Status
systemctl status firewalld
firewall-cmd --state
firewall-cmd --list-all
Allow common services
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-port=8080/tcp
firewall-cmd --reload
Block an IP
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.5 reject'
firewall-cmd --reload
Restrict port to subnet
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.1.0/24 port port=3306 protocol=tcp accept'
firewall-cmd --reload
Zones
firewall-cmd --permanent --zone=internal --add-interface=eth1
firewall-cmd --permanent --zone=internal --add-service=mysql
firewall-cmd --reload
