ExamFinch.com My Study

Study guide

19.1 Configure Firewall Settings with firewall-cmd and firewalld

Practice this exam

Red Hat Certified System Administrator RHCSA

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts 1.2 Lab Setup & Performance-Based Study Strategy

2 Essential Tools: Shell, Redirection & Text Analysis

2.1 Shell Prompt and Command Syntax 2.2 Input-Output Redirection and Pipes 2.3 grep and Regular Expressions for Text Analysis

3 Essential Tools: Remote Access, Users & Text Editing

3.1 Access Remote Systems Using SSH 3.2 Log In and Switch Users in Multiuser Targets 3.3 Create and Edit Text Files

4 Essential Tools: Files, Links & Archives

4.1 Create, Delete, Copy, and Move Files and Directories 4.2 Hard and Soft Links 4.3 Archive and Compress with tar, gzip, and bzip2

5 Essential Tools: Permissions & System Documentation

5.1 List, Set, and Change Standard ugo/rwx Permissions 5.2 System Documentation: man, info, and /usr/share/doc

6 Manage Software: RPM and Flatpak

6.1 Configure Access to RPM Repositories 6.2 Install and Remove RPM Software Packages 6.3 Configure Access to Flatpak Repositories 6.4 Install and Remove Flatpak Software Packages

7 Create Simple Shell Scripts

7.1 Conditional Execution: if, test, and [] 7.2 Looping Constructs for Files and Input 7.3 Process Script Inputs ($1, $2, and Beyond) 7.4 Process Shell Command Output in Scripts

8 Operate Running Systems: Boot and Recovery

8.1 Boot, Reboot, and Shut Down a System Normally 8.2 Boot Systems into Different Targets Manually 8.3 Interrupt the Boot Process to Gain Access

9 Operate Running Systems: Processes and Tuning

9.1 Identify and Kill CPU/Memory Intensive Processes 9.2 Adjust Process Scheduling 9.3 Manage Tuning Profiles

10 Operate Running Systems: Logs, Services & File Transfer

10.1 Locate and Interpret System Log Files and Journals 10.2 Preserve System Journals 10.3 Start, Stop, and Check Status of Network Services 10.4 Securely Transfer Files Between Systems

11 Configure Local Storage: Partitions and LVM

11.1 List, Create, and Delete Partitions on GPT Disks 11.2 Create and Remove Physical Volumes 11.3 Assign Physical Volumes to Volume Groups 11.4 Create and Delete Logical Volumes

12 Configure Local Storage: Mounting and Expansion

12.1 Mount File Systems at Boot by UUID or Label 12.2 Add Partitions, Logical Volumes, and Swap Non-Destructively

13 Create and Configure File Systems: Local FS and Permissions

13.1 Create, Mount, and Use VFAT, ext4, and XFS File Systems 13.2 Extend Existing Logical Volumes 13.3 Diagnose and Correct File Permission Problems

14 Create and Configure File Systems: NFS and autofs

14.1 Mount and Unmount Network File Systems Using NFS 14.2 Configure autofs

15 Deploy and Maintain: Scheduling, Services & Targets

15.1 Schedule Tasks with at, cron, and systemd Timers 15.2 Start, Stop, and Enable Services at Boot 15.3 Configure Systems to Boot into a Specific Target

16 Deploy and Maintain: Time, Software Updates & Bootloader

16.1 Configure Time Service Clients 16.2 Install and Update Software from CDN, Remote Repos, and Local Files 16.3 Modify the System Bootloader

17 Manage Basic Networking

17.1 Configure IPv4 and IPv6 Addresses 17.2 Configure Hostname Resolution 17.3 Configure Network Services to Start Automatically at Boot 17.4 Restrict Network Access Using firewalld and firewall-cmd

18 Manage Users and Groups

18.1 Create, Delete, and Modify Local User Accounts 18.2 Change Passwords and Adjust Password Aging 18.3 Create, Delete, and Modify Local Groups and Memberships 18.4 Configure Privileged Access

19 Manage Security: Firewall, umask & SSH Keys

19.1 Configure Firewall Settings with firewall-cmd and firewalld 19.2 Manage Default File Permissions 19.3 Configure Key-Based Authentication for SSH

20 Manage Security: SELinux Modes and Contexts

20.1 Set Enforcing and Permissive Modes for SELinux 20.2 List and Identify SELinux File and Process Contexts 20.3 Restore Default File Contexts

21 Manage Security: SELinux Ports and Booleans

21.1 Manage SELinux Port Labels 21.2 Use Boolean Settings to Modify SELinux Settings

19.1 Configure Firewall Settings with firewall-cmd and firewalld

Key Takeaways Explain This Topic AI

firewalld is the RHEL host firewall; keep the service enabled and use firewall-cmd for runtime and permanent policy.

Zones define trust (public, trusted, drop, internal, …); bind interfaces or sources, then open services/ports in the correct zone.

Always pair --permanent changes with firewall-cmd --reload so runtime matches saved policy after reboot.

Prefer predefined services (--add-service=http) when available; use --add-port=PORT/PROTO for custom listeners; rich rules cover source-limited allows.

Verify with --get-active-zones, --list-all, --list-services, and --list-ports; prove persistence by checking permanent config, not only live state.

Last updated: August 2026

19.1 Configure Firewall Settings with firewall-cmd and firewalld

Quick Answer: Keep firewalld running and enabled. Open what the task requires with firewall-cmd --permanent --add-service=… or --add-port=…/tcp (in the right zone ), then firewall-cmd --reload . Inspect with --get-active-zones and --list-all . For tighter policy, assign interfaces/sources to zones and use rich rules when you must allow only specific sources.

Why this is a security objective (not only networking)

Chapter 17.4 introduced firewalld as the way to restrict network access under Manage basic networking. Under Manage security , EX200 still expects competent firewall settings : correct zone, permanent rules, reload, and verification that the host only exposes intended services. Lab language looks like:

  • “Configure the firewall so HTTP and HTTPS are permanently allowed.”
  • “Open TCP port 8443 in the default zone.”
  • “Assign the interface to the internal zone and allow only ssh and cockpit .”
  • “Allow NFS-related services from subnet 192.168.10.0/24 only.”

You are graded on end state after reboot : firewalld active, permanent configuration contains the required allows, and runtime matches after reload.

  • firewalld service baseline systemctl status firewalld
  • systemctl is-enabled firewalld
  • systemctl is-active firewalld
  • sudo systemctl enable --now firewalld

If firewalld is stopped or masked, permanent XML never becomes live policy. Prefer firewalld on RHEL 10 training systems; do not replace the exam path with hand-built raw iptables / nft rule sets unless a task forces it (unlikely for standard EX200 wording). firewall-cmd --state

  • # running
  • Runtime vs permanent vs reload

Mode What it changes Survives reload/reboot?

  • Runtime (default firewall-cmd without --permanent ) Live policy now Until reload/restart/reboot (not saved)
  • Permanent ( --permanent ) On-disk zone/service config After reload or service restart
  • firewall-cmd --reload Loads permanent → runtime Makes permanent rules active without full reboot
  • Exam habit: for lasting change, always: sudo firewall-cmd --permanent --add-service=http
  • sudo firewall-cmd --reload
  • firewall-cmd --list-services

Optional dual-write (runtime now and permanent) without waiting for reload of only permanent: sudo firewall-cmd --add-service=http

sudo firewall-cmd --permanent --add-service=http

# or after a series of runtime tweaks:

sudo firewall-cmd --runtime-to-permanent

--runtime-to-permanent snapshots current runtime into permanent files—useful after experimental runtime testing, dangerous if runtime is messy. Prefer explicit --permanent + --reload for clean exam steps. sudo firewall-cmd --complete-reload # harder reset; can drop connections

Prefer ordinary --reload on the exam unless something is stuck.

Zones: trust model

Zones are named policy buckets. Each zone has a default target (accept/reject/drop behavior for unmatched traffic) and a set of allowed services/ports/rich rules. Interfaces and source addresses are assigned to zones. firewall-cmd --get-zones

  • firewall-cmd --get-default-zone
  • firewall-cmd --get-active-zones
  • firewall-cmd --list-all-zones | less

Common zones you will meet:

  • Zone Typical use
  • public Default-ish external: limited services (often ssh , dhcpv6-client )
  • trusted Accept almost everything (very open)
  • drop Drop incoming (stealthy deny)
  • block Reject incoming with ICMP/TCP reset
  • internal / work / home More services allowed for trusted networks
  • dmz / external Edge/gateway-style policies
  • Default zone vs active zone

Default zone: used for interfaces not explicitly assigned elsewhere.

