What incoming TCP and UDP connections are permitted, by the default firewall policy of Fedora Workstation, and Fedora Server?

I am interested in the current version, Fedora 28.

1 Answer 1


Look at the default zone definitions in /usr/lib/firewalld/zones/, and cross-reference them against /usr/lib/firewalld/services/.


Unsolicited incoming network packets are rejected from port 1 to 1024, except for select network services. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed.

  <service name="dhcpv6-client"/> <!-- udp 546 from fe80::/64 only -->
  <service name="ssh"/>           <!-- tcp 22 -->
  <service name="samba-client"/>  <!-- udp 137,138, plus nf_conntrack_netbios_ns -->
  <port protocol="udp" port="1025-65535"/>
  <port protocol="tcp" port="1025-65535"/>


For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

  <service name="ssh"/>           <!-- tcp 22 -->
  <service name="dhcpv6-client"/> <!-- udp 546 from fe80::/64 only -->
  <service name="cockpit"/>       <!-- tcp 9090 -->

("cockpit" is implemented as a web server running on TCP port 9090. It uses HTTPS and password authentication. There is an alternative option to use SSH and SSH key authentication as well).

Does it allow MDNS / avahi?

This is slightly confusing when you look at the package. The package includes a patch to enable MDNS by default, but it does not touch either of these files. Nevertheless, MDNS will be allowed on Fedora Workstation. The standard MDNS port is 5353, which is in the "high ports" that Fedora Workstation allows (1025-65535).

The MDNS patch pre-dates FedoraWorkstation.xml and FedoraServer.xml in Fedora 21 (2014-12-09). This was the first release of Fedora to be split into Workstation and Server editions. In Fedora 20, the default zone definition was public.xml and it allowed MDNS.

Fedora 21 and its Workstation firewall -- LWN.net, 2014-12-17


Date: Mon, 6 Aug 2012 10:01:09 +0200
Subject: [PATCH] Make MDNS work in all but the most restrictive zones

  • For me (FC 29) the directory is /etc/firewalld (ends on d). Commented May 24, 2019 at 8:47
  • @YaroslavNikitenko wups. Thanks for the correction.
    – sourcejedi
    Commented May 24, 2019 at 10:25
  • Also the default zones are in /usr/lib/firewalld/zones Commented May 24, 2019 at 17:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .