Updated: 22 October 2026 · Applies to: AlmaLinux 9 / Rocky Linux 9
CentOS 8 reached end of life in 2021. Its firewall, firewalld, works the same on AlmaLinux 9 / Rocky Linux 9, so this guide uses those.
Check the firewall
systemctl status firewalld firewall-cmd --state firewall-cmd --get-active-zones firewall-cmd --list-all # rules of the default zone
Open and close services and ports
firewall-cmd --permanent --add-service=https # by service name firewall-cmd --permanent --add-port=5555/tcp # by port firewall-cmd --permanent --remove-port=5555/tcp # close it again firewall-cmd --reload
Without --permanent a change applies at once but is lost at the next reload or reboot. With --permanent it is saved but applies only after firewall-cmd --reload. A useful pattern is to test a rule without --permanent, then save everything with firewall-cmd --runtime-to-permanent.
List the known service names with firewall-cmd --get-services.
Allow a service only from certain addresses
firewall-cmd --permanent --new-zone=admin firewall-cmd --permanent --zone=admin --add-source=203.0.113.10 firewall-cmd --permanent --zone=admin --add-service=ssh firewall-cmd --reload
Traffic from 203.0.113.10 now uses the admin zone. When it works, remove SSH from the public zone if only that address should connect: firewall-cmd --permanent --zone=public --remove-service=ssh.
Port forwarding
firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080 firewall-cmd --reload
Panic mode
firewall-cmd --panic-on drops all traffic, including your SSH session. Turn it off from the console with firewall-cmd --panic-off.
Note: On current systems the iptables command is a front end to nftables. Use firewalld (AlmaLinux/Rocky) or UFW (Ubuntu/Debian) rather than editing iptables rules by hand; mixing several firewall tools leads to confusing results.
Tip: On a Ucartz VPS, keep the VNC console open (client area › your VPS service › VPS dashboard) while you change firewall or network settings. If you lock yourself out of SSH, you can still fix it from the console.
