Just completed a few tomcat servers that sit behind an LB, everything worked fine with the firewall off, so I enabled firewalld and added my ports for the cluster. All of the servers except for one worked just fine. For some reason, on one of the servers it will not show the ports when I do firewall-cmd --list-all but it does actually show the ports in public.xml inside the firewalld etc directory. Here is the same command that I used for all servers:

firewall-cmd --zone=public --permanent --add-port=4000-4100/tcp

After running that I get success. Yet, I get the following when I run firewall-cmd --list-all

public (default, active)
  interfaces: ens32
  services: dhcpv6-client http ssh
  ports: 45564/tcp 8080/tcp
  masquerade: no
  rich rules: 

The other ports that I put in there stay without any issues (that's the 45564 and 8080)

What's weird is when cat /etc/firewalld/public.xml it shows the ports in there.

 <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
 <service name="dhcpv6-client"/>
 <service name="http"/>
 <service name="ssh"/>
 <port protocol="tcp" port="45564"/>
 <port protocol="tcp" port="4000-4100"/>
 <port protocol="tcp" port="8080"/>

Some of the times that I entered in the command to allow 4000-4100, they would actually show in the --list-all but if I restarted the firewall, they would not show back up (the others would).

Having some issues resolving this. Any help ya'll might have, I would greatly appreciate. Thanks!

2 Answers 2


You should runn the command

firewall-cmd --reload

after you executed commands with "--permanent". Those commands work only on the config file but not on the current running configuration. IF you do not use --permanent, you are working on the running configuration and can see you changes immediately.


I know this is old but I hate when I come across the one post that mentions my exact problem and there are zero replies, so here it is:

I messed with this for like 20 minutes before simply restarting firewalld, and after the firewall restarted the ports were listed using --list-all

So, I hate to be this guy, but "turn it off and back on again" seemed to be the fix here for me.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .