6

If we use firewall-cmd to open a port before starting the firewalld service, it will fail saying "firewalld is not running".

If I start firewalld I'm getting disconnected from the remote server, I'm running SSH on a different port than 22.

How am I supposed to configure a remote server without losing connection to it?

2
  • 1
    The same here. This is ridiculous... Jun 9, 2018 at 13:56
  • 2
    Found the solution: firewall-offline-cmd — firewalld offline command line client
    – Gotenks
    Jun 9, 2018 at 18:17

1 Answer 1

5

firewall-offline-cmd is an offline command line client of the firewalld daemon. It should be used only if the firewalld service is not running. For example to migrate from system-config-firewall/lokkit or in the install environment to configure firewall settings with kickstart.

A few basic examples:

# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
success
# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p udp -m state --state NEW -m udp --dport 69 -j ACCEPT
success
# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 8000 -j ACCEPT
success
# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
success
# firewall-offline-cmd --direct --add-rule ipv4 filter INPUT 0 -p tcp -m state --state NEW -m tcp --dport 8443 -j ACCEPT
success

Tell your system to reboot in 2 minutes if your firewall kicks you out for some reason:

# shutdown -r +2 "Enabling firewall. If access is lost, server will restart in 5 minutes."

When you're ready:

systemctl start firewalld

If all is well, cancel shutdown:

# shutdown -c

And finally, enable the service and make sure your config is permanent:

# systemctl enable firewalld
# firewall-cmd --runtime-to-permanent

Full details here: https://firewalld.org/documentation/man-pages/firewall-offline-cmd.html and here: https://manpages.debian.org/unstable/firewalld/firewall-offline-cmd.1.en.html

1
  • If what you need is to check the current configuration before starting the firewall this is the command: sudo firewall-offline-cmd --list-all Sep 7, 2021 at 8:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .