Managing Services and Ports

Introduction

In this lab, you will dive deeper into controlling what traffic is allowed into your system using firewalld.

Imagine your computer is a building. By default, the firewall locks all the doors. To let legitimate visitors in (like web traffic or file transfers), you need to unlock specific doors. In networking terms, these doors are called "ports" or "services".

You will learn two critical ways to change these rules:

1. Temporary (Runtime): Like writing a note on a whiteboard. It works now, but if the cleaner comes (system reboot or reload), the note is gone.
2. Permanent: Like carving a sign in stone. It stays there after reloads and reboots.

This runtime-versus-permanent split is one of the most important Firewalld concepts. It lets administrators test changes safely before deciding to keep them.

By the end of this lab, you will be able to allow web traffic temporarily for testing, open a specific custom port permanently, and understand how to save your changes.

Allow a Service Temporarily

In this step, you will allow traffic for the HTTP service.

Note on the Lab Environment: Because we set the default zone to trusted in the setup (to keep your terminal connection alive), all ports are technically already open. However, we will proceed as if we are on a secure server where everything is blocked, so you can learn the correct commands for opening ports.

We will add the http rule as a runtime (temporary) configuration.

This distinction between runtime and permanent state is one of Firewalld's most useful safety features. It lets you test whether a rule works before you commit it to long-term configuration.

First, check which services are explicitly allowed in your current zone.

sudo firewall-cmd --list-services

You might not see much initially. Now, add the http service to the allowed list.

sudo firewall-cmd --add-service=http

If successful, the terminal will simply say success.

Verify that the service is now allowed by listing the services again.

sudo firewall-cmd --list-services

You should now see http in the list. Remember, because we didn't tell the firewall to make this "permanent", this rule is like the whiteboard note—it exists only in memory right now.

Open a Port Permanently

In this step, sometimes you need to open a specific "door" number directly, rather than a named service. For example, port 8080 is commonly used for testing web servers.

The service-versus-port choice also matters conceptually. A service is a named bundle that usually maps to one or more well-known ports, while a raw port rule is more literal and lower level. Both are valid, but service names are often easier to read and maintain.

For this rule, we want it to stick around even if the server restarts. We will use the --permanent flag.

Run the following command to open TCP port 8080 permanently.

sudo firewall-cmd --permanent --add-port=8080/tcp

The output should be success.

Crucial Concept: When you use --permanent, you are editing the configuration file (the "stone tablet"), but you are not changing the live firewall immediately.

Let's prove this. Check the currently running (runtime) ports.

sudo firewall-cmd --list-ports

You will see that the list is empty (or doesn't show 8080). The firewall doesn't know about the new rule yet because it hasn't read the updated configuration file.

Now, check the permanent configuration to confirm your rule is safely saved on disk.

sudo firewall-cmd --permanent --list-ports

Here, you should see 8080/tcp. This confirms the rule is "queued" to be applied next time the firewall loads its config.

Reload the Firewall

In this step, you now have a situation:

• You have a temporary rule allowing http (from Step 1).
• You have a permanent rule allowing 8080 that is saved but not active (from Step 2).

To activate the permanent rule, you must reload the firewall. This tells Firewalld to re-read its configuration files and apply them.

Operationally, reload is where the runtime and permanent worlds meet. It replaces the live in-memory rule set with what is defined on disk, which is why temporary experiments disappear unless you chose to save them permanently.

Warning: Reloading resets the firewall to the state described in the configuration files. Since your http rule was only temporary (not in the config file), it will be lost!

Execute the reload command.

sudo firewall-cmd --reload

Now, let's verify what happened. First, check if port 8080 is now active.

sudo firewall-cmd --list-ports

Success! You should see 8080/tcp. The permanent rule has been loaded into the live system.

Now, check what happened to the http service.

sudo firewall-cmd --list-services

The http service is gone. This proves that reloading wipes out any runtime-only changes. This is a common "gotcha" for beginners—always remember to make your important rules permanent!

Verify Full Configuration

In this step, you will use the most useful command for daily firewall management. Instead of checking services and ports separately, you can view the entire configuration of the active zone at once.

This "big picture" view is valuable because firewall mistakes often come from forgetting that multiple rule types combine to form the real behavior of the host. Looking at the whole zone reduces that risk.

Use the --list-all option to see the big picture.

sudo firewall-cmd --list-all

The output gives you a complete summary of the active zone (which is trusted in our lab setup):

• target: ACCEPT.
• interfaces: The active network interface (e.g., eth0).
• services: Lists standard allowed services. Note http is missing because we lost it after the reload.
• ports: Lists custom open ports (e.g., 8080/tcp).

This command is excellent for troubleshooting because it shows you exactly what the firewall is doing right now.

Summary

In this lab, you have mastered the difference between temporary and permanent firewall rules. You have learned:

1. Runtime Rules: How to add a service like http instantly but temporarily.
2. Permanent Rules: How to use the --permanent flag to save a rule (like opening port 8080) for the future.
3. Reloading: How to apply permanent changes to the runtime environment using --reload, and the side effect that temporary rules are discarded.
4. Verifying: Using --list-all to see the complete state of your firewall.

You are now building a solid understanding of how to control network access securely and persistently.