CentOS 7 - fresh instance. I want to open port 8888, so issued:

# firewall-cmd --zone=public --add-port=8888/tcp --permanent
# firewall-cmd --reload
# netstat -plnt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0  *               LISTEN      1706/master         
tcp        0      0 *               LISTEN      1470/sshd           
tcp6       0      0 ::1:25                  :::*                    LISTEN      1706/master         
tcp6       0      0 :::26532                :::*                    LISTEN      1470/sshd  

Where is port 8888? So I try:

# firewall-cmd --zone=public --list-all
public (default)
  services: dhcpv6-client https
  ports:  8888/tcp 26532/tcp  
  masquerade: no
  rich rules: 

What? How come this shows port 8888? So I try:

# lsof -i
chronyd  497  chrony    1u  IPv4  12405      0t0  UDP my.srvr.com:323 
chronyd  497  chrony    2u  IPv6  12406      0t0  UDP localhost:323 
sshd    1321    root    3u  IPv4  14788      0t0  TCP *:26532 (LISTEN)
sshd    1321    root    4u  IPv6  14797      0t0  TCP *:26532 (LISTEN)
master  1716    root   13u  IPv4  15666      0t0  TCP my.srvr.com:smtp (LISTEN)
master  1716    root   14u  IPv6  15667      0t0  TCP localhost:smtp (LISTEN)
sshd    1969    root    3u  IPv4  71914      0t0  TCP my.srvr.com:26532-> (ESTABLISHED)
sshd    1971     rob    3u  IPv4  71914      0t0  TCP my.srvr.com:26532-> (ESTABLISHED)
smtpd   2572 postfix    6u  IPv4  15666      0t0  TCP my.srvr.com:smtp (LISTEN)
smtpd   2572 postfix    7u  IPv6  15667      0t0  TCP localhost:smtp (LISTEN)

So where is port 8888? Why does it show up under firewall-cmd but not the others?

  • 1
    It shows up in the firewall-cmd --list-all output because that lists the firewall settings.  It doesn't show up in the netstat and lsof outputs because they show system activity.  If you run a program that uses port 8888, it will appear in netstat and lsof. – G-Man Says 'Reinstate Monica' Nov 29 '16 at 22:31
  • Yes, just had not clued into that fact that they are two different things. Thanks! – rtfminc Nov 29 '16 at 23:35

Opening a port in the firewall does not automatically mean that an application will try to bind it. These are separate things. Applications can bind to ports that haven't been opened in the firewall and vice versa.

firewall-cmd (and probably also iptables -L) shows you what your firewall looks like.

netstat and lsof show you what your applications are doing and trying to do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.