Open a port with firewall-cmd: zones and the traps (Rocky 9)

When to use it

Your service listens on 8080 but nothing can reach it — usually firewalld has not allowed it. firewalld is not one flat rule table: rules live in zones. Find the zone your interface belongs to, then change that zone’s ports or services.

Look at the zone before typing commands

firewall-offline-cmd --get-zones
firewall-offline-cmd --get-default-zone

block dmz drop external home internal public trusted work
public

On Rocky 9 the public zone allows only three services by default:

firewall-offline-cmd --zone=public --list-services

cockpit dhcpv6-client ssh

The output above is real output from firewall-offline-cmd in a rockylinux:9 container (Rocky 9.3 image, firewalld installed with dnf install firewalld). The container has no systemd, and firewall-cmd needs the running firewalld daemon, so the offline tool is used to inspect the static configuration.

Open a port (permanent and effective now)

sudo firewall-cmd --permanent --zone=public --add-port=8080/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --zone=public --list-ports

With only --permanent and no --reload, the rule applies on the next reload or reboot; without --permanent, it disappears on restart. You need both.

Verify

firewall-cmd --zone=public --list-all

public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: cockpit dhcpv6-client ssh
  ports: 8080/tcp
  ...

Only when ports: lists 8080/tcp is the port open; services: still shows the three defaults.

Common traps

• --add-port=8080 without a protocol: it is treated as a single protocol; write 8080/udp explicitly when you need UDP;
• Wrong zone: the interface is in public but the command targets --zone=internal; check firewall-cmd --get-active-zones;
• Port open but the service listens on localhost: confirm with ss -lntp | grep 8080; a service bound to 127.0.0.1 is unreachable no matter what the firewall allows.

Practice: open 8443/tcp and keep it after a restart

Prerequisite: Rocky 9 with root or sudo.

sudo firewall-cmd --permanent --zone=public --add-port=8443/tcp
sudo firewall-cmd --reload

Checks:

1. firewall-cmd --zone=public --list-ports → includes 8443/tcp
2. firewall-cmd --permanent --zone=public --list-ports → also includes 8443/tcp
3. systemctl restart firewalld && firewall-cmd --zone=public --list-ports → still there

Next steps

• Ports and SELinux are separate concerns (page pending): /en/selinux-modes/
• Server baseline: Security baseline
• Connectivity debugging (page pending): /en/network-troubleshoot/