CentOS 7 Firewall: Checking Open Ports

TL;DR

Yes, CentOS 7’s firewalld may have open ports by default depending on the services installed and active. This guide shows you how to check which ports are currently open and how to manage them for better cyber security.

Checking Open Ports with Firewalld

1. Understand Firewalld Zones: Firewalld uses zones to define trust levels for network connections. Common zones include ‘public’, ‘home’, ‘work’ and ‘trusted’. The active zone determines which ports are open.
   • To find your active zone:

     firewall-cmd --get-active-zones

2. List All Ports for the Active Zone: This shows you all ports currently allowed in your default zone.
   • Use this command, replacing ‘public’ with your active zone if it’s different:

     firewall-cmd --list-ports --zone=public

3. List All Services for the Active Zone: Firewalld often allows services instead of individual ports. This command shows which services are enabled.
   • Again, replace ‘public’ with your active zone:

     firewall-cmd --list-services --zone=public

4. Check Permanent vs. Runtime Configuration: Firewalld has a runtime configuration (changes are lost on reboot) and a permanent configuration.
   • To see the permanent ports:

     firewall-cmd --list-ports --zone=public --permanent

   • To see the permanent services:

     firewall-cmd --list-services --zone=public --permanent

5. Check if a Specific Port is Open: You can directly query if a specific port is open.
   • For example, to check if port 80 (HTTP) is open:

     firewall-cmd --query-port=80/tcp --zone=public

Managing Open Ports

1. Opening a Port: If you need to allow access through a specific port.
   • To open port 80 (HTTP) permanently:

     firewall-cmd --permanent --zone=public --add-port=80/tcp

   • Reload firewalld to apply the changes:

     firewall-cmd --reload

2. Closing a Port: If you want to block access through a specific port.
   • To close port 80 (HTTP) permanently:

     firewall-cmd --permanent --zone=public --remove-port=80/tcp

   • Reload firewalld to apply the changes:

     firewall-cmd --reload

3. Opening a Service: If you need to allow access for a specific service.
   • To open the ‘http’ service permanently:

     firewall-cmd --permanent --zone=public --add-service=http

   • Reload firewalld to apply the changes:

     firewall-cmd --reload

4. Closing a Service: If you want to block access for a specific service.
   • To close the ‘http’ service permanently:

     firewall-cmd --permanent --zone=public --remove-service=http

   • Reload firewalld to apply the changes:

     firewall-cmd --reload