firewalld

Firewalld is a firewall management tool for Linux that provides a dynamically configurable firewall using a zone-based approach. It abstracts the underlying packet filtering backend and supports both IPv4 and IPv6. Firewalld runs as a daemon in the background and uses a runtime configuration and a permanent configuration, allowing changes to take effect immediately while remaining persistent across reboots. The firewall rules are implemented on top of either nftables or iptables, depending on the system's backend.

Key concepts include zones, services, ports, and rich rules. Zones represent trust levels for network connections and are assigned to network interfaces or sources. Examples commonly shipped with Firewalld include public, home, work, internal, and drop. Services are predefined sets of ports and protocols (for example, http, ssh) and can be enabled in a zone without naming individual ports. Rich rules allow fine-grained filtering, such as permitting or blocking traffic based on source, destination, interface, or protocol, beyond the standard zone/service model.

Configuration can be changed at runtime or made permanent. The command-line tool firewall-cmd is used to query and modify settings, with options such as --zone, --add-service, --add-port, --add-rich-rule, and --permanent. To apply permanent changes, use --reload. A graphical configuration tool, firewall-config, is available in many desktop environments.

Firewalld integrates with NetworkManager and other networking services and ships with distributions such as Fedora and Red Hat Enterprise Linux. Service definitions for common networks are typically located in /usr/lib/firewalld/services and can be overridden in /etc/firewalld/services. The daemon maintains the active rules and supports runtime changes without restarting the service.