Firewalld

firewalld
Developers	Eric Garver, Thomas Woerner, Red Hat, Inc.
Release	January 3, 2011 (2011-01-03)
Stable release	2.5.2  / 17 September 2026 (17 September 2026)
Written in	Python
Operating system	Linux
Platform	Netfilter
License	GNU General Public License 2
Website	www.firewalld.org
Repository	github.com/firewalld/firewalld.git

firewalld, stylized in all lowercase, is a firewall management tool for Linux operating systems. It provides firewall features by acting as a front-end for the Linux kernel's netfilter framework. firewalld's current default backend is nftables. Prior to v0.6.0, iptables was the default backend. Through its abstractions, firewalld acts as an alternative to nft and iptables command line programs. The name firewalld adheres to the Unix convention of naming system daemons by appending the letter "d".

firewalld is written in Python. It was intended to be ported to C++, but the porting project was abandoned in January 2015.

History

firewalld is a dynamic firewall management tool designed for Linux operating systems, acting as a high-level front-end interface for the Linux kernel's netfilter framework. Through its abstraction layer, firewalld serves as a direct alternative to lower-level command-line utilities such as nft and iptables.

Currently, firewalld's default backend is nftables; prior to version 0.6.0, the utility used iptables as its default backend engine. Adhering to Unix naming conventions, the trailing "d" in firewalld designates a system daemon that runs continuously in the background. The software is written in Python; an initial plan to rewrite the codebase in C++ was officially abandoned in January 2015.

Features

firewalld supports both IPv4 and IPv6 networks and can administer separate firewall zones with varying degrees of trust as defined in zone profiles. Administrators can configure Network Manager to automatically switch zone profiles based on known Wi-Fi (wireless) and Ethernet (wired) networks, but firewalld cannot do this on its own.

Services and applications can use the D-Bus interface to query and configure the firewall. firewalld supports timed rules, meaning the number of connections (or "hits") to a service can be limited globally. There is no support for hit-counting and subsequent connection rejection per source IP; a common technique deployed to limit the impact of brute-force hacking and distributed denial-of-service attacks.

firewalld's command syntax is similar to but more verbose than other iptables front-ends like Ubuntu's Uncomplicated Firewall (ufw). The command-line interface allows managing firewall rulesets for protocol, ports, source and destination; or predefined services by name.

Services are defined as XML files containing port- and protocol-mappings, and optionally extra information like specifying subnets and listing required Kernel helper modules. The syntax resembles that of systemd's service files. A simple service file for a web server listening on TCP port 443 might look like this:

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Web Server</short>
  <description>Public web host over HTTPS.</description>
  <port port="443" protocol="tcp" />
</service>

firewalld v0.9.0 added native support for forward and output forwarding via policy objects. By default, firewalld does not block outbound traffic as required by standards such as NIST 800-171 and 800-53.

Zone-based trust architecture and network orchestration

The separation of trust zones represents the defining paradigm that distinguishes firewalld from conventional, flat packet-filtering tools. Rather than evaluating a monolithic chain of rules sequentially across the entire operating system, firewalld isolates network traffic into designated zones mapped to physical interfaces or source address ranges.

NetworkManager orchestration and dynamic switching

Because the firewalld daemon itself does not incorporate link-state monitoring logic, it relies entirely on integration with NetworkManager to adapt to network transitions. When a device migrates between an unmanaged public Wi-Fi access point and a corporate wired Ethernet interface, NetworkManager triggers runtime state updates via internal events, enabling firewalld to bind interfaces to appropriate trust profiles without requiring network disconnections.

Inter-process communication and security limitations

By adopting Linux system buses for runtime orchestration, firewalld simplifies deployment workflows but presents specific constraints when subjected to targeted malicious traffic.

Daemon administration via D-Bus interface

Through the standardized D-Bus system bus, local services, hypervisors, and container runtimes (such as Podman and Docker) can dynamically query state and request firewall rule mutations.

This application programming interface eliminates the requirement for helper scripts to execute direct root commands, providing a more reliable foundation for automated infrastructure management.

