Adding ports to a firewalld zone

Having the service files is handy, except that not every service that you'll need to run has its own predefined service file. Let's say that you've installed Webmin on your server, which requires port 10000/tcp to be open. A quick grep operation will show that port 10000 isn't in any of our predefined services:

donnie@localhost services]$ pwd
 /usr/lib/firewalld/services
[donnie@localhost services]$ grep '10000' *
[donnie@localhost services]$

So, let's just add that port to our default zone, which is still the dmz zone:

donnie@localhost ~]$ sudo firewall-cmd --add-port=10000/tcp
 [sudo] password for donnie:
 success
[donnie@localhost ~]$

Again, this isn't permanent, because we didn't include the --permanent option. Let's do this again and reload:

[donnie@localhost ~]$ sudo firewall-cmd --permanent --add-port=10000/tcp
 success
 [donnie@localhost ~]$ sudo firewall-cmd --reload
 success
 [donnie@localhost ~]$

You can also add multiple ports at once by enclosing the comma-separated list within a pair of curly brackets, just as we did with the services (I purposely left --permanent out – you'll see why in a moment):

[donnie@localhost ~]$ sudo firewall-cmd --add-port={636/tcp,637/tcp,638/udp}
 success
[donnie@localhost ~]$

And of course, you can remove ports from a zone by substituting --remove-port for --add-port.

If you don't want to type --permanent every time you create a new permanent rule, just leave it out. Then, when you're done creating rules, make them all permanent at once by typing the following:

sudo firewall-cmd --runtime-to-permanent

Now's, let's turn our attention to controlling ICMP.