## Initial information
| Command | Description |
| ----------------------------------------------------------- | ---------------------------------------- |
| firewall-cmd --state | Get the status of firewalld |
| firewall-cmd --reload | Reload the firewall |
| firewall-cmd --get-zones | List of all supported zones |
| firewall-cmd --get-services | List of all supported services |
| firewall-cmd --get-icmptypes | List of all supported icmptypes |
| firewall-cmd --list-all-zones | List all zones with the enabled features |
| firewall-cmd [--zone=<zone>] --list-all | Print zone with the enabled features |
| firewall-cmd --get-default-zone | Get the default zone |
| firewall-cmd --set-default-zone=<zone> | Set the default zone |
| firewall-cmd --get-active-zones | Get active zones |
| firewall-cmd --get-zone-of-interface=<interface> | Get zone related to an interface |
## Interface
| Command | Description |
| ----------------------------------------------------------------------- | --------------------------------------- |
| firewall-cmd [--zone=<zone>] --add-interface=<interface> | Add an interface to a zone |
| firewall-cmd [--zone=<zone>] --change-interface=<interface> | Change the zone an interface belongs to |
| firewall-cmd [--zone=<zone>] --remove-interface=<interface> | Remove an interface from a zone |
| firewall-cmd [--zone=<zone>] --query-interface=<interface> | Query if an interface is in a zone |
| firewall-cmd [ --zone=<zone> ] --list-services | List the enabled services in a zone |
## Service
| Command | Description |
| ----------------------------------------------------------------------------------------- | --------------------------------------- |
| firewall-cmd [--zone=<zone>] --add-service=<service> [--timeout=<seconds>] | Enable a service in a zone |
| firewall-cmd [--zone=<zone>] --remove-service=<service> | Disable a service in a zone |
| firewall-cmd [--zone=<zone>] --query-service=<service> | Query if a service is enabled in a zone |
## Source
| Command | Description |
| ------------------------------------------------------------------------------------------ | -------------------------------------- |
| firewall-cmd [--zone=<zone>] --add-source=<address> [--timeout=<seconds>] | Enable a source in a zone |
| firewall-cmd [--zone=<zone>] --remove-source=<address> | Disable a source in a zone |
| firewall-cmd [--zone=<zone>] --query-source=<address> | Query if a source is enabled in a zone |
## ICMP
| Command | Description |
| ----------------------------------------------------------------------- | ----------------------------- |
| firewall-cmd [--zone=<zone>] --add-icmp-block=<icmptype> | Enable ICMP blocks in a zone |
| firewall-cmd [--zone=<zone>] --remove-icmp-block=<icmptype> | Disable ICMP blocks in a zone |
| firewall-cmd [--zone=<zone>] --query-icmp-block=<icmptype> | Query ICMP blocks in a zone |
| firewall-cmd --zone=public --add-icmp-block=echo-reply | **Example:** |
## Port and protocol combination
| Command | Description |
| ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| firewall-cmd [--zone=<zone>] --add-port=<port>[-<port>]/<protocol> [--timeout=<seconds>] | Enable a port and protocol combination in a zone |
| firewall-cmd [--zone=<zone>] --remove-port=<port>[-<port>]/<protocol> | Disable a port and protocol combination in a zone |
| firewall-cmd [--zone=<zone>] --query-port=<port>[-<port>]/<protocol> | Query if a port and protocol combination in enabled in a zone |
## Port forwarding or port mapping
| Command | Description |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- |
| firewall-cmd [--zone=<zone>] --add-forward-port=port=<port>[-<port>]:proto=<protocol> { :toport=<port>[-<port>] \| :toaddr=<address> \| :toport=<port>[-<port>]:toaddr=<address> } | Enable port forwarding or port mapping in a zone |
| firewall-cmd [--zone=<zone>] --remove-forward-port=port=<port>[-<port>]:proto=<protocol> { :toport=<port>[-<port>] \| :toaddr=<address> \| :toport=<port>[-<port>]:toaddr=<address> } | Disable port forwarding or port mapping in a zone |
| firewall-cmd [--zone=<zone>] --query-forward-port=port=<port>[-<port>]:proto=<protocol> { :toport=<port>[-<port>] \| :toaddr=<address> \| :toport=<port>[-<port>]:toaddr=<address> } | Query port forwarding or port mapping in a zone |
| firewall-cmd --zone=home --add-forward-port=port=22:proto=tcp:toaddr=127.0.0.2 | **Example:** |
## Sources
[firewall-cmd Cheat Sheet by mikael.leberre - Download free from Cheatography - Cheatography.com: Cheat Sheets For Every Occasion](https://cheatography.com/mikael-leberre/cheat-sheets/firewall-cmd/)