If we use firewall-cmd to open a port before starting the firewalld service, it will fail saying "firewalld is not running".
If I start firewalld I'm getting disconnected from the remote server, I'm running SSH on a different port than 22.
How am I supposed to configure a remote server without losing connection to it?
firewall-offline-cmd is an offline command line client of the firewalld daemon. It should be used only if the firewalld service is not running. For example to migrate from system-config-firewall/lokkit or in the install environment to configure firewall settings with kickstart.
A few basic examples:
# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
success
# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p udp -m state --state NEW -m udp --dport 69 -j ACCEPT
success
# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 8000 -j ACCEPT
success
# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
success
# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 8443 -j ACCEPT
success
Tell your system to reboot in 2 minutes if your firewall kicks you out for some reason:
# shutdown -r +2 "Enabling firewall. If access is lost, server will restart in 5 minutes."
When you're ready:
systemctl start firewalld
If all is well, cancel shutdown:
# shutdown -c
And finally, enable the service and make sure your config is permanent:
# systemctl enable firewalld
# firewall-cmd --runtime-to-permanent
Full details here: https://firewalld.org/documentation/man-pages/firewall-offline-cmd.html and here: https://manpages.debian.org/unstable/firewalld/firewall-offline-cmd.1.en.html
