Open firewall port on CentOS 7

Question

I am using CentOS 7 and I have to ensure that ports 2888 and 3888 are open   I read this article but this did not work because on CentOS 7 OS there is no iptables save command   Someone told me that the above URL is not valid for CentOS 7  and I should follow this   But this article is not clear to me on exactly what command I need to execute   I also found   firewall-cmd --zone public --add-port 2888 tcp    but this does not survive reboots   So how can I open the ports and make it survive reboots

User · Answer

If you are familiar with iptables service like in centos 6 or earlier, you can still use iptables service by manual installation:

step 1 => install epel repo

yum install epel-release

step 2 => install iptables service

yum install iptables-services

step 3 => stop firewalld service

systemctl stop firewalld

step 4 => disable firewalld service on startup

systemctl disable firewalld

step 5 => start iptables service

systemctl start iptables

step 6 => enable iptables on startup

systemctl enable iptables

finally you're now can editing your iptables config at /etc/sysconfig/iptables.

So -> edit rule -> reload/restart.

do like older centos with same function like firewalld.

User · Answer

CentOS  RHEL  7  has changed the firewall to use firewall-cmd which has a notion of zones which is like a Windows version of Public  Home  and Private networks   You should look here to figure out which one you think you should use   EL7 uses public by default so that is what my examples below use   You can check which zone you are using with firewall-cmd --list-all and change it with firewall-cmd --set-default-zone  lt zone gt    You will then know what zone to allow a service  or port  on   firewall-cmd --permanent --zone  lt zone gt  --add-service http  firewall-cmd --permanent --zone  lt zone gt  --add-port 80 tcp  You can check if the port has actually be opened by running    firewall-cmd --zone  lt zone gt  --query-port 80 tcp  firewall-cmd --zone  lt zone gt  --query-service http  According to the documentation      When making changes to the firewall settings in Permanent mode  your   selection will only take effect when you reload the firewall or the   system restarts    You can reload the firewall settings with  firewall-cmd --reload

User · Answer

The answer by ganeshragav is correct  but  it is also useful to know that you can use   firewall-cmd --permanent --zone public --add-port 2888 tcp    but if is a known service  you can use   firewall-cmd --permanent --zone public --add-service http    and then reload the firewall  firewall-cmd --reload     Answer modified to reflect Martin Peter s comment  original answer had --permanent at end of command line

User · Answer

To view open ports  use the following command   firewall-cmd --list-ports   We use the following to see services whose ports are open   firewall-cmd --list-services   We use the following to see services whose ports are open and see open ports   firewall-cmd --list-all   To add a service to the firewall  we use the following command  in which case the service will use any port to open in the firewall   firewall-cmd --add-services ntp    For this service to be permanently open we use the following command   firewall-cmd    add-service ntp --permanent    To add a port  use the following command  firewall-cmd --add-port 132 tcp  --permanent   To run the firewall must be reloaded using the following command   firewall-cmd --reload   Ya Ali

User · Answer

If you have multiple ports to allow in Centos 7 FIrewalld then we can use the following command      firewall-cmd --add-port  port number tcp port number tcp  --permanent   firewall-cmd --reload   And check the Port opened or not after reloading the firewall     firewall-cmd --list-port   For other configuration  Linuxwindo com  1

User · Answer

Firewalld is a bit non-intuitive for the iptables veteran   For those who prefer an iptables-driven firewall with iptables-like syntax in an easy configurable tree  try replacing firewalld with fwtree     https   www linuxglobal com fwtree-flexible-linux-tree-based-firewall  and then do the following    echo  -p tcp --dport 80 -m conntrack --cstate NEW -j ACCEPT   gt   etc fwtree d filter INPUT 80-allow rule  systemctl reload fwtree

User · Answer

The top answers here work  but I found something more elegant in Michael Hampton s answer to a related question   The  new   firewalld-0 3 9-11   --runtime-to-permanent option to firewall-cmd lets you create runtime rules and test them out before making them permanent     firewall-cmd --zone  lt zone gt  --add-port 2888 tcp  lt Test it out gt    firewall-cmd --runtime-to-permanent   Or to revert the runtime-only changes     firewall-cmd --reload   Also see Antony Nguyen s comment   Apparently firewall-cmd --reload may not work properly in some cases where rules have been removed  In that case  he suggests restarting the firewalld service     systemctl restart firewalld

User · Answer

While ganeshragav and Sotsir provide correct and directly applicable approaches  it is useful to note that you can add your own services to  etc firewalld services  For inspiration  look at  usr lib firewalld services   where firewalld s predefined services are located   The advantage of this approach is that later you will know why these ports are open  as you ve described it in the service file  Also  you can now apply it to any zone without the risk of typos  Furthermore  changes to the service will not need to be applied to all zones separately  but just to the service file   For example  you can create  etc firewalld services foobar xml    lt  xml version  1 0  encoding  utf-8   gt   lt service gt     lt short gt FooBar lt  short gt     lt description gt      This option allows you to create FooBar connections between     your computer and mobile device  You need to have FooBar     installed on both sides for this option to be useful     lt  description gt     lt port protocol  tcp  port  2888   gt     lt port protocol  tcp  port  3888   gt   lt  service gt     For information about the syntax  do man firewalld service    Once this file is created  you can firewall-cmd --reload to have it become available and then permanently add it to some zone with  firewall-cmd --permanent --zone  lt zone gt  --add-service foobar   followed with firewall-cmd --reload to make it active right away

User · Answer

Use this command to find your active zone s    firewall-cmd --get-active-zones   It will say either public  dmz  or something else  You should only apply to the zones required    In the case of public try   firewall-cmd --zone public --add-port 2888 tcp --permanent   Then remember to reload the firewall for changes to take effect   firewall-cmd --reload   Otherwise  substitute public for your zone  for example  if your zone is dmz   firewall-cmd --zone dmz --add-port 2888 tcp --permanent

User · Answer

Fedora  did it via iptables  sudo iptables -I INPUT -p tcp --dport 3030 -j ACCEPT sudo service iptables save   Seems to work

User · Answer

To view open ports  use the following command   firewall-cmd --list-ports   We use the following to see services whose ports are open   firewall-cmd --list-services   We use the following to see services whose ports are open and see open ports   firewall-cmd --list-all   To add a service to the firewall  we use the following command  in which case the service will use any port to open in the firewall   firewall-cmd --add-services ntp    For this service to be permanently open we use the following command   firewall-cmd -add-service ntp --permanent    To add a port  use the following command   firewall-cmd --add-port 132 tcp  --permanent

User · Answer

Hello in Centos 7 firewall-cmd   Yes correct if you use  firewall-cmd --zone public --add-port 2888 tcp  but if you reload firewal firewall-cmd --reload  your config not will be save  you need to add key  firewall-cmd --permanent --zone public --add-port 2888 tcp

[centos] Open firewall port on CentOS 7

Examples related to centos

Examples related to port

Examples related to firewall