Use firewalld safely on an ArkHost Linux VPS Печать

This article is for ArkHost Linux VPS services that run firewalld. It does not apply to shared or managed hosting, to other firewall tools, or to every distribution. Do not change firewall rules on a managed or shared hosting service.

Look before you change

Inspect the current state before changing anything:

firewall-cmd --get-active-zones
firewall-cmd --list-all

Note which zone is active, which interface it covers, and which services and ports it currently allows.

Before changing rules

Add one rule at a time

Add only the services you deliberately operate, one service or port at a time, and test each addition from a new connection before continuing:

firewall-cmd --add-service=<service-name>
firewall-cmd --add-port=<port>/<protocol>

After the tested runtime rule works, add that same rule with --permanent and reload:

firewall-cmd --add-service=<service-name> --permanent
firewall-cmd --add-port=<port>/<protocol> --permanent
firewall-cmd --reload

A public zone should allow only services you actually run. Remove entries you do not need. firewalld controls incoming traffic to the VPS; do not assume it filters outgoing traffic in every configuration.