Runtime and permanent rules

firewalld keeps two copies of its rules: the ones in force right now (runtime) and the ones saved on disk (permanent). Most firewall surprises come from changing one and expecting the other. This lesson makes the difference routine.

Explain the runtime and permanent stores and which command changes which.
Make a change survive a reload and a reboot.
Use --timeout for temporary tests, and avoid the trap of --runtime-to-permanent.

Two stores

Two stores of rules: Step through a change that is made without --permanent.

Without --permanent, a command changes only the running firewall. Compare both stores after a runtime change:

[root@servera ~]# firewall-cmd --add-service=http
success
[root@servera ~]# firewall-cmd --list-services
cockpit dhcpv6-client http ssh
[root@servera ~]# firewall-cmd --permanent --list-services
cockpit dhcpv6-client ssh
[root@servera ~]# firewall-cmd --reload
success
[root@servera ~]# firewall-cmd --query-service=http
no

The reload threw the runtime change away. The correct habit is: change the permanent configuration, then reload.

[root@servera ~]# firewall-cmd --permanent --add-service=http
success
[root@servera ~]# firewall-cmd --reload
success
[root@servera ~]# firewall-cmd --query-service=http
yes

Queries work on either store: firewall-cmd --query-service=http asks the running firewall, and firewall-cmd --permanent --query-service=http the saved one. Each prints yes or no.

Options at a glance

Options that change the store: Select an option.

Temporary rules

--timeout opens something for a fixed time. It is runtime only, so it is ideal for a quick test:

[root@servera ~]# firewall-cmd --add-port=8080/tcp --timeout=60
success
[root@servera ~]# firewall-cmd --list-ports
8080/tcp

After a minute the port closes again by itself.

The runtime-to-permanent trap

firewall-cmd --runtime-to-permanent saves everything that is in force now. If a test rule is still open, it becomes permanent too:

[root@servera ~]# firewall-cmd --add-port=8080/tcp --timeout=60
success
[root@servera ~]# firewall-cmd --runtime-to-permanent
success
[root@servera ~]# firewall-cmd --permanent --list-ports
8080/tcp

The temporary port is now saved for good. To remove it: firewall-cmd --permanent --remove-port=8080/tcp, then --reload.

The saved configuration lives under /etc/firewalld/ (zone files in zones/, your own services in services/). You rarely edit those files by hand, but it is useful to know that --permanent writes them.

Try it

Check your understanding

You run firewall-cmd --add-service=http and reboot. What happens?
What does firewall-cmd --reload do to runtime-only changes?
Which option removes a temporary rule by itself after a time?
Why can --runtime-to-permanent be risky?
How do you ask whether http is allowed in the saved configuration?
After firewall-cmd --permanent --add-service=http, is port 80 open?