Updated: 28 September 2026 · Applies to: AlmaLinux 9 / Rocky Linux 9 (and Ubuntu 24.04 / Debian 12 with UFW)
CentOS 6/7/8 and RHEL 6/7 are end of life. This guide uses AlmaLinux 9 / Rocky Linux 9 (and Ubuntu 24.04 / Debian 12 where they differ).
firewalld is the standard firewall on AlmaLinux 9 / Rocky Linux 9. It groups rules into zones; most servers only use the default public zone.
Install and start
dnf install firewalld systemctl enable --now firewalld
Tip: On a Ucartz VPS, keep the VNC console open (client area › your VPS service › VPS dashboard) while you change firewall or network settings. If you lock yourself out of SSH, you can still fix it from the console.
Check the firewall
systemctl status firewalld firewall-cmd --state firewall-cmd --get-active-zones firewall-cmd --list-all # rules of the default zone
Open and close services and ports
firewall-cmd --permanent --add-service=https # by service name firewall-cmd --permanent --add-port=5555/tcp # by port firewall-cmd --permanent --remove-port=5555/tcp # close it again firewall-cmd --reload
Without --permanent a change applies at once but is lost at the next reload or reboot. With --permanent it is saved but applies only after firewall-cmd --reload. A useful pattern is to test a rule without --permanent, then save everything with firewall-cmd --runtime-to-permanent.
List the known service names with firewall-cmd --get-services.
Zones in short
public(default): for internet-facing interfaces. Only the services you add are allowed in.trusted: everything allowed. Use it only for private networks you control.- Assign an interface to a zone with
firewall-cmd --permanent --zone=internal --change-interface=eth1.
Allow a port only from one IP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.10" port port="3306" protocol="tcp" accept' firewall-cmd --reload
Note: On current systems the iptables command is a front end to nftables. Use firewalld (AlmaLinux/Rocky) or UFW (Ubuntu/Debian) rather than editing iptables rules by hand; mixing several firewall tools leads to confusing results.
