Manage firewalld on AlmaLinux, Rocky Linux and Fedora

Check that it is running

sudo systemctl status firewalld
sudo firewall-cmd --state
sudo firewall-cmd --get-active-zones

On a fresh VPS the network interface normally sits in the public zone, which allows SSH and DHCPv6 client traffic and blocks everything else inbound.

Runtime versus permanent

Every firewalld change is either runtime (active now, lost on reload or reboot) or permanent (saved, applied on next reload). The safe workflow is to test at runtime and then save:

sudo firewall-cmd --add-service=http
# test that the site loads
sudo firewall-cmd --runtime-to-permanent

Or make the change permanent and reload in one go:

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Open services and ports

Named services bundle the right ports and protocols:

sudo firewall-cmd --permanent --add-service={http,https}
sudo firewall-cmd --permanent --add-port=51820/udp
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

firewall-cmd --get-services lists every predefined service, including postgresql, mysql, wireguard and cockpit.

Restrict a service to one address

Rich rules handle source-based access. To let only an office IP reach PostgreSQL:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="198.51.100.7" service name="postgresql" accept'
sudo firewall-cmd --reload

For several trusted addresses, a cleaner pattern is a dedicated zone bound to source addresses:

sudo firewall-cmd --permanent --new-zone=office
sudo firewall-cmd --permanent --zone=office --add-source=198.51.100.0/28
sudo firewall-cmd --permanent --zone=office --add-service={ssh,postgresql}
sudo firewall-cmd --reload

Traffic from those addresses now uses the office zone; everyone else falls through to public.

Close what you do not need

Many RHEL-family images allow cockpit (port 9090) in the public zone. If you do not use the web console, remove it:

sudo firewall-cmd --permanent --remove-service=cockpit
sudo firewall-cmd --reload

Moving SSH to another port

SELinux must be told about the new port as well as the firewall:

sudo semanage port -a -t ssh_port_t -p tcp 2222
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

Only then change Port in the SSH configuration and reload sshd. Keep your current session open until a new login on the new port succeeds.

Logging dropped packets

sudo firewall-cmd --set-log-denied=unicast
sudo journalctl -k -f | grep -i reject

Set it back with --set-log-denied=off when you are done.

If you get locked out

Use the browser-based VNC console in the VeloxMedia control panel and run sudo firewall-cmd --reload to discard runtime mistakes, or sudo systemctl stop firewalld while you fix permanent rules. Firewall rules in the control panel can be used alongside firewalld for a second layer of protection.