FireWall in CentOS7

In CentOS7 you can no longer edit the usual iptables firewall rules the way you’re used to. iptables itself is still there, but it’s now wrapped in firewalld. Traffic is allowed through the firewall-cmd utility.

You can use firewall-cmd to add rules, for example:

firewall-cmd -zone=public -add-port=http/tcp  
firewall-cmd -zone=public -add-port=http/tcp -permanent

The second command is needed so the rule stays applied after the firewall restarts.

To allow access to an arbitrary port use:

firewall-cmd -zone=public -add-port=2121/tcp  
firewall-cmd -zone=public -add-port=2121/tcp -permanent

You can also set a range:

firewall-cmd -zone=public -add-port=35000-60000/tcp  
firewall-cmd -zone=public -add-port=35000-60000/tcp -permanent

Allow access from an ip address:

firewall-cmd -permanent -zone=public -add-source=10.209.128.30  
firewall-cmd -permanent -zone=public -add-source=10.209.128.30 -permanent