How do I check the firewalld zone protecting a server interface?
firewalld associates traffic with zones through interfaces and source assignments. Inspecting the default zone alone can be misleading when the network interface uses another zone. Runtime configuration is active now, while permanent configuration is used on reload or restart.
Before you start
- Sudo access and the actual server interface name.
Instructions
1. Find active zones
List current zone bindings and locate the interface carrying the affected connection. Source-based zone assignments can also influence which rules apply.
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --get-zone-of-interface=ens3Replace ens3 with the interface discovered on this server.
2. Read the active policy
Replace public with the actual zone returned above. Review services, ports, rich rules, interfaces, sources and the zone target as one policy.
sudo firewall-cmd --zone=public --list-allDisplays runtime policy for the selected zone.
3. Compare the permanent policy
Differences can explain why a rule worked until a reboot. A reload would replace runtime-only settings, so collect the difference before making changes.
sudo firewall-cmd --permanent --zone=public --list-allReads the saved policy without applying it or reloading firewalld.
Check the result
- The inspected zone is associated with the relevant interface or source.
- Any runtime/permanent differences are understood before scheduling a reload or reboot.
Troubleshooting
- The requested interface has no explicit zone
- Check the active-zone output and default-zone behaviour for this installation; do not reassign the live interface blindly.
- firewall-cmd reports that firewalld is not running
- Confirm which firewall manager owns this server before enabling a different service.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.