iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To secure a Linux VPS with firewalld, identify the zone attached to its network interface, allow SSH before changing inbound access, add only the services or ports the server needs, save the rules as permanent, reload firewalld, and verify the result from both the VPS and another machine. The critical distinction is that runtime rules are active immediately but can disappear on restart, while permanent rules are loaded when firewalld starts.
What firewalld does on a VPS
firewalld is a dynamically managed firewall that organizes policy into zones. A zone represents a trust level for a network connection, interface, or source address. Instead of maintaining one undifferentiated list of ports, you assign an interface or source to a zone and define what that zone accepts.
The active firewall is the runtime configuration. It is the configuration currently applied in the kernel, so a runtime change can affect new connections as soon as the command succeeds. The permanent configuration is saved on disk. When the firewalld service starts, that permanent configuration becomes the runtime configuration. A setting written only at runtime therefore may vanish after a reboot or service restart.
firewalld also provides named service definitions. ssh, http, and https are readable names for the ports and protocols used by those services. For an application that has no suitable definition, you can allow an explicit port such as 8080/tcp. Zones, service definitions, ports, and optional rich rules can be combined, but a small VPS is easiest to manage when its policy is narrow and clearly documented.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Before changing a remote firewall
A firewall change on a local computer is inconvenient when it fails. On a remote VPS it can terminate your only administrative connection. Prepare an access and rollback plan before running restrictive commands.
- Confirm the VPS distribution and its package manager.
- Keep your current SSH session open while applying and testing changes.
- Open a second SSH session, or arrange a provider console or other out-of-band access, before removing any existing access.
- Write down the current SSH port. The default service definition assumes SSH is using its standard port; a custom port must be allowed explicitly.
- Know which interface carries the VPS’s public traffic. Do not assume that the interface is named
eth0. - Check whether the VPS provider also has a security group or network firewall. An upstream policy can block traffic even when firewalld is configured correctly.
Do not begin by deleting the zone’s existing rules. First inspect them, preserve the administration path, and then remove only entries you can identify as unnecessary.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Install and start firewalld
Package names, service defaults, and interface names vary by distribution release and by VPS image. Install the package with the package manager for the operating system, then check whether the daemon is already active.
| Distribution family | Typical installation command | State and startup commands |
|---|---|---|
| Debian or Ubuntu | sudo apt update && sudo apt install firewalld |
sudo firewall-cmd --statesudo systemctl enable --now firewalld |
| Fedora, RHEL, Rocky, AlmaLinux | sudo dnf install firewalld |
sudo firewall-cmd --statesudo systemctl enable --now firewalld |
| Systems using another package manager | Install the distribution’s firewalld package using its documented package tool. |
Use the same firewall-cmd and systemctl checks after installation. |
The installation commands are examples rather than a universal prescription: an older release may use a different package tool, and an image may already include firewalld. systemctl enable --now firewalld is safe to repeat when the service is already enabled. Verify the result explicitly:
sudo firewall-cmd --state
sudo systemctl status firewalld --no-pagerThe first command should report running. If it does not, inspect the service status and system journal before attempting to add rules:
sudo journalctl -u firewalld --no-pager -n 100Find the zone and interface that are actually in use
Rules in the wrong zone do not protect or expose the interface you think they do. Inspect the live assignment before making changes.
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --get-default-zone
sudo firewall-cmd --get-zone-of-interface=eth0
sudo firewall-cmd --list-allReplace eth0 with the real interface name. The first command lists zones that currently have an interface or source assigned. The default-zone command tells you where unassigned connections would go; it does not prove that the VPS’s public interface is in that zone. The interface query gives the direct answer for a known interface.
If you do not know the interface name, list network interfaces with the operating system’s network tools, then query the candidate interface:
ip -br address
sudo firewall-cmd --get-zone-of-interface=ens3Some cloud images use names such as ens3, enp1s0, or a provider-specific name. Use the zone reported for the interface carrying the public address. In the examples below, public is only a placeholder; substitute the zone you actually discovered.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
To inspect one zone in detail, specify it explicitly:
sudo firewall-cmd --zone=public --list-allThis displays the zone’s target, interfaces, sources, services, ports, forwarding settings, masquerading state, and rich rules. Record the output before editing so you can recognize an accidental change.
Preserve SSH access first
If you administer the VPS over SSH, allow that service in the active zone before tightening anything else. Apply the runtime rule first so it takes effect immediately, and add the permanent form so it survives a restart:
sudo firewall-cmd --zone=public --add-service=ssh
sudo firewall-cmd --permanent --zone=public --add-service=sshSubstitute the real zone in both commands. If SSH listens on a nonstandard port, allow the exact port and protocol instead of relying on the standard service definition:
sudo firewall-cmd --zone=public --add-port=2222/tcp
sudo firewall-cmd --permanent --zone=public --add-port=2222/tcpReplace 2222 with the port configured by your SSH daemon. Do not remove an existing SSH rule until a new session has successfully connected through the intended port. If you lose SSH, use the provider console or another out-of-band path to restore the service or port, then check which zone owns the interface.
Recommended Free Tools
Allowing SSH does not make the daemon listen. Confirm separately that the SSH service is running and bound to the expected address and port. A firewall can permit a connection only after an application has opened a listening socket.
Allow the services the VPS really needs
HTTP and HTTPS with predefined services
A web server normally needs HTTP and HTTPS. Named services are easier for another administrator to read than unexplained port numbers:
sudo firewall-cmd --zone=public --add-service=http
sudo firewall-cmd --zone=public --add-service=https
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=httpsUse the active zone rather than blindly copying public. These commands change the runtime and permanent configurations separately, which is why each service appears twice.
A custom application port
When an application listens on a port with no suitable predefined service, specify the port and protocol:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
sudo firewall-cmd --zone=public --add-port=8080/tcp
sudo firewall-cmd --permanent --zone=public --add-port=8080/tcpDocument why the port is open and which application owns it. UDP and TCP are different protocols; allowing 8080/tcp does not allow UDP on the same number. Avoid broad ranges unless the application genuinely requires them. A narrow rule reduces accidental exposure and makes later audits easier.
Remove an exposure you no longer need
Remove runtime and permanent entries separately, just as you add them:
sudo firewall-cmd --zone=public --remove-port=8080/tcp
sudo firewall-cmd --permanent --zone=public --remove-port=8080/tcpFor a named service, use --remove-service. Check the zone listing afterward so you know whether the entry was present in one configuration, both, or neither.
Runtime rules versus permanent rules
The distinction explains most reports that a rule disappeared. Runtime state is the effective firewall in the kernel. Permanent state is the saved policy that firewalld loads at startup. Adding a rule without --permanent changes only runtime state; adding a rule with --permanent writes the saved configuration but does not, by itself, change the active firewall.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches| Command form | Changes now | Survives restart | Typical use |
|---|---|---|---|
firewall-cmd --zone=... --add-service=... |
Yes | No | Immediate test or temporary change |
firewall-cmd --permanent --zone=... --add-service=... |
No | Yes | Prepare saved policy before activation |
firewall-cmd --runtime-to-permanent |
Keeps current runtime | Yes | Save a tested runtime configuration |
firewall-cmd --reload |
Loads saved policy | Uses saved policy | Activate permanent changes |
Workflow A: test first, then save
This workflow is useful when you want to validate access without committing a mistake:
- Add the SSH, web, and application rules to the runtime configuration.
- Test from another machine while your existing session remains open.
- When the result is correct, copy the tested runtime configuration into permanent storage:
sudo firewall-cmd --runtime-to-permanentAfter saving, reload to ensure the saved policy can be loaded cleanly:
sudo firewall-cmd --reloadWorkflow B: write permanent rules, then activate them
You can instead add every rule with --permanent, review the saved configuration, and activate it once:
sudo firewall-cmd --permanent --zone=public --add-service=ssh
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reloadUntil the reload, the permanent additions are not active. A reload replaces runtime state with the saved configuration. firewalld is designed to maintain existing connections during a reload, but you should still keep a second access path available when changing a remote policy.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Verify the resulting policy
Verification has two parts: confirm what firewalld believes the zone contains, then test the service from outside the VPS.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Inspect the zone and query individual entries
sudo firewall-cmd --zone=public --list-all
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=public --query-service=ssh
sudo firewall-cmd --zone=public --query-service=http
sudo firewall-cmd --zone=public --query-service=https
sudo firewall-cmd --zone=public --list-portsA query returns whether the named service is enabled in the selected runtime zone. The zone listing shows the complete active policy, including interfaces and sources, so it can reveal that you inspected the wrong zone. If you need to compare saved and active state, inspect the permanent zone explicitly:
sudo firewall-cmd --permanent --zone=public --list-allCompare this output with the non-permanent listing. Differences indicate that a change has not yet been saved or that the active configuration has not been reloaded.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Confirm that an application is listening
A permitted port is not enough. Check the local listener and its protocol:
sudo ss -tulpnLook for the expected TCP or UDP port and the address on which the process is bound. An application listening only on 127.0.0.1 cannot accept connections arriving on the public interface, regardless of the firewalld rule.
Test from a separate machine
Use a different host or network so the test represents an inbound connection. An HTTPS client can request the site, and a TCP connectivity check can test a custom listener. Test IPv4 and IPv6 separately when the VPS has both address families and the application is intended to serve both. A successful local test does not prove that an external firewall or routing path permits the traffic.
Choose the least complex rule approach that fits
| Approach | Best use | Trade-off |
|---|---|---|
| Predefined service | Standard SSH, HTTP, HTTPS, and other recognized protocols | Readable and portable, but depends on the service definition provided by firewalld. |
| Explicit port and protocol | A simple custom listener such as 8080/tcp |
Precise, but the port and protocol must be documented and maintained. |
| Rich rule | Source-address limits, logging, or conditions that a basic service or port cannot express | More expressive and more complex; syntax must be validated carefully. |
| Separate zones | Different trust levels for interfaces or source networks | Creates clear policy boundaries, but only when interface and source bindings are correct. |
For a single-interface public web VPS, a small set of named services and explicitly documented application ports is usually easier to audit than a large collection of rich rules. Use richer policy only when the requirement justifies its added complexity.
A zone is not a label you add to a command for appearance; it is the policy attached to an interface or source. If a VPS has multiple interfaces, place each in the zone whose trust assumptions match that network. A private management interface may need a different policy from a public interface. Likewise, a source-based zone can express a policy for a known administrative network, but source addresses can change and should be monitored. Do not move an interface between zones while relying on an untested SSH session. First determine the resulting policy, add the necessary management rule in the destination zone, and test through the intended path. Keep the number of zones understandable enough that an operator can identify the owner of every exposed service. One custom port can be represented directly with Before using a custom definition, list existing services and confirm that a suitable definition does not already exist. Treat a custom definition as configuration that must be backed up, reviewed, and deployed consistently on other VPSs. The firewall rule still does not start the application; it only describes which traffic firewalld may pass. It was probably added only to runtime. Add the permanent form, or save the tested active configuration with Use the provider console or another out-of-band route. Restore the SSH service or the actual custom port in the zone that owns the public interface. Confirm the daemon’s listening port and verify the zone assignment before closing the recovery session. You may have edited a zone that is not attached to the traffic interface. Re-run Review whether the application truly requires every port and protocol. If it does, group the ports in a service definition or use a carefully reviewed rich rule rather than leaving undocumented, scattered openings. For a new VPS, the following order minimizes lockout risk and makes the final state auditable: Recommended Free Tools This sequence separates discovery, exposure, persistence, and verification. It also leaves an operator with a record of which interface, zone, service, and port each decision concerns. Review the active and permanent zone listings whenever you install or remove a network-facing application. Remove ports that are no longer needed, and keep a short change record explaining the owner and purpose of each nonstandard opening. Recheck provider-level firewalls whenever a service is migrated or its address changes. When testing a new rule, prefer a temporary runtime change, test from outside, and then persist only the result you intend to keep. When deploying a permanent policy, schedule the reload with a console or second session available. This practice makes the difference between runtime and permanent configuration an operational safeguard rather than a source of surprises. Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.When to use a service definition
--add-port. An application that needs several ports, a defined protocol set, or descriptive metadata is a better candidate for a firewalld service definition. A definition keeps related ports together and avoids hiding a large, opaque set of openings in a command history.Best Value
Troubleshoot common failures
firewall-cmd --state does not report running
sudo systemctl status firewalld --no-pager.sudo journalctl -u firewalld --no-pager -n 100.A rule vanished after reboot or reload
sudo firewall-cmd --runtime-to-permanent, then reload and inspect both configurations.SSH disconnected after a change
The rule appears correct, but the service is unreachable
ss -tulpn.The command succeeds in one zone but has no effect
--get-active-zones and --get-zone-of-interface, then apply the rule to the zone shown for the relevant interface.A custom application needs many ports
A safe repeatable setup sequence
--runtime-to-permanent, or reload after writing permanent rules.Ongoing maintenance
Quick Recap
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11
