sudo nmap -p0-65535
Starting Nmap 7.40 ( https://nmap.org ) at 2018-02-06 19:03 HKT
Nmap scan report for localhost (
Host is up (0.0000050s latency).
Not shown: 65525 closed ports
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
110/tcp  open  pop3
143/tcp  open  imap

List ports with firewall-cmd.

sudo firewall-cmd --zone=public --list-ports

No ports listed! How to get the same ports displayed with firewall-cmd as with nmap?


It is possible that these rules are defined based on the service rather than the port directly. Run sudo firewall-cmd --list-all and check if you have the listed services allowed on the correct zone. You can see in my example, that ssh, dhcpv6-client are allowed, which doesn't show the actual ports.

# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens192
  services: ssh dhcpv6-client
  masquerade: no
  rich rules: 

If you want to see the ports for ssh, you can look at the rule for that service:

# cat /usr/lib/firewalld/services/ssh.xml
firewall-cmd --zone public --list-all | awk '/services/ { for (i=2;i<=NF;i++) { print $i;system("grep -o port=.* /usr/lib/firewalld/services/"$i".xml") } }'

A solution utilizing firewalld-cmd and awk would be as above. Run the firewall-cmd --zone public --list-all command to get the list of services and then pull out the services line with awk. Looping through each service on this line (space delimited word) we execute a grep command looking for any ports in /usr/lib/firewalld/services/<service name>.xml

Note that there are risk associated with command injection when executing the awk system function.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.