Active zones: zones currently binding interfaces and/or sources that have traffic context. firewall-cmd --get-default-zone

  • sudo firewall-cmd --set-default-zone=public
  • firewall-cmd --get-active-zones

Changing default zone is permanent when done with firewall-cmd --set-default-zone (it writes configuration). Still verify which zone your NIC actually sits in.

  • Assign interface or source to a zone # Interface permanently in internal zone
  • sudo firewall-cmd --permanent --zone=internal --change-interface=ens192
  • sudo firewall-cmd --reload
  • firewall-cmd --get-active-zones
  • # Source network treated as trusted (example)
  • sudo firewall-cmd --permanent --zone=trusted --add-source=192.168.50.0/24
  • sudo firewall-cmd --reload

Tip: Opening http in public does nothing useful if the interface is active only in internal without that service. Always --list-all for the zone that owns the NIC . firewall-cmd --zone=public --list-all

firewall-cmd --zone=internal --list-all

# default zone list-all:

  • firewall-cmd --list-all
  • Services vs ports
  • Predefined services

firewalld ships XML service definitions (ports + protocols + helpers) under /usr/lib/firewalld/services/ (and overrides under /etc/firewalld/services/ ). firewall-cmd --get-services

  • firewall-cmd --info-service=http
  • firewall-cmd --info-service=https
  • firewall-cmd --info-service=ssh
  • Allow a service in a zone: sudo firewall-cmd --permanent --zone=public --add-service=http
  • sudo firewall-cmd --permanent --zone=public --add-service=https
  • sudo firewall-cmd --reload
  • firewall-cmd --zone=public --list-services
  • Remove when a task requires closing: sudo firewall-cmd --permanent --remove-service=http
  • sudo firewall-cmd --reload

Prefer services when Red Hat/firewalld already defines the app ( http , https , ssh , samba , nfs , cockpit , postgresql , …). Graders and docs often phrase “allow the http service.”

Ports (custom listeners)

When the task names a bare port (for example TCP 8080 or 8443 ): sudo firewall-cmd --permanent --add-port=8080/tcp

  • sudo firewall-cmd --permanent --add-port=8443/tcp
  • sudo firewall-cmd --reload
  • firewall-cmd --list-ports
  • UDP example: sudo firewall-cmd --permanent --add-port=53/udp
  • sudo firewall-cmd --reload
  • Port ranges: sudo firewall-cmd --permanent --add-port=3000-3010/tcp
  • sudo firewall-cmd --reload
  • Remove: sudo firewall-cmd --permanent --remove-port=8080/tcp
  • sudo firewall-cmd --reload
  • Approach When
  • -add-service=NAME Named application service exists
  • -add-port=N/tcp or /udp Custom or explicitly numeric port

Do not assume “HTTP is always 80 only via port add”—using --add-service=http is cleaner when the service is standard.

  • Query and audit commands (memorize) firewall-cmd --state
  • firewall-cmd --get-default-zone
  • firewall-cmd --get-active-zones
  • firewall-cmd --list-all
  • firewall-cmd --list-all-zones
  • firewall-cmd --list-services
  • firewall-cmd --list-ports
  • firewall-cmd --list-rich-rules
  • firewall-cmd --permanent --list-all
  • firewall-cmd --permanent --zone=public --list-all

--permanent --list-all shows what will load after reload/reboot. --list-all (no permanent) shows runtime . Both should match after a successful permanent change + reload.

Rich rules (introduction for security tasks)

Rich rules express finer policy: allow a service or port only from a source , log, or limit. Syntax is picky—use patterns you can type under pressure. # Allow SSH only from a management subnet (example)

  • sudo firewall-cmd --permanent --zone=public \
  • -add-rich-rule='rule family="ipv4" source address="192.168.100.0/24" service name="ssh" accept'
  • sudo firewall-cmd --reload
  • firewall-cmd --list-rich-rules

Port from one host: sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.25" port port="8443" protocol="tcp" accept'

sudo firewall-cmd --reload

Reject everything from a bad host (illustrative): sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.50" reject'

sudo firewall-cmd --reload

Remove a rich rule by repeating the same rule string with --remove-rich-rule .

