ExamFinch.com My Study

Study guide

17.4 Restrict Network Access Using firewalld and firewall-cmd

Practice this exam

Red Hat Certified System Administrator RHCSA

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Lab Setup & Performance-Based Study Strategy

2 Essential Tools: Shell, Redirection & Text Analysis

2.1 Shell Prompt and Command Syntax 2.2 Input-Output Redirection and Pipes 2.3 grep and Regular Expressions for Text Analysis

3 Essential Tools: Remote Access, Users & Text Editing

3.1 Access Remote Systems Using SSH 3.2 Log In and Switch Users in Multiuser Targets 3.3 Create and Edit Text Files

4 Essential Tools: Files, Links & Archives

4.1 Create, Delete, Copy, and Move Files and Directories 4.2 Hard and Soft Links 4.3 Archive and Compress with tar, gzip, and bzip2

5 Essential Tools: Permissions & System Documentation

5.1 List, Set, and Change Standard ugo/rwx Permissions 5.2 System Documentation: man, info, and /usr/share/doc

6 Manage Software: RPM and Flatpak

6.1 Configure Access to RPM Repositories 6.2 Install and Remove RPM Software Packages 6.3 Configure Access to Flatpak Repositories 6.4 Install and Remove Flatpak Software Packages

7 Create Simple Shell Scripts

7.1 Conditional Execution: if, test, and [] 7.2 Looping Constructs for Files and Input 7.3 Process Script Inputs ($1, $2, and Beyond) 7.4 Process Shell Command Output in Scripts

8 Operate Running Systems: Boot and Recovery

8.1 Boot, Reboot, and Shut Down a System Normally 8.2 Boot Systems into Different Targets Manually 8.3 Interrupt the Boot Process to Gain Access

9 Operate Running Systems: Processes and Tuning

9.1 Identify and Kill CPU/Memory Intensive Processes 9.2 Adjust Process Scheduling 9.3 Manage Tuning Profiles

10 Operate Running Systems: Logs, Services & File Transfer

10.1 Locate and Interpret System Log Files and Journals 10.2 Preserve System Journals 10.3 Start, Stop, and Check Status of Network Services 10.4 Securely Transfer Files Between Systems

11 Configure Local Storage: Partitions and LVM

11.1 List, Create, and Delete Partitions on GPT Disks 11.2 Create and Remove Physical Volumes 11.3 Assign Physical Volumes to Volume Groups 11.4 Create and Delete Logical Volumes

12 Configure Local Storage: Mounting and Expansion

12.1 Mount File Systems at Boot by UUID or Label 12.2 Add Partitions, Logical Volumes, and Swap Non-Destructively

13 Create and Configure File Systems: Local FS and Permissions

13.1 Create, Mount, and Use VFAT, ext4, and XFS File Systems 13.2 Extend Existing Logical Volumes 13.3 Diagnose and Correct File Permission Problems

14 Create and Configure File Systems: NFS and autofs

14.1 Mount and Unmount Network File Systems Using NFS 14.2 Configure autofs

15 Deploy and Maintain: Scheduling, Services & Targets

15.1 Schedule Tasks with at, cron, and systemd Timers 15.2 Start, Stop, and Enable Services at Boot 15.3 Configure Systems to Boot into a Specific Target

16 Deploy and Maintain: Time, Software Updates & Bootloader

16.1 Configure Time Service Clients 16.2 Install and Update Software from CDN, Remote Repos, and Local Files 16.3 Modify the System Bootloader

17 Manage Basic Networking

17.1 Configure IPv4 and IPv6 Addresses 17.2 Configure Hostname Resolution 17.3 Configure Network Services to Start Automatically at Boot 17.4 Restrict Network Access Using firewalld and firewall-cmd

18 Manage Users and Groups

18.1 Create, Delete, and Modify Local User Accounts 18.2 Change Passwords and Adjust Password Aging 18.3 Create, Delete, and Modify Local Groups and Memberships 18.4 Configure Privileged Access

19 Manage Security: Firewall, umask & SSH Keys

19.1 Configure Firewall Settings with firewall-cmd and firewalld 19.2 Manage Default File Permissions 19.3 Configure Key-Based Authentication for SSH

20 Manage Security: SELinux Modes and Contexts

20.1 Set Enforcing and Permissive Modes for SELinux 20.2 List and Identify SELinux File and Process Contexts 20.3 Restore Default File Contexts

21 Manage Security: SELinux Ports and Booleans

21.1 Manage SELinux Port Labels 21.2 Use Boolean Settings to Modify SELinux Settings

17.4 Restrict Network Access Using firewalld and firewall-cmd

Key Takeaways Explain This Topic AI

firewalld implements host firewall policy; manage it with firewall-cmd and ensure the firewalld service is running and enabled when permanent rules must apply after reboot.

