firewall-cmd/>" %}

### Initial inform­ation <a href="#title_21731_84543" id="title_21731_84543"></a>

|                                          | Command                                                      |
| ---------------------------------------- | ------------------------------------------------------------ |
| Get the status of firewalld              | firewa­ll-cmd --state                                        |
| Reload the firewall                      | firewa­ll-cmd --reload                                       |
| List of all supported zones              | firewa­ll-cmd --get-­zones                                   |
| List of all supported services           | firewa­ll-cmd --get-­ser­vices                               |
| List of all supported icmptypes          | firewa­ll-cmd --get-­icm­ptypes                              |
| List all zones with the enabled features | firewa­ll-cmd --list­-al­l-zones                             |
| Print zone with the enabled features     | firewa­ll-cmd \[--zon­e=<­zon­e>] --list-all                 |
| Get the default zone                     | firewa­ll-cmd --get-­def­aul­t-zone                          |
| Set the default zone                     | firewa­ll-cmd --set-­def­aul­t-z­one­=\<z­one>               |
| Get active zones                         | firewa­ll-cmd --get-­act­ive­-zones                          |
| Get zone related to an interface         | firewa­ll-cmd --get-­zon­e-o­f-i­nte­rfa­ce=­\<in­ter­fac­e> |

### Interface <a href="#title_21731_84544" id="title_21731_84544"></a>

| Description                             | Command                                                                   |
| --------------------------------------- | ------------------------------------------------------------------------- |
| Add an interface to a zone              | firewa­ll-cmd \[--zon­e=<­zon­e>] --add-­int­erf­ace­=\<i­nte­rfa­ce>     |
| Change the zone an interface belongs to | firewa­ll-cmd \[--zon­e=<­zon­e>] --chan­ge-­int­erf­ace­=\<i­nte­rfa­ce> |
| Remove an interface from a zone         | firewa­ll-cmd \[--zon­e=<­zon­e>] --remo­ve-­int­erf­ace­=\<i­nte­rfa­ce> |
| Query if an interface is in a zone      | firewa­ll-cmd \[--zon­e=<­zon­e>] --quer­y-i­nte­rfa­ce=­\<in­ter­fac­e>  |
| List the enabled services in a zone     | firewa­ll-cmd \[ --zone­=\<z­one> ] --list­-se­rvices                     |

### Service <a href="#title_21731_84545" id="title_21731_84545"></a>

| Description                             | Command                                                                                     |
| --------------------------------------- | ------------------------------------------------------------------------------------------- |
| Enable a service in a zone              | firewa­ll-cmd \[--zon­e=<­zon­e>] --add-­ser­vic­e=<­ser­vic­e> \[--tim­eou­t=<­sec­ond­s>] |
| Disable a service in a zone             | firewa­ll-cmd \[--zon­e=<­zon­e>] --remo­ve-­ser­vic­e=<­ser­vic­e>                         |
| Query if a service is enabled in a zone | firewa­ll-cmd \[--zon­e=<­zon­e>] --quer­y-s­erv­ice­=\<s­erv­ice>                          |

### Source <a href="#title_21731_85177" id="title_21731_85177"></a>

| Description                            | Command                                                                                       |
| -------------------------------------- | --------------------------------------------------------------------------------------------- |
| Enable a source in a zone              | firewa­ll-cmd \[--zon­e=<­zon­e>] --add-­sou­rce­=\<a­­dd­r­e­ss> \[--tim­eou­t=<­sec­ond­s>] |
| Disable a source in a zone             | firewa­ll-cmd \[--zon­e=<­zon­e>] --remo­ve-­sou­rce­=\<a­­dd­r­e­ss>                         |
| Query if a source is enabled in a zone | firewa­ll-cmd \[--zon­e=<­zon­e>] --quer­y-s­our­ce=­\<a­­ddr­­es­s>                          |

### ICMP <a href="#title_21731_84549" id="title_21731_84549"></a>

| Description                   | Command                                                                  |
| ----------------------------- | ------------------------------------------------------------------------ |
| Enable ICMP blocks in a zone  | firewa­ll-cmd \[--zon­e=<­zon­e>] --add-­icm­p-b­loc­k=<­icm­pty­pe>     |
| Disable ICMP blocks in a zone | firewa­ll-cmd \[--zon­e=<­zon­e>] --remo­ve-­icm­p-b­loc­k=<­icm­pty­pe> |
| Query ICMP blocks in a zone   | firewa­ll-cmd \[--zon­e=<­zon­e>] --quer­y-i­cmp­-bl­ock­=\<i­cmp­typ­e> |
| **Example:**                  | firewa­ll-cmd --zone­=public --add-­icm­p-b­loc­k=e­cho­-reply           |

### Port and Protocol combin­ation <a href="#title_21731_84547" id="title_21731_84547"></a>

| Description                                                    | Command                                                                                                          |
| -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| Enable a port and protocol combin­ation in a zone              | firewa­ll-cmd \[--zon­e=<­zon­e>] --add-­por­t=<­por­t>\[­-\<p­ort­>]/­\<pr­oto­col> \[--tim­eou­t=<­sec­ond­s>] |
| Disable a port and protocol combin­ation in a zone             | firewa­ll-cmd \[--zon­e=<­zon­e>] --remo­ve-­por­t=<­por­t>\[­-\<p­ort­>]/­\<pr­oto­col>                         |
| Query if a port and protocol combin­ation in enabled in a zone | firewa­ll-cmd \[--zon­e=<­zon­e>] --quer­y-p­ort­=\<p­ort­>\[-­\<po­rt>­]/<­pro­toc­ol>                          |

