Set up firewalld on a Linux VPS by identifying the zone attached to your network interface, allowing SSH before tightening inbound access, adding only the services or ports your server needs, and saving the working configuration permanently. Firewalld separates its live runtime rules from its saved permanent rules, so you must deliberately persist changes and then verify them from both inside and outside the VPS.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What firewalld does on a VPS
firewalld is a dynamically managed firewall. It organizes rules into zones, each representing a level of trust for a network connection, interface, or source address. A zone can allow predefined services such as SSH, HTTP, and HTTPS, individual port-and-protocol combinations, rich rules, or a mixture of these.
As an Amazon Associate I earn from qualifying purchases.
The firewall that is actually enforcing traffic is the runtime configuration. It is applied in the kernel immediately. The permanent configuration is the saved policy loaded when firewalld starts. At service start, the permanent configuration becomes the runtime configuration. A command that changes only the permanent configuration does not open or close traffic until you reload or restart firewalld.
That distinction explains two common surprises: a rule can appear to work until a reboot because it was runtime-only, and a permanent rule can appear ineffective because it has not been reloaded. Firewalld reloads preserve existing connections, but you should still keep an active administrative session and an out-of-band recovery method while changing a remote firewall.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Before you change a remote firewall
Firewall changes on a VPS can disconnect you permanently if SSH is blocked and the provider offers no console access. Complete these checks first:
- Confirm the VPS distribution and release so you use the correct package manager.
- Keep your current SSH session open while applying and testing changes.
- Open a second SSH session if possible; it provides an immediate test without sacrificing the first session.
- Locate the provider’s web console, serial console, rescue mode, or other out-of-band access before adopting a restrictive policy.
- Record the current SSH port. It may be the standard port or a custom TCP port.
- List the services the VPS must expose. A web server commonly needs HTTP and HTTPS; a database or game server may need a specific application port instead.
Do not assume that the zone named public owns your interface. Provider images and distributions can choose different defaults.
Install and start firewalld
Package names and defaults vary by distribution. Use the command family for your VPS and check the service state after installation.
Debian or Ubuntu
sudo apt update
sudo apt install firewalld
sudo systemctl enable --now firewalldRHEL-compatible distributions
sudo dnf install firewalld
sudo systemctl enable --now firewalldopenSUSE and other zypper-based systems
sudo zypper install firewalld
sudo systemctl enable --now firewalldSome images already include and enable firewalld. In that case, systemctl enable --now firewalld is idempotent. Always verify the daemon rather than assuming installation succeeded:
sudo firewall-cmd --state
sudo systemctl status firewalld --no-pagerThe first command should report running. If it does not, inspect the service status and journal before editing rules:
sudo journalctl -u firewalld -b --no-pagerFind the active zone and VPS interface
Firewalld applies a zone according to an interface or source assignment. Discover that assignment before adding rules.
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --get-default-zone
sudo firewall-cmd --get-zone-of-interface=eth0
sudo firewall-cmd --list-allReplace eth0 with the actual interface name shown by your operating system. If you need to identify interfaces first, use your distribution’s normal network inspection tools, then pass the correct name to --get-zone-of-interface.
--get-active-zones reports zones currently bound to interfaces or sources. --get-default-zone shows the fallback zone for connections without another assignment. --list-all without a zone displays the default zone’s settings; to inspect a particular zone, specify it explicitly:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo firewall-cmd --zone=public --list-allUse the zone that actually owns the VPS interface in every subsequent command. The examples below use public only as a placeholder for that discovered zone.
Choose what the VPS should expose
Start with an allow-list. Inbound traffic not covered by an allowed service, port, or rule is controlled by the zone’s target and policy. Remove services you do not need rather than opening broad port ranges.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Requirement | Recommended firewalld form | Why |
|---|---|---|
| Standard SSH | Predefined ssh service |
Readable and tied to firewalld’s service definition. |
| Web traffic | Predefined http and https services |
Expresses the intent without memorizing port numbers. |
| One custom listener, such as 8080/tcp | Explicit port and protocol | Precise and easy to audit. |
| Source restrictions, logging, or compound conditions | Rich rule | More expressive, but syntax must be validated carefully. |
| Different trust levels for interfaces or sources | Separate zones | Creates clear policy boundaries, provided assignments are correct. |
A predefined service is a named collection maintained in firewalld’s service definitions. An explicit port rule is simply a port and transport protocol, such as 8080/tcp. Use the latter when no suitable service exists or when you need a narrowly defined listener.
Allow SSH before tightening inbound access
If you administer the VPS over SSH, make that access work in the active zone before removing anything else. For a server using the standard SSH service:
sudo firewall-cmd --zone=public --add-service=ssh
sudo firewall-cmd --permanent --zone=public --add-service=sshFor SSH on a custom port, allow the actual TCP port instead. The following example uses port 2222; replace it with your configured port and with the zone found during inspection:
sudo firewall-cmd --zone=public --add-port=2222/tcp
sudo firewall-cmd --permanent --zone=public --add-port=2222/tcpThe first command changes the live firewall. The second records the same allowance for future starts. Keep the existing session open, establish a second session, and test the port before proceeding. If you use an SSH service definition that has been customized to a nonstandard port, verify what that definition contains rather than assuming it covers your listener.
Free tools Windows power users keep installed
One-click scans. No signup required.
Allow HTTP, HTTPS, and application ports
Web server services
For a web server, use the predefined service names:
sudo firewall-cmd --zone=public --add-service=http
sudo firewall-cmd --zone=public --add-service=https
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=httpsThese commands permit the protocols represented by firewalld’s HTTP and HTTPS service definitions. They do not start a web server; the application must be installed, running, and listening on the expected sockets.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
One custom TCP or UDP listener
When the application has no appropriate predefined service, specify its exact port and protocol. This example opens TCP port 8080:
sudo firewall-cmd --zone=public --add-port=8080/tcp
sudo firewall-cmd --permanent --zone=public --add-port=8080/tcpUse udp when the application genuinely uses UDP. TCP and UDP are separate rules; opening one does not open the other. Avoid broad ranges unless the application documentation requires them, because every extra exposed port increases the policy you must maintain and troubleshoot.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSeveral ports or richer metadata
If an application needs several related ports, a custom firewalld service definition can be clearer than a long, opaque command sequence. A service definition can describe the application and its ports in one named object. Use a rich rule when you need source-address limits, logging, or other conditions that a simple service or port rule cannot express. Validate rich-rule syntax before relying on it in production.
Runtime versus permanent rules
Every change should have an intentional lifecycle. Runtime rules are effective immediately but disappear when firewalld restarts unless they are copied into the permanent configuration. Permanent rules are saved but inert until a reload or restart activates them.
Apply and save each rule
The clearest approach for a small change is to issue one runtime command and one permanent command, as shown in the SSH and web examples. This lets you test the live result immediately while ensuring it will return after a reboot.
Build in runtime, then save the tested state
For a larger change, build and test the policy in runtime first. Once access and services work, copy the complete runtime configuration to permanent storage and reload:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →sudo firewall-cmd --runtime-to-permanent
sudo firewall-cmd --reloadThis avoids accidentally omitting one of several commands. Review the runtime policy before copying it so temporary experiments do not become part of the boot configuration.
Write permanent rules first
You can also add rules with --permanent while preparing a change, then activate all saved rules together:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
sudo firewall-cmd --reloadA reload replaces the runtime configuration with the saved permanent configuration. Firewalld’s concepts documentation notes that existing connections are maintained during a reload, but new connections are evaluated against the newly active policy. Keep an administrative session available in case the resulting policy is not what you intended.
Verify the configuration before leaving the VPS
Inspect the exact zone that owns the interface, not just the default zone:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo firewall-cmd --zone=public --list-all
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=public --query-service=ssh
sudo firewall-cmd --zone=public --query-service=http
sudo firewall-cmd --zone=public --query-service=https
sudo firewall-cmd --zone=public --list-portsA query command returns whether the requested service is enabled. The port listing shows explicit port rules; predefined services appear in the services portion of --list-all, not necessarily in the port list.
Check both configurations when diagnosing persistence. Add --permanent to inspection commands when you need to see the saved policy:
sudo firewall-cmd --permanent --zone=public --list-allThen confirm the application is listening locally. For example:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo ss -lntupLook for the expected address, port, and protocol. A firewall allowance cannot make an application listen, and a process bound only to loopback will not accept connections arriving through the VPS’s public interface.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test from outside the VPS
Use a separate machine or network to test the intended service. An HTTPS client can request the public URL for a web service; a TCP connectivity check can test a custom listener. Testing externally matters because local checks can bypass routing, address-family, or upstream filtering issues.
Interpret an external failure in layers:
- Confirm the process is listening on the VPS with
ssor the application’s own status command. - Confirm the firewalld rule is in the zone attached to the public interface.
- Confirm the rule uses the correct protocol. A TCP rule does not permit UDP.
- Check whether the application is intended to accept IPv4, IPv6, or both. A successful test over one address family does not prove the other is reachable.
- Check the VPS provider’s security group, network firewall, or edge ACL. An upstream block cannot be overridden by firewalld on the guest.
For a web server, also verify that the service is bound to the expected hostname and address and that any TLS configuration is valid. For a custom application, compare the externally tested port with the port in the service’s configuration rather than assuming they match.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Use zones when interfaces or sources have different trust
Separate zones are useful when one interface or source should receive a different policy from another. For example, an internal interface can have a more permissive application policy while the public interface exposes only SSH and web services. The security benefit comes from the assignment: a carefully written zone does nothing if the interface or source is attached to the wrong one.
Inspect assignments with:
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --get-zone-of-interface=eth0When changing assignments, verify the resulting zone immediately and test through the relevant network path. Treat source-based zones with the same caution as interface-based zones; a source range that is too broad can grant access to more hosts than intended.
Troubleshoot common failures
firewall-cmd --state is not running
Do not continue adding rules while the daemon is stopped. Check the unit and its boot journal:
sudo systemctl status firewalld --no-pager
sudo journalctl -u firewalld -b --no-pagerResolve the service or configuration error, start firewalld, and then inspect the active zones before applying policy.
A rule disappeared after reboot or reload
The rule was probably added only to runtime. Add the permanent form or copy a tested runtime policy with:
Recommended Free Tools
sudo firewall-cmd --runtime-to-permanentIf the rule vanished after a reload rather than a reboot, check whether you edited the permanent configuration and then reloaded from an older saved state. Compare --list-all with --permanent --list-all for the same zone.
SSH disconnected
Use the provider console or another out-of-band path to restore the SSH service or the actual custom port in the zone assigned to the public interface. Do not blindly add the rule to public if inspection shows another zone owns the interface. After recovery, keep a second session open while correcting and testing the permanent policy.
The rule looks correct but the service is unreachable
Check the application’s listening socket, interface binding, protocol, and address family. Then inspect provider-level security controls. A guest firewall rule cannot compensate for a process that is stopped, listening only on loopback, using UDP instead of TCP, or blocked before traffic reaches the VPS.
A custom service needs many ports
Consider a named firewalld service definition so the policy remains understandable and maintainable. If the requirement is conditional access, source filtering, or logging, use a rich rule and validate its syntax. Avoid concealing a large port set in undocumented one-off commands.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A repeatable setup sequence
For a new Linux VPS, the following order minimizes lockouts and makes the final state auditable:
Quick Recap
- Install firewalld with the distribution’s package manager and enable it with
sudo systemctl enable --now firewalld. - Confirm
sudo firewall-cmd --statereportsrunning. - Discover the active zone and interface with
--get-active-zonesand--get-zone-of-interface. - Allow SSH in that zone, using either the predefined service or the actual custom port.
- Open only the HTTP, HTTPS, and application ports the VPS requires.
- Test the runtime policy from a second session and from an external machine.
- Copy the tested policy to permanent storage with
--runtime-to-permanent, or add permanent rules directly. - Reload firewalld and verify the zone, services, ports, and application listeners.
- Reboot during a planned maintenance window if you need to prove the saved policy survives a full service start, then repeat the verification.
Final checklist
- The daemon is running and enabled.
- The public interface and its owning zone are known.
- SSH access is allowed on the real port before other exposure is reduced.
- Only required services and exact protocols are open.
- Runtime and permanent configurations agree.
- Reload and reboot behavior have been considered.
- The application is listening locally.
- External tests succeed.
- Any provider-level firewall permits the same intended traffic.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