Runtime vs permanent: --permanent writes lasting config; always firewall-cmd --reload (or --runtime-to-permanent patterns) so active policy matches what you saved.

Open access with --add-service=NAME or --add-port=PORT/PROTOCOL, optionally scoped to a zone; verify with --list-all and connection tests.

Zones (public, trusted, drop, etc.) define trust level and interfaces/sources; know the active zone for your NIC with firewall-cmd --get-active-zones.

This section meets the networking objective to restrict access; the security chapter deepens firewalld scenarios—here focus on service/port rules, zones, permanence, and reload.

Last updated: August 2026

17.4 Restrict Network Access Using firewalld and firewall-cmd

Quick Answer: Keep firewalld enabled and running . Allow needed traffic with firewall-cmd --permanent --add-service=… or --add-port=…/tcp , then firewall-cmd --reload . Check firewall-cmd --list-all (and active zones). Default zones restrict unsolicited inbound access; you open only what the task requires.

Objective scope (networking vs security)

Under Manage basic networking , you must restrict network access using firewalld/firewall-cmd . Typical tasks:

  • “Allow HTTP and HTTPS through the firewall permanently.”
  • “Open TCP port 8080 in the default zone.”
  • “Ensure firewalld is running and the ssh service is allowed.”

A later security chapter deepens firewalld (richer policy, tighter scenarios). Here , master the network-restrict essentials: daemon up, zones awareness, add-service/add-port , permanent + reload , and verification.

  • Start from a working firewalld systemctl status firewalld --no-pager
  • sudo systemctl enable --now firewalld
  • firewall-cmd --state
  • # should print: running

If firewalld is stopped, firewall-cmd fails and permanent rules do not protect or allow traffic as expected after boot. systemctl is-enabled firewalld

  • systemctl is-active firewalld
  • Runtime vs permanent vs reload

Mode Flag / action Survives reload? Survives reboot?

  • Runtime default firewall-cmd --add-… Until reload/restart may drop No (unless also permanent)
  • Permanent --permanent --add-… After --reload becomes active Yes (with firewalld enabled)

Reload firewall-cmd --reload Applies permanent set to runtime — # Runtime only (good for a quick test):

sudo firewall-cmd --add-service=http

# Permanent (exam default when “persist” is implied):

  • sudo firewall-cmd --permanent --add-service=http
  • sudo firewall-cmd --reload

Critical exam pattern:

Make changes with --permanent .

firewall-cmd --reload .

Verify with --list-all (runtime view after reload).

Forgetting reload is a top failure mode: permanent XML is updated but the running firewall still blocks (or still allows) the old set. # See permanent configuration without relying only on runtime:

  • firewall-cmd --permanent --list-all
  • firewall-cmd --list-all
  • Zones: trust buckets

firewalld organizes rules into zones . Interfaces (and/or sources) bind to a zone; the zone’s services/ports apply. firewall-cmd --get-zones

  • firewall-cmd --get-default-zone
  • firewall-cmd --get-active-zones
  • firewall-cmd --list-all
  • firewall-cmd --list-all-zones | less
  • Zone (examples) Typical idea
  • public Default-ish external: ssh often allowed, little else
  • trusted Accept most traffic (very open)
  • home / work / internal More services pre-associated
  • drop / block Highly restrictive inbound

dmz / external Specialized edge roles # Which zone is my NIC using?

  • firewall-cmd --get-active-zones
  • nmcli -f GENERAL.ZONE device show ens192 2>/dev/null
  • Add a service to a specific zone: sudo firewall-cmd --permanent --zone=public --add-service=http
  • sudo firewall-cmd --reload

If you omit --zone , commands use the default zone (or the zone context firewall-cmd applies—prefer being explicit when the task names a zone).

  • Change default zone (only when required): sudo firewall-cmd --set-default-zone=public
  • Assign interface to zone permanently: sudo firewall-cmd --permanent --zone=public --change-interface=ens192
  • sudo firewall-cmd --reload

(NetworkManager may also store connection.zone ; keep NM and firewalld consistent if both are in play.) sudo nmcli connection modify ens192 connection.zone public

  • sudo nmcli connection up ens192
  • Allow by service name
  • Predefined services map names to ports/protocols: firewall-cmd --get-services | tr ' ' '\n' | head
  • firewall-cmd --info-service=http
  • firewall-cmd --info-service=https
  • firewall-cmd --info-service=ssh
  • firewall-cmd --info-service=nfs sudo firewall-cmd --permanent --add-service=http
  • sudo firewall-cmd --permanent --add-service=https
  • sudo firewall-cmd --permanent --add-service=ssh
  • sudo firewall-cmd --reload
  • firewall-cmd --list-services

Prefer --add-service when a predefined service exists ( http , https , ssh , smtp , cockpit , …). It tracks the correct ports if definitions update.

