firewall-cmd tips — authorized firewalld CLI literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run firewall-cmd on the lab host (syllabus box you own or were given access to; typically needs root/CAP).
2. Prefer documenting who / why / ticket before any permanent rule change — never open production ports without change control.
3. Record short factual notes; quote short Evidence (zone + service/port names — never secrets).
4. Optional: daemon overview peer → firewalld-tips.
5. Optional: classic iptables peers → iptables-tips / iptables-save-tips.
6. Prefer disposable lab VMs for firewall-cmd drills; quote non-secret zone/service labels afterward as Evidence.
7. Prefer read-only --list-all / --get-active-zones for most Evidence binders — refuse unauthorized hostile-open cookbooks.
8. Stop at literacy — no attack or unauthorized firewall-bypass cookbooks.

Allowed framing

• Classroom labs reviewing firewall-cmd --list-all and --get-services on authorized disposable hosts.
• Binding short factual notes as Evidence (zone + service/port — no secrets).
• Documenting expected vs observed firewalld zone inventory for authorized notes.
• Comparing firewall-cmd ↔ firewalld / iptables / iptables-save peer tip pages under one binder.
• Testing syllabus-approved zone/service changes only when change control authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via firewall-cmd.
• No intentional unauthorized firewall opens against foreign hosts.
• No secret-theft or zone-inventory credential harvesting against hosts you do not own.
• No cookbooks that weaken host firewalls via hostile port opens for attack without authorization.
• No --add-port / --permanent framed as an exploit step against production.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with firewalld / firewall-cmd available.
2. Prefer a throwaway lab VM before any permanent rule drill.
3. With authorization, run firewall-cmd --list-all; quote selected zone/service labels as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized firewall-bypass cookbooks.

Practical notes for authorized labs

• firewall-cmd is the firewalld CLI — keep Evidence labels distinct from firewalld-tips daemon overview and iptables-tips classic tables.
• Pair with iptables-save-tips when the syllabus compares firewalld persistence vs iptables-save.
• Zone lists are generally non-secret — still avoid pasting unrelated host inventories into notes or git.
• Prefer documenting zone / service / port names the syllabus authorized without dumping unrelated privileged state.
• Never commit firewalld dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host firewall-cmd / port open → refuse.
• Unauthorized firewall-bypass / hostile-open attack cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources