Use firewalld safely on an ArkHost Linux VPS Print

This guide is for an ArkHost Linux VPS that already uses firewalld. It does not apply to shared hosting or a server managed by another firewall tool.

Inspect the active zone

Run these read-only checks with administrative privileges:

sudo firewall-cmd --get-active-zones
sudo firewall-cmd --get-default-zone

Identify the zone attached to the interface or source address you intend to change. The default zone is not necessarily that zone. Replace YOUR_ZONE below with the actual name:

sudo firewall-cmd --zone=YOUR_ZONE --list-all
sudo firewall-cmd --permanent --zone=YOUR_ZONE --list-all

Runtime and permanent settings can differ. Record both before changing anything.

Keep a recovery route

Confirm you can log in through the browser console in your ArkHost Client Area. Keep your SSH session open and test a new session after each change. Preserve the actual SSH port in the correct zone.

Add a scoped rule

For example, if you operate a public HTTPS service, add it to the intended zone at runtime:

sudo firewall-cmd --zone=YOUR_ZONE --add-service=https

Test the service from the intended client and verify a new SSH connection. If the rule is wrong, remove that specific addition:

sudo firewall-cmd --zone=YOUR_ZONE --remove-service=https

When the runtime rule works, save the same rule permanently:

sudo firewall-cmd --permanent --zone=YOUR_ZONE --add-service=https
sudo firewall-cmd --check-config

You have now added the rule to both runtime and permanent configuration. You do not need a reload just to apply that rule. A reload replaces runtime configuration with the permanent configuration and can discard other runtime-only rules, including administrative access.

Custom ports and boundaries

For a custom service, use --add-port=PORT/tcp or --add-port=PORT/udp in the same zone, substituting the actual port. Add only what the application needs.

Do not assume ordinary zone rules filter all outgoing traffic or Docker-published ports. Check the behavior of containers and any additional network policies separately.

See the firewall-cmd manual for your installed version.