RHEL 10 FirewallD Commands & Examples

What is FirewallD in RHEL 10?

In RHEL 10, FirewallD is the default firewall management service that provides dynamic firewall capabilities for Linux servers. Unlike static rules applied via traditional iptables, FirewallD enables administrators to manage firewall rules without restarting the firewall service, ensuring uninterrupted connectivity for production workloads. This flexibility is essential for enterprises that demand continuous uptime and quick adaptability to evolving security requirements.

At its core, FirewallD is built on the concept of zones and services. Zones define trust levels for network connections, while services provide pre-defined sets of rules for commonly used protocols like HTTP, HTTPS, SSH, and DNS. With RHEL 10, FirewallD introduces improved support for IPv6, stronger default profiles, and integration with modern DevOps workflows, making it a cornerstone of system hardening and network security in enterprise Linux environments.

How Has Firewall Management Evolved in RHEL?

The evolution of firewall management in Red Hat Enterprise Linux reflects the broader transformation in enterprise IT security. Earlier versions relied heavily on iptables, a powerful but complex tool that required intricate rule management. While effective, iptables configurations were often static and difficult for administrators to modify in real time without disrupting services.

With the introduction of FirewallD in RHEL 7, Red Hat aimed to simplify firewall administration by providing an abstraction layer that manages iptables rules dynamically. By RHEL 8 and RHEL 9, FirewallD had matured, adding features like runtime and permanent configurations, integration with systemd, and support for cloud-native workloads. Now, in RHEL 10, FirewallD builds upon this foundation by offering enhanced automation, compatibility with containerized environments, and streamlined security for hybrid cloud infrastructures.

Core Principles of FirewallD

FirewallD in RHEL 10 operates on three fundamental principles:

1. Zone-Based Security

Zones represent levels of trust associated with network interfaces. For example, the public zone restricts most traffic except for explicitly allowed services, while the trusted zone permits all communication. Administrators can assign different interfaces to zones based on security requirements, offering flexibility across development, testing, and production environments.

2. Dynamic Rule Management

Unlike static rule sets, FirewallD allows administrators to modify rules on the fly. This eliminates downtime caused by service restarts, which is crucial in high-availability environments where even a minute of disruption can result in revenue loss or security exposure.

3. Service-Centric Approach

Instead of writing complex rules for every port and protocol, FirewallD provides predefined services. For example, enabling SSH access is as simple as running a single command. This not only reduces administrative overhead but also minimizes misconfigurations that could expose the system to attacks.

Key FirewallD Practices for RHEL 10

To secure RHEL 10 systems effectively, administrators must adopt best practices that align with enterprise-grade security standards. Below are some key practices:

1. Define Appropriate Zones

Assigning interfaces to correct zones is fundamental. Public-facing servers should use restrictive zones, while internal systems may leverage more permissive ones. Each zone can be customized to balance security with functionality.

2. Use Runtime and Permanent Rules

FirewallD distinguishes between runtime (temporary) and permanent configurations. Always test changes in runtime mode before committing them to permanent rules. This minimizes the risk of accidentally locking yourself out of the system.

3. Enable Logging

Enable firewall logging to monitor denied packets. This provides valuable insights into potential intrusion attempts and allows for fine-tuning of firewall rules.

4. Harden SSH Access

Restrict SSH to specific IP addresses, use non-standard ports where applicable, and leverage key-based authentication. Combine these with FirewallD service restrictions to build multiple layers of defense.

Essential FirewallD Commands with Examples

FirewallD provides a powerful yet simple command-line interface through the firewall-cmd tool. Below are some essential commands:

Check FirewallD Status

systemctl status firewalld

Displays whether FirewallD is active and running on your RHEL 10 system.

Start and Enable FirewallD

systemctl start firewalld
systemctl enable firewalld

Ensures the firewall starts automatically on system boot.

View Active Zones

firewall-cmd --get-active-zones

Shows which zones are currently in use and the interfaces assigned to them.

Allow a Service (Example: HTTP)

firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --reload

This opens port 80 (HTTP) for public access permanently.

Block a Port

firewall-cmd --zone=public --remove-port=8080/tcp --permanent
firewall-cmd --reload

Closes access to port 8080 in the public zone.

Enable Logging of Denied Packets

firewall-cmd --set-log-denied=all

Logs all denied connection attempts for monitoring and auditing purposes.

FirewallD vs iptables: Tool Comparison Table

Benefits of Using FirewallD in RHEL 10

FirewallD provides numerous advantages over legacy solutions, including:

• Dynamic rule updates without downtime.
• Zone-based approach that simplifies network segmentation.
• Predefined services that reduce misconfiguration risks.
• Strong integration with container and virtualization platforms.
• Improved IPv6 handling for modern enterprise environments.

Challenges in Managing FirewallD

Despite its strengths, FirewallD is not without challenges:

• Learning curve for administrators transitioning from iptables.
• Complexity in managing custom services for niche protocols.
• Risk of misconfigured runtime rules if not carefully tested.
• Integration issues in hybrid environments with legacy applications.

The Future of FirewallD in Enterprise Linux

Looking forward, FirewallD is expected to integrate more tightly with automation frameworks such as Ansible and Terraform, enabling infrastructure-as-code approaches to firewall management. With enterprises moving toward zero-trust architectures, FirewallD’s zone and service model aligns well with fine-grained security requirements. In RHEL 10 and beyond, we can expect continued enhancements in usability, performance, and compatibility with containerized workloads in Kubernetes and OpenShift environments.

Conclusion

FirewallD in RHEL 10 is more than just a firewall—it is a modern, dynamic, and enterprise-ready security management solution. By leveraging its zones, services, and runtime flexibility, administrators can build resilient and secure environments that scale across hybrid and cloud-native infrastructures. While challenges exist in terms of complexity and adaptation, the benefits far outweigh the learning curve. For organizations adopting RHEL 10, mastering FirewallD is an essential step toward building a proactive and robust security posture.