Exam note: Many EX200 tasks stop at service/port + zone . Use rich rules when the task requires source restriction . If you only need “open HTTP globally in the zone,” do not invent rich rules.

  • Interfaces, NetworkManager, and zones
  • NetworkManager can store a connection’s firewall zone: nmcli -f connection.zone connection show ens192
  • sudo nmcli connection modify ens192 connection.zone internal
  • sudo nmcli connection up ens192
  • firewall-cmd --get-active-zones

Alternatively, use firewall-cmd --change-interface as shown earlier. After interface moves, re-check which zone has your services .

SELinux is separate

Opening a port in firewalld does not relabel SELinux port types. If a daemon binds a non-default port, you may also need SELinux port labeling (later security chapters). Conversely, correct SELinux does not open firewalld. On multi-part tasks, fix both when symptoms match each layer.

Panic recovery without locking yourself out

When working over SSH , never permanently remove ssh from the only zone that holds your interface without another access path. Sequence for risky changes:

Add new allows first.

Test.

Remove old rules only after verification.

  • Prefer temporary runtime test, then permanent. # Temporary test (gone after reload if not permanent)
  • sudo firewall-cmd --add-port=8080/tcp
  • # verify connectivity, then permanent + reload
  • Exam workflows
  • Workflow A — Permanent HTTP/HTTPS in default zone sudo systemctl enable --now firewalld
  • firewall-cmd --get-default-zone
  • sudo firewall-cmd --permanent --add-service=http
  • sudo firewall-cmd --permanent --add-service=https
  • sudo firewall-cmd --reload
  • firewall-cmd --list-services
  • firewall-cmd --permanent --list-services
  • Workflow B — Custom TCP port sudo firewall-cmd --permanent --add-port=8080/tcp
  • sudo firewall-cmd --reload
  • firewall-cmd --list-ports

Workflow C — Zone + services for an interface sudo firewall-cmd --permanent --zone=internal --change-interface=ens192

  • sudo firewall-cmd --permanent --zone=internal --add-service=ssh
  • sudo firewall-cmd --permanent --zone=internal --add-service=cockpit
  • sudo firewall-cmd --reload
  • firewall-cmd --get-active-zones
  • firewall-cmd --zone=internal --list-all

Workflow D — Source-limited allow (rich rule) sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="172.25.250.0/24" port port="9090" protocol="tcp" accept'

  • sudo firewall-cmd --reload
  • firewall-cmd --list-rich-rules
  • Workflow E — Verify permanence mindset firewall-cmd --state
  • firewall-cmd --list-all
  • firewall-cmd --permanent --list-all
  • systemctl is-enabled firewalld
  • Common traps

Runtime-only --add-service without --permanent —works now, gone after reboot/reload of permanent-only disk state.

--permanent without --reload —disk updated, runtime still old.

Adding rules to the wrong zone while the NIC is active in another zone.

Using --add-port=80/tcp when the task said allow http service (often both work for port 80, but service name is what docs expect).

Removing ssh permanently over a remote session and locking yourself out.

Assuming firewalld is running —always check after minimal installs or hard problems.

Confusing default zone with active zones .

Opening the firewall but forgetting the daemon/service itself is not installed or not listening.

Expecting rich-rule typos to work—quote carefully; verify with --list-rich-rules .

Treating iptables -F as a firewalld configuration method on modern RHEL exams.

Relationship to other sections

  • Topic Where
  • Restrict network access (intro) 17.4
  • Deep firewall settings (this) 19.1
  • Services listening / systemd Operate / deploy chapters
  • SELinux ports/booleans Security SELinux chapters
  • SSH access path 19.3 and essential SSH
  • Section checkpoint

You should enable firewalld , choose the correct zone , open services and ports permanently, reload , optionally use interface/source assignment and simple rich rules , and prove runtime and permanent lists match the task. That is the EX200 security bar for firewall settings with firewall-cmd on RHEL 10.