Mastering Firewall Rules with firewalld (Linux Security Guide)

🚀 Allow MySQL Access

sudo firewall-cmd --zone=public --add-service=mysql --permanent
sudo firewall-cmd --zone=public --add-port=3306/tcp --permanent
sudo firewall-cmd --reload
firewall-cmd --zone=public --list-all

🌐 Allow Specific IP

sudo firewall-cmd --zone=public --add-source=192.168.0.1 --permanent
sudo firewall-cmd --reload

🛠️ Open cPanel Ports in Work Zone

firewall-cmd --zone=work --add-port=2087/tcp --permanent
firewall-cmd --zone=work --add-port=2083/tcp --permanent
firewall-cmd --reload
firewall-cmd --zone=work --list-all

❌ Remove cPanel Ports from Work Zone

firewall-cmd --zone=work --remove-port=2087/tcp --permanent
firewall-cmd --zone=work --remove-port=2083/tcp --permanent
firewall-cmd --reload
firewall-cmd --zone=work --list-all

🌍 Manage Public Zone Ports

Open ports:

firewall-cmd --zone=public --add-port=2087/tcp --permanent
firewall-cmd --zone=public --add-port=2083/tcp --permanent
firewall-cmd --reload
firewall-cmd --zone=public --list-all

Close ports:

firewall-cmd --zone=public --remove-port=2087/tcp --permanent
firewall-cmd --zone=public --remove-port=2083/tcp --permanent
firewall-cmd --reload
firewall-cmd --zone=public --list-all

🧠 Key Principles

• Use --permanent to save rules after reboot.

• Always run firewall-cmd --reload after changes.

• Keep the public zone minimal.

• Prefer IP-based access instead of opening ports globally.

⚡ Final Thought

Open ports create risk.
Controlled access creates real security.

Build your firewall like a gatekeeper, not a welcome mat.