Firewalld is Fedora’s way to provide dynamic firewall properties in Linux. Thus way changes in the firewall configuration are applied immediately, without the need to restart. Additionally, firewalld supports D-BUS and zone concepts.

Firewalld replaced Fedora’s old firewall mechanism with Fedora 18. One of the main motivations for a new firewall system was that the old solution required a firewall restart and was thus breaking all statefull connections at each change. Additionally, Firewalld supports dynamic zones which comes in handy when using it with mobile devices as laptops: you can have different zones, thus different sets of rules, for your work network and for your home network.

Besides, to better integrate the system firewall with other applications D-BUS support was integrated into Firewalld, and the configuration is eased for the user via a GUI and a command line helper which is covered here.

If you want to use Firewalld, it might be a good idea to check on which zone you actually are running:

firewall-cmd --get-active-zone
home: wlan0

It shows the devices and the given zones.

You can list all available zones by:

# firewall-cmd --get-zones
drop work internal external trusted home dmz public block

So, if you want to change a zone on a network for example because you just started your VPN tunnel to your homenetwork, just do it:

# firewall-cmd --zone=external --change-interface=wlan0

There is no return code shown, unfortunately, but you can query the current zone again to see if it worked.

But since we are talking about dynamic firewall changes, the really interesting part is to open and close ports. Another way to look at it would be to allow or deny the access to services. The difference is that a service can be a list of several ports.

As a result, you can query the enabled services (no ports shown), or enabled ports (no services shown), or list all (everything shown):

# firewall-cmd --zone=home --list-services
mdns ipp-client dhcpv6-client ssh samba-client

The story looks different for a zone like external:

# firewall-cmd --zone=public --list-services
ssh

The port query looks just the same, but includes the actual port and protocol:

# firewall-cmd --zone=external --list-ports
3333/tcp

As mentioned above, the safest bet is to always query everything:

# firewall-cmd --zone=external --list-all
external
  interfaces: wlan0
  services: ssh
  ports: 3333/tcp
  forward-ports: 
  icmp-blocks:

As you probably know anyway, if you want to test that the port is actually reachable from the outside, start nc -l 3333 and try to telnet to that port.

But that’s all nothing without the ability, to open and close ports:

# firewall-cmd --zone=external --add-port=2222/tcp
# firewall-cmd --zone=external --list-ports
3333/tcp 2222/tcp

Closing the port is just as easy:

# firewall-cmd --zone=external --remove-port=2222/tcp
# firewall-cmd --zone=external --list-ports
3333/tcp

As you see the dynamic and zone features of Firewalld work pretty neatly. However, I do not see the benefit of Firewalld for server environments. There you usually have no changing connection …read more

Source: FULL ARTICLE at Planet KDE