AlmaLinux 9: open a single port

When to use it

Your service listens on 8080 but nothing can reach it — usually firewalld has not allowed it. firewalld is not one flat rule table but rules grouped by zone: find the zone your interface belongs to, then change that zone’s ports or services.

Test scope

In an almalinux:9 container (AlmaLinux 9.8, firewalld 1.3.4-20.el9_8) the static configuration was read with firewall-offline-cmd: --get-zones, --get-default-zone, --zone=public --list-services, --add-port=8080/tcp, --list-ports, --list-all. Log: plans/content-expansion/evidence/logs/alma-firewalld-zones.log.

The container has no systemd and firewall-cmd needs the running daemon, so the runtime firewall-cmd commands below were not executed here (E3); only the static-config output is tested (E1).

Look at the zone first

firewall-offline-cmd --get-zones
firewall-offline-cmd --get-default-zone
firewall-offline-cmd --zone=public --list-services

block dmz drop external home internal public trusted work
public
cockpit dhcpv6-client ssh

With this firewalld installation the public zone allows cockpit, dhcpv6-client and ssh (static configuration; check --list-all on other hosts).

The output above is real firewall-offline-cmd output (not runtime firewall-cmd output).

Open a port

sudo firewall-cmd --permanent --zone=public --add-port=8080/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --zone=public --list-ports

With only --permanent and no --reload the rule applies on the next reload or reboot; without --permanent it vanishes on restart — you need both.

Verify

firewall-cmd --zone=public --list-all

public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: cockpit dhcpv6-client ssh
  ports: 8080/tcp

Only when ports: lists 8080/tcp is the port open.

Common traps

--add-port=8080 without a protocol: it is treated as a single protocol; write 8080/udp explicitly when you need UDP;
Wrong zone: the interface is in public but the command targets --zone=internal; check firewall-cmd --get-active-zones first;
Service bound to 127.0.0.1: opening the port does not help; confirm with ss -lntp | grep 8080.

Practice: open 8443/tcp and keep it after a restart

sudo firewall-cmd --permanent --zone=public --add-port=8443/tcp
sudo firewall-cmd --reload
sudo systemctl restart firewalld
firewall-cmd --zone=public --list-ports

Checks:

firewall-cmd --zone=public --list-ports → includes 8443/tcp
firewall-cmd --permanent --zone=public --list-ports → also includes it
After systemctl restart firewalld → still there

FAQ

常见问题

Why does `--add-port` disappear after a restart?

Because `--permanent` was missing: without it you only change the runtime state, which is lost on restart. With `--permanent` you also need `--reload` for it to take effect now. Use both.

The command succeeded but the port is still unreachable?

Check which zone the interface is in (`firewall-cmd --get-active-zones`) and what address the service listens on (`ss -lntp`). A service bound to 127.0.0.1 is unreachable no matter what the firewall allows.