Firewalls are critical for network security, ensuring systems remain protected from unauthorized access. In Red Hat Linux, firewalld is the default firewall tool that controls incoming and outgoing network traffic. While its primary function is security, it can also block important services, causing disruptions in network operations.

Understanding which TCP ports FirewallD may block, how to open them, and how to stay alert for firewall-related issues helps ensure smooth server functionality without compromising security.

Index

1. How FirewallD Blocks TCP Ports

By default, FirewallD restricts incoming connections unless explicitly allowed. This means that applications or services needing access to specific TCP ports may encounter connectivity failures if those ports are not open.

Common scenarios include:

  • Web server downtime due to blocked HTTP/HTTPS ports.
  • Failed SSH connections preventing remote login.
  • Database access issues caused by restricted MySQL/PostgreSQL ports.
  • Broken file-sharing services because of blocked NFS or Samba ports.

2. Commonly Blocked TCP Ports in Red Hat Linux

FirewallD often restricts ports essential for network operations. Below are some critical ports that must be open for various services to function properly.

Service Port Number Purpose
HTTP 80 Web server access via Apache/Nginx
HTTPS 443 Secure website access
SSH 22 Remote server administration
FTP 21 File transfers
MySQL 3306 Database connections
PostgreSQL 5432 PostgreSQL database management
NFS 2049 Network file sharing
Samba 445 Windows-Linux file sharing
DNS 53 Resolving domain names

If these ports are blocked, services relying on them will not function, leading to significant issues in network communications and data accessibility.

3. Opening Blocked TCP Ports in FirewallD

FirewallD allows you to manage network traffic through simple commands.

Step 1: Check Current Firewall Rules

To view open and restricted ports, use:

sudo firewall-cmd --list-all

If you don’t see a required port in the list, you need to open it manually.

Step 2: Allow a Specific Port

To open a port (e.g., SSH on port 22), run:

sudo firewall-cmd --permanent --add-port=22/tcp

For web traffic, allow HTTP and HTTPS:

sudo firewall-cmd --permanent --add-port=80/tcp
sudo firewall-cmd --permanent --add-port=443/tcp

Step 3: Apply Changes

Once ports are added, reload the firewall to apply updates:

sudo firewall-cmd --reload

Step 4: Verify Open Ports

Confirm the firewall now allows traffic through the required ports:

sudo firewall-cmd --list-ports

4. Effects of FirewallD Blocking Essential Ports

Blocking necessary ports can cause serious problems, including:

  • Website Inaccessibility – Web servers fail to serve content if port 80 or 443 is blocked.
  • Denied SSH Access – Remote administrators cannot log in to manage the system.
  • Database Connectivity Failures – Applications relying on MySQL/PostgreSQL cannot access required data.
  • File-Sharing Disruptions – Services like Samba and NFS fail to transfer files.

These issues can slow down business operations, create service outages, and impact productivity.

5. How to Stay Alert and Detect Firewall Issues

Firewall misconfigurations can often go unnoticed until they create disruptions. Staying proactive helps prevent unexpected failures.

Check Firewall Logs

Review firewall logs to detect blocked connections:

sudo journalctl -u firewalld --no-pager

This will display recent firewall activity, including any blocked requests.

Test Connectivity with Netcat or Telnet

To check if a port is open, use:

nc -zv  80

If the port is blocked, the test will fail, confirming a firewall issue.

Automate Firewall Monitoring

Setting up a firewall monitoring script can send alerts whenever essential ports are blocked, ensuring quick action is taken before problems escalate.

6. Use Case: Resolving Blocked SSH Access on a Remote Server

Problem:

An administrator is unable to SSH into a Red Hat Linux server due to connection refusals.

Solution:

  1. Check if FirewallD is blocking SSH: 
sudo firewall-cmd --list-ports
  1. If port 22 is missing, open it manually