firewall-cmd: List All Rules and Useful firewalld Examples

Updated: 17 October 2026 · Applies to: firewalld 2.4.3 (AlmaLinux 10.2) and 1.3.4 (AlmaLinux 9.8); the same commands work on Rocky Linux and RHEL 9 and 10

To list all firewall rules with firewall-cmd, run firewall-cmd --list-all. It prints every rule of the default zone, which is normally the zone of your network interface: allowed services and ports, rich rules, port forwards and blocked ICMP types. For the complete picture, add --list-all-zones (every zone), --list-all-policies (rules between zones) and --permanent (the saved rules, which can differ from the running ones). Run the commands as root or with sudo.

CentOS 7 and CentOS Linux 8 are end of life and get no more updates. The commands below are the same on their firewalld versions, but move such servers to AlmaLinux or Rocky Linux.

1. List all rules, step by step

1. Check that firewalld is running. firewall-cmd --state should print running.
2. Find the zone your interface is in:

   firewall-cmd --get-active-zones

   Lab output on AlmaLinux 10 after the examples in section 3 were added (AlmaLinux 9 does not print (default)):

   drop
     sources: 203.0.113.66 ipset:blocklist
   public (default)
     interfaces: eth0

3. List every rule of the default zone:

   firewall-cmd --list-all

   Lab output on AlmaLinux 10 (firewalld 2.4.3):

   public (default, active)
     target: default
     ingress-priority: 0
     egress-priority: 0
     icmp-block-inversion: no
     interfaces: eth0
     sources:
     services: dhcpv6-client http https ssh
     ports: 8080/tcp
     protocols:
     forward: yes
     masquerade: no
     forward-ports:
   	port=80:proto=tcp:toport=8080:toaddr=
     source-ports:
     icmp-blocks:
     rich rules:
   	rule family="ipv4" source address="198.51.100.7/32" port port="3306" protocol="tcp" accept

   On AlmaLinux 9 (firewalld 1.3.4) the output is the same except that the two priority lines are missing. A fresh server shows only services: cockpit dhcpv6-client ssh.
4. List another zone with --zone, for example the zone that holds blocked addresses: firewall-cmd --zone=drop --list-all. To print all nine built-in zones at once (about 150 lines), use firewall-cmd --list-all-zones.
5. List the policies, which filter traffic between zones and to the server itself:

   firewall-cmd --list-all-policies

   On a new server only allow-host-ipv6 is active (it accepts the ICMPv6 messages IPv6 needs). firewalld 2.4 also ships five gateway-* policies that are disabled by default.
6. List IP sets, which hold long address lists: firewall-cmd --get-ipsets, then firewall-cmd --info-ipset=blocklist for the entries of one set.
7. Check for old direct rules: firewall-cmd --direct --get-all-rules. It printed nothing on our test servers. According to the firewall-cmd manual, the direct interface is deprecated and superseded by policies.

2. Running rules, saved rules and the real kernel rules

Every --list-* command shows the runtime rules (active now). Add --permanent to see the saved rules that load after a reboot or --reload. In our lab, right after adding services with --permanent and before reloading:

$ firewall-cmd --list-services
cockpit dhcpv6-client ssh
$ firewall-cmd --permanent --list-services
dhcpv6-client http https ssh

If the two lists differ, a change is either not saved yet or not loaded yet. The saved rules live in /etc/firewalld/zones/public.xml.

firewalld turns its rules into nftables rules. To see exactly what the kernel enforces, use nft:

$ nft list chain inet firewalld filter_IN_public_allow
table inet firewalld {
	chain filter_IN_public_allow {
		tcp dport 22 accept
		ip6 daddr fe80::/64 udp dport 546 accept
		tcp dport 80 accept
		tcp dport 443 accept
		tcp dport 8080 accept
		ip saddr 198.51.100.7 tcp dport 3306 accept
		tcp dport 9000 accept
	}
}

The last line is a temporary rule (example 5 in section 3). nft list ruleset prints everything (over 600 lines in our lab). iptables -L -n is not useful here: it showed only empty INPUT, FORWARD and OUTPUT chains with policy ACCEPT, because firewalld writes nftables rules, not iptables rules.

For a single item, use the short commands: --list-services, --list-ports, --list-rich-rules, --list-forward-ports and --list-sources. To test one rule, firewall-cmd --query-service=ssh prints yes or no.

3. Useful firewall-cmd examples

Each change below is saved with --permanent and becomes active with firewall-cmd --reload. All of them returned success in our tests.

1. Allow a service or a port, and close one you do not use:

   firewall-cmd --permanent --add-service=http --add-service=https
   firewall-cmd --permanent --add-port=8080/tcp
   firewall-cmd --permanent --remove-service=cockpit
   firewall-cmd --reload

   firewall-cmd --get-services lists the 263 service names firewalld 2.4.3 knows, and firewall-cmd --info-service=http shows which port one of them opens. More in how to open a port on RHEL, AlmaLinux and Rocky Linux.
2. Allow a port for one address only (rich rule), for example a database port for your office IP:

   firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="198.51.100.7/32" port port="3306" protocol="tcp" accept'

   See also enable a port for a specific IP address in firewalld.
3. Block an address, or a whole list of networks with an IP set:

   firewall-cmd --permanent --zone=drop --add-source=203.0.113.66
   firewall-cmd --permanent --new-ipset=blocklist --type=hash:net
   firewall-cmd --permanent --ipset=blocklist --add-entry=198.51.100.0/24
   firewall-cmd --permanent --zone=drop --add-source=ipset:blocklist

   Traffic from sources in the drop zone is discarded without a reply. firewall-cmd --get-zone-of-source=203.0.113.66 then prints drop.
4. Forward port 80 to port 8080 on the same server:

   firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080

   To forward to another machine, add :toaddr= with its address and enable masquerading with --add-masquerade.
5. Open a port for a limited time: firewall-cmd --add-port=9000/tcp --timeout=30m removes the rule after 30 minutes.
6. Emergency stop: firewall-cmd --panic-on drops all traffic, including your own SSH session. Check it with --query-panic and end it with --panic-off. Use it only from a console, never over SSH.

Common problems

• A rule works until the next reboot: it was added without --permanent. firewall-cmd --runtime-to-permanent saves all running rules. Careful: in our test it also saved a rule added with --timeout, which then stayed open for good. Remove such rules first.
• A permanent rule has no effect: run firewall-cmd --reload.
• The rule is in a different zone than the interface: compare with --get-active-zones and add --zone= to your command.
• Error: INVALID_PORT: bad port (most likely missing protocol): write 8080/tcp, not 8080.
• Error: INVALID_RULE: unknown element: a typo in a rich rule (we got it for acept). Error: INVALID_ZONE means the zone name does not exist (--get-zones lists them).
• You locked yourself out of SSH: on a Ucartz VPS, log in through the VNC console (see how to access your VPS via VNC) and fix the rule there. On a dedicated server, use the IPMI or KVM console if your server has one, or contact our support team.

For a compact list of all options, see the firewalld command line cheat sheet. To remove rules again, see how to close or block a port.

Official documentation: firewalld documentation.