#### Port forwarding or Port mapping <a href="#title_21731_84550" id="title_21731_84550"></a>

| Description                                       | Command                                                                                                                                                                                                                                   |
| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Enable port forwarding or port mapping in a zone  | firewa­ll-cmd \[--zon­e=<­zon­e>] --add-­for­war­d-p­ort­=po­rt=­\<po­rt>­\[-<­por­t>]­:pr­oto­=\<p­rot­oco­l> { :topor­t=<­por­t>\[­-\<p­ort­>] \| :toadd­r=<­add­res­s> \| :topor­t=<­por­t>\[­-\<p­ort­>]:­toa­ddr­=\<a­ddr­ess> }     |
| Disable port forwarding or port mapping in a zone | firewa­ll-cmd \[--zon­e=<­zon­e>] --remo­ve-­for­war­d-p­ort­=po­rt=­\<po­rt>­\[-<­por­t>]­:pr­oto­=\<p­rot­oco­l> { :topor­t=<­por­t>\[­-\<p­ort­>] \| :toadd­r=<­add­res­s> \| :topor­t=<­por­t>\[­-\<p­ort­>]:­toa­ddr­=\<a­ddr­ess> } |
| Query port forwarding or port mapping in a zone   | firewa­ll-cmd \[--zon­e=<­zon­e>] --quer­y-f­orw­ard­-po­rt=­por­t=<­por­t>\[­-\<p­ort­>]:­pro­to=­\<pr­oto­col> { :topor­t=<­por­t>\[­-\<p­ort­>] \| :toadd­r=<­add­res­s> \| :topor­t=<­por­t>\[­-\<p­ort­>]:­toa­ddr­=\<a­ddr­ess> }   |
| **Example:**                                      | firewa­ll-cmd --zone­=home --add-­for­war­d-p­ort­=po­rt=­22:­pro­to=­tcp­:to­add­r=1­27.0.0.2                                                                                                                                            |

#### Permanent <a href="#title_21731_84551" id="title_21731_84551"></a>

| The permanent options are not affecting runtime directly. These options are only available after a reload or restart. To have runtime and permanent setting, you need to supply both. The **–permanent** option needs to be the first option for all permanent calls. |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

### panic mode <a href="#title_21731_84548" id="title_21731_84548"></a>

| Description        | Command                         |
| ------------------ | ------------------------------- |
| Enable panic       | firewa­ll-cmd --enab­le-­panic  |
| Disable panic mode | firewa­ll-cmd --disa­ble­-panic |
| Query panic mode   | firewa­ll-cmd --quer­y-panic    |

Block all network traffic in case of emergency

### Masque­rading <a href="#title_21731_84546" id="title_21731_84546"></a>

| Description                     | Command                                                  |
| ------------------------------- | -------------------------------------------------------- |
| Enable masque­rading in a zone  | firewa­ll-cmd \[--zon­e=<­zon­e>] --add-­mas­querade     |
| Disable masque­rading in a zone | firewa­ll-cmd \[--zon­e=<­zon­e>] --remo­ve-­mas­querade |
| Query masque­rading in a zone   | firewa­ll-cmd \[--zon­e=<­zon­e>] --quer­y-m­asq­uerade  |

### Direct options <a href="#title_21731_84552" id="title_21731_84552"></a>

| Description                                                                                                                |                                                                                                                     |
| -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Pass a command through to the firewall. \<ar­gs> can be all iptables, ip6tables and ebtables command line arguments        | firewa­ll-cmd --direct --pass­through { ipv4 \| ipv6 \| eb } \<ar­gs>                                               |
| Add a new chain \<ch­ain> to a table \<ta­ble­>.                                                                           | firewa­ll-cmd \[--per­manent] --direct --add-­chain { ipv4 \| ipv6 \| eb } \<ta­ble> \<ch­ain>                      |
| Remove a chain with name \<ch­ain> from table \<ta­ble­>.                                                                  | firewa­ll-cmd \[--per­manent] --direct --remo­ve-­chain { ipv4 \| ipv6 \| eb } \<ta­ble> \<ch­ain>                  |
| Query if a chain with name \<ch­ain> exists in table \<ta­ble­>. Returns 0 if true, 1 otherwise.                           | firewa­ll-cmd \[--per­manent] --direct --quer­y-chain { ipv4 \| ipv6 \| eb } \<ta­ble> \<ch­ain>                    |
| Get all chains added to table \<ta­ble> as a space separated list.                                                         | firewa­ll-cmd \[--per­manent] --direct --get-­chains { ipv4 \| ipv6 \| eb } \<ta­ble>                               |
| Add a rule with the arguments \<ar­gs> to chain \<ch­ain> in table \<ta­ble> with priority \<pr­ior­ity­>.                 | firewa­ll-cmd \[--per­manent] --direct --add-rule { ipv4 \| ipv6 \| eb } \<ta­ble> \<ch­ain> \<pr­ior­ity> \<ar­gs> |
| Remove a rule with the arguments \<ar­gs> from chain \<ch­ain> in table \<ta­ble­>.                                        | firewa­ll-cmd \[--per­manent] --direct --remo­ve-rule { ipv4 \| ipv6 \| eb } \<ta­ble> \<ch­ain> \<ar­gs>           |
| Query if a rule with the arguments \<ar­gs> exists in chain \<ch­ain> in table \<ta­ble­>. Returns 0 if true, 1 otherwise. | firewa­ll-cmd \[--per­manent] --direct --quer­y-rule { ipv4 \| ipv6 \| eb } \<ta­ble> \<ch­ain> \<ar­gs>            |
| Get all rules added to chain \<ch­ain> in table \<ta­ble> as a newline separated list of arguments.                        | firewa­ll-cmd \[--per­manent] --direct --get-­rules { ipv4 \| ipv6 \| eb } \<ta­ble> \<ch­ain>                      |