Global rate-limiting constraints and denial-of-service exposure

While firewalld provides native support for timed rules to limit aggregate connection attempts (or "hits") against a service, it lacks granular hit-counting mechanisms coupled with connection rejection on an individual source-IP basis.

Without the ability to track and throttle abusive sources natively, systems running firewalld remain susceptible to rapid brute-force authentication attempts and distributed denial-of-service (DDoS) traffic unless paired with dedicated mitigation software such as fail2ban.

Service abstraction and comparison with systemd

Managing complex rulesets via high-level service descriptors streamlines deployment across large server deployments.

XML service definitions and kernel helper bindings

Instead of forcing administrators to manage port numbers and protocols manually, firewalld implements declarative XML service definitions that mirror the operational design of systemd service units.

In addition to basic protocol bindings, these definitions can declare required subnet scopes and automatically load connection-tracking kernel helper modules (such as nf_conntrack_ftp) on demand.

Syntax divergence from Uncomplicated Firewall (ufw)

Compared to Ubuntu's ufw, which prioritizes minimal syntax for standalone single-interface machines, firewalld's firewall-cmd utility exposes a more verbose, hierarchical command structure.

While requiring more descriptive arguments, this verbosity provides greater operational clarity when defining multi-zone rulesets, rich language rules, and protocol-specific forwarding logic.

Traffic forwarding and compliance frameworks

As the platform evolved, its ability to manage multi-interface traffic routing expanded to meet enterprise operational requirements.

Native forwarding via policy objects in v0.9.0

The introduction of policy objects in version 0.9.0 fundamentally improved inter-zone routing within firewalld. This architectural layer provides native support for packet forwarding and output forwarding between distinct zones, allowing engineers to construct complex ingress-to-egress filtering pipelines without resorting to low-level direct iptables or nftables pass-through rules.

Compliance considerations under NIST SP 800-171 and NIST SP 800-53

By default, firewalld does not filter or restrict outbound network connections. This permissive baseline diverges from the stringent egress controls mandated by enterprise and government compliance frameworks, including NIST SP 800-171 and NIST SP 800-53, which require explicit allowlisting for all outgoing communication.

Achieving formal compliance requires system administrators to explicitly construct restrictive egress policies overriding default zone settings.

Graphical front-ends (GUIs)

To assist administrators who prefer visual interfaces over terminal sessions, firewalld includes two optional utilities:

• firewall-config is a graphical front-end that is optionally included with firewalld, with support for most of its features.
• firewall-applet is a small status indicator utility that is optionally included with firewalld. It can provide firewall event log notifications as well as a quick way to open firewall-config. firewall-applet was ported from the GTK+ to the Qt framework in the summer of 2015 following the GNOME Desktop’s deprecation of system tray icons.

Due to its reliability and tight systemd integration, firewalld serves as the default firewall daemon across major enterprise and community distributions, including Red Hat Enterprise Linux (RHEL 7+), CentOS (7+), Fedora (18+), SUSE Linux Enterprise Server (SLES 15+), openSUSE Leap (15+), and EndeavourOS. It is also packaged across Debian and Ubuntu repositories, providing a dynamic alternative to ufw and legacy iptables-persistent configurations.

Adoption

firewalld ships by default on the following Linux distributions:

• CentOS 7 and newer
• Fedora 18 and newer
• OpenSUSE Leap 15 and newer
• Red Hat Enterprise Linux 7 and newer
• SUSE Linux Enterprise 15 and newer
• EndeavourOS Apollo and newer

firewalld is enabled by default in all of these distributions. firewalld is also available as one of many firewall options in the package repository of many other popular distributions such as Debian or Ubuntu.

Repository availability in alternative platforms

Beyond its primary distribution footprint, firewalld is maintained within the official software repositories of other major operating systems, including Debian and Ubuntu, offering administrators a modular, dynamic alternative to static packet filters.

External links

• Firewalld guide (in English)
• Firewalld guide (in Spanish)