Introduction
When a network service is unreachable, check the path in layers: service state, listening socket, local request, firewall rule, then final access. This keeps you from opening firewall ports for a service that is not even listening.
In this lab, a small HTTP service listens on TCP port 8088, but firewalld does not allow that port. You will inspect the service path and add the missing permanent firewall rule.
Check the Service State
In this step, you will confirm that the application service is running before looking at firewall rules.
Move into the project directory and create a workspace.
cd /home/labex/project
mkdir -p firewall-path
Check the service state.
systemctl is-active rhce-http-demo.service | tee firewall-path/service-state.txt
Read the service command.
systemctl show rhce-http-demo.service -p ExecStart | tee firewall-path/exec-start.txt
The service is active, so the next question is whether it is listening on the expected port.
Inspect the Listening Socket
In this step, you will confirm that the host is listening on TCP port 8088.
Show listening TCP sockets for port 8088.
sudo ss -ltnp 'sport = :8088' | tee firewall-path/socket.txt
Test the service over loopback.
curl -s http://127.0.0.1:8088/ | tee firewall-path/loopback-response.txt
The service responds locally, so the application itself is working.
Find the Missing Firewall Rule
In this step, you will check firewalld for the service port. A local socket does not automatically mean the firewall allows the port.
List open ports in the default zone.
sudo firewall-cmd --list-ports | tee firewall-path/ports-before.txt
Query port 8088/tcp.
sudo firewall-cmd --query-port=8088/tcp | tee firewall-path/query-before.txt || true
The query should return no, which means firewalld is missing the rule.
Open the Service Port
In this step, you will add a permanent firewalld rule and reload the firewall.
Add the permanent port rule.
sudo firewall-cmd --add-port=8088/tcp --permanent
Reload firewalld.
sudo firewall-cmd --reload
Query the port again.
sudo firewall-cmd --query-port=8088/tcp | tee firewall-path/query-after.txt
The firewall now allows the service port.
Verify the Complete Service Path
In this step, you will verify the service, socket, firewall rule, and response together.
Check the service state.
systemctl is-active rhce-http-demo.service
Show the firewall port list.
sudo firewall-cmd --list-ports | tee firewall-path/ports-after.txt
Request the service again.
curl -s http://127.0.0.1:8088/ | tee firewall-path/final-response.txt
The application path is complete: service active, socket listening, firewall rule present, and HTTP response working.
Summary
You checked a service path in layers: service state, listening socket, local HTTP response, missing firewalld port, permanent firewall repair, and final response validation.