  • Remove if you opened the wrong thing: sudo firewall-cmd --permanent --remove-service=http
  • sudo firewall-cmd --reload
  • Allow by port/protocol
  • When no service name fits or the task gives a raw port: sudo firewall-cmd --permanent --add-port=8080/tcp
  • sudo firewall-cmd --permanent --add-port=53/udp
  • sudo firewall-cmd --reload
  • firewall-cmd --list-ports

Syntax is port/protocol ( tcp or udp ). Ranges use 1000-2000/tcp form when needed. sudo firewall-cmd --permanent --remove-port=8080/tcp

  • sudo firewall-cmd --reload
  • Restrict means default deny + explicit allow

firewalld’s usual zone posture blocks unsolicited inbound except listed services/ports (and related connection tracking for replies). “Restrict network access” on EX200 often means:

Leave firewalld on (do not stop / disable it to “make things work”).

Open only required services/ports.

Optionally move hostile interfaces to stricter zones if the task says so.

Do not solve connectivity by systemctl stop firewalld unless a task explicitly demands firewalld off (rare for this objective).

  • Verification and testing firewall-cmd --state
  • firewall-cmd --get-active-zones
  • firewall-cmd --list-all
  • firewall-cmd --permanent --list-all

# From another host or with local tools when appropriate:

  • curl -I http://SERVER_IP
  • ss -tlnp | grep 80

Symptom traps: service listens ( sshd , httpd ) but firewall closed → connection timeout; firewall open but service not running → connection refused. Check both . systemctl is-active httpd

  • firewall-cmd --query-service=http
  • # query returns yes/no exit status
  • Runtime-to-permanent helper
  • If you tested with runtime adds and want to keep them: sudo firewall-cmd --runtime-to-permanent
  • sudo firewall-cmd --reload # still good hygiene after major edits

Prefer deliberate --permanent adds during the exam so you do not copy experimental runtime junk.

  • Exam workflows
  • Workflow A — Permanent HTTP/HTTPS sudo systemctl enable --now firewalld
  • sudo firewall-cmd --permanent --add-service=http
  • sudo firewall-cmd --permanent --add-service=https
  • sudo firewall-cmd --reload
  • firewall-cmd --list-services
  • firewall-cmd --query-service=http && echo http-allowed
  • Workflow B — Custom TCP port sudo firewall-cmd --permanent --add-port=8443/tcp
  • sudo firewall-cmd --reload
  • firewall-cmd --list-ports
  • Workflow C — Zone-specific allow firewall-cmd --get-active-zones
  • sudo firewall-cmd --permanent --zone=public --add-service=nfs
  • sudo firewall-cmd --reload
  • firewall-cmd --zone=public --list-all
  • Workflow D — Accidentally runtime-only; fix permanence firewall-cmd --list-services # shows http
  • firewall-cmd --permanent --list-services # missing http
  • sudo firewall-cmd --permanent --add-service=http
  • sudo firewall-cmd --reload
  • Workflow E — Lock down mistake (opened too much) sudo firewall-cmd --permanent --remove-service=http
  • sudo firewall-cmd --reload
  • Panic buttons (use carefully) sudo firewall-cmd --panic-on # severe cut-off; can lock you out
  • sudo firewall-cmd --panic-off

Avoid panic mode on a remote exam unless you fully understand the impact. Prefer precise --add / --remove .

SELinux vs firewalld (do not confuse)

  • Layer Symptom if wrong
  • firewalld Timeout / no route to peer from outside
  • SELinux Local service denial; AVC in audit; often connection refused or app error even when port “open”
  • Service down Connection refused

Open the port and run the service and fix SELinux when serving content—but this section’s skill is firewall-cmd restriction/allow rules.

Common traps

--permanent without --reload .

Runtime-only open — works until reload/reboot, then fails grading.

stop firewalld to allow traffic — fails “restrict with firewalld.”

Wrong zone — rule in work while interface is in public .

--add-port=80 without /tcp .

Allowing http but testing HTTPS only (or the reverse).

firewalld disabled at boot — permanent files exist but daemon never loads them.

Assuming trusted is default — often public or environment-specific; always check.

Opening ports but forgetting enable --now on the application service.

Confusing this checklist with deep rich-rule mastery — learn basics here; security chapter expands.

Relationship to other content

  • Skill Where
  • IP addressing / DNS 17.1–17.2
  • NM at boot 17.3
  • firewalld services/ports/zones/reload 17.4
  • Deeper firewall settings Security chapter ( firewalld-security )
  • SELinux ports/booleans Security SELinux chapters
  • sshd/httpd enable Deploy services chapter
  • Section checkpoint

You should enable and run firewalld , inspect default and active zones , permanently --add-service or --add-port , --reload , verify with --list-all / --query-service , remove mistaken openings, and keep the firewall on as the restriction mechanism. That meets the EX200 networking objective to restrict network access with firewalld and firewall-cmd on RHEL 10, with richer firewall scenarios reserved for the security material that follows.