If I open an individual port on a zone using FirewallD and query the port it comes back with yes (allowed).

firewall-cmd --zone=zonename --add-port=6005/tcp
firewall-cmd --zone=zonename --query-port=6005/tcp

If I open a port range and run a query on a port within that range, it comes back with no (blocked).

firewall-cmd --zone=zonename --add-port=6000-6010/tcp
firewall-cmd --zone=zonename --query-port=6005/tcp

Is this normal behaviour or am I not doing something correctly? (These rules are also added using --permanent and I do issue a reload after each change).

1 Answer 1


From RHEL support, this is by design. You need to query the whole port range to get "yes". Querying for individual ports within the range is not supported.

  • because it is how the rules in iptables look like ...
    – Jakuje
    Dec 12, 2016 at 17:28
  • @Jakuje yeah I didn't know this. I had another support question open and asked about this too. I thought it actually probed the firewall and not just looked at the rules. If you have complicated setups it would be nice for it to tell you yes that port is open under the range x-y.
    – MarcLaf
    Dec 12, 2016 at 18:38
  • 1
    Sure. But underlying mechanism under firewalld is iptables, which is based on such rules. Though, good you resolved your case.
    – Jakuje
    Dec 12, 2016 at 18:40
  • @Jakuje That's why I was confused... where were you 2 weeks ago when I posted the question? lol
    – MarcLaf
    Dec 12, 2016 at 20:09
  • Unfortunately, I don't have notification for all the tags (already follow a lot of the). Next time :P
    – Jakuje
    Dec 12, 2016 at 20:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .