Firewalld OS Service / Admin


This page is about the management of the OS service known as firewalld on the operating system.



The system service configuration file 1) is located at:

cat /etc/firewalld/firewalld.conf


# firewalld config file

# default zone
# The default zone used if an empty zone string is used.
# Default: public

# Minimal mark
# Marks up to this minimum are free for use for example in the direct 
# interface. If more free marks are needed, increase the minimum
# Default: 100

# Clean up on exit
# If set to no or false the firewall configuration will not get cleaned up
# on exit or stop of firewalld
# Default: yes

# Lockdown
# If set to enabled, firewall changes with the D-Bus interface will be limited
# to applications that are listed in the lockdown whitelist.
# The lockdown whitelist file is lockdown-whitelist.xml
# Default: no

# IPv6_rpfilter
# Performs a reverse path filter test on a packet for IPv6. If a reply to the
# packet would be sent via the same interface that the packet arrived on, the 
# packet will match and be accepted, otherwise dropped.
# The rp_filter for IPv4 is controlled using sysctl.
# Default: yes

# IndividualCalls
# Do not use combined -restore calls, but individual calls. This increases the
# time that is needed to apply changes and to start the daemon, but is good for
# debugging.
# Default: no

# LogDenied
# Add logging rules right before reject and drop rules in the INPUT, FORWARD
# and OUTPUT chains for the default rules and also final reject and drop rules
# in zones. Possible values are: all, unicast, broadcast, multicast and off.
# Default: off

# AutomaticHelpers
# For the secure use of iptables and connection tracking helpers it is
# recommended to turn AutomaticHelpers off. But this might have side effects on
# other services using the netfilter helpers as the sysctl setting in
# /proc/sys/net/netfilter/nf_conntrack_helper will be changed.
# With the system setting, the default value set in the kernel or with sysctl
# will be used. Possible values are: yes, no and system.
# Default: system

# AllowZoneDrifting
# Older versions of firewalld had undocumented behavior known as "zone
# drifting". This allowed packets to ingress multiple zones - this is a
# violation of zone based firewalls. However, some users rely on this behavior
# to have a "catch-all" zone, e.g. the default zone. You can enable this if you
# desire such behavior. It's disabled by default for security reasons.
# Note: If "yes" packets will only drift from source based zones to interface
# based zones (including the default zone). Packets never drift from interface
# based zones to other interfaces based zones (including the default zone).
# Possible values; "yes", "no". Defaults to "yes".


See Firewalld - Log

List of commands

Start / Stop

# init
service firewalld start
service firewalld stop
# or systemd
systemctl firewalld start
systemctl firewalld stop
Redirecting to /bin/systemctl start  firewalld.service


# init
service firewalld status
# systemd
systemctl firewalld status
Redirecting to /bin/systemctl status  firewalld.service
firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Fri 2018-02-09 09:41:17 UTC; 58s ago
     Docs: man:firewalld(1)
 Main PID: 3963 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─3963 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Feb 09 09:41:17 HI-INFA-BDM-01 systemd[1]: Starting firewalld - dynamic firewall daemon...
Feb 09 09:41:17 HI-INFA-BDM-01 systemd[1]: Started firewalld - dynamic firewall daemon.


firewall-cmd --reload        
firewall-cmd  --complete-reload    
  • Ansible: Handler to restart ie firewall-cmd –reload
- name: "firewalld reload"
    state: restarted
    name: firewalld


  • Return and print firewalld state
firewall-cmd --state

Discover More

Cheatsheet on the usage of Firewalld
Management of Port in Firewalld

This page is the management of port within firewalld Ports can be named: numerically with the internet protocol. ie: for a HTTP server port 80/tcp or 80 (as tcp is the default) or with...
What is and how to create an IpSet? (Firewalld/Iptables)

An IPset is a set of IP or MAC addresses grouped together under a name. You can use an IPset in every source with the ipset: prefix. reload firewalld A IPset called white-list List of mac...
Which backend uses Firewalld to store the rules?

firewalld uses as backend: nftables (default) iptables (deprecated) The configuration is firewalld system configuration.

Share this page:
Follow us:
Task Runner