Mon Sep 14 10:29:42 AM EDT 2026

Remember selinux, reload the firewall

list statuses

firewall-cmd --list-all-zones

cat /etc/firewalld/zones/public.xml

open port [1]

[tcarrigan@server ~]$ sudo firewall-cmd --permanent --zone=external --add-port=60001/udp

sudo firewall-cmd --permanent --zone=external --add-port=60001/udp
sudo firewall-cmd --permanent --zone=public --add-port=8080/tcp
sudo firewall-cmd --permanent --zone=public --add-port=8081/tcp
sudo firewall-cmd --permanent --zone=public --add-port=8082/tcp
sudo firewall-cmd --permanent --zone=public --add-port=8000/tcp

sudo firewall-cmd --permanent --zone=public --add-port=9999/tcp


firewall-cmd --reload

setup:

allow specific port from specific host [2]

Try this command

firewall-cmd --permanent --zone=public --add-rich-rule='
  rule family="ipv4"
  source address="1.2.3.4/32"
  port protocol="tcp" port="4567" accept'

Check the zone file later to inspect the XML configuration

cat /etc/firewalld/zones/public.xml

Reload the firewall

firewall-cmd --reload

[3] [4]

firewall-cmd --zone=public --add-rich-rule='rule family="ipv4" source address="11.22.33.44" accept' --permanent

more examples [5] [6]

- firewalld:
    zone=public
    rich_rule='rule family="ipv4" source address="11.22.33.44" port port="6556" protocol="tcp" accept'
    permanent=true

references 1 https://www.redhat.com/sysadmin/beginners-guide-firewalld 2 https://serverfault.com/questions/684602/how-to-open-port-for-a-specific-ip-address-with-firewall-cmd-on-centos 3 https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/security_guide/configuring_complex_firewall_rules_with_the_rich-language_syntax#Understanding_the_Rich_Rule_Structure 4 https://stackoverflow.com/questions/39967184/ansible-how-to-whitelist-ips-using-firewalld-module 5 https://docs.ansible.com/ansible/latest/collections/ansible/posix/firewalld_module.html#examples 6 https://docs.checkmk.com/latest/en/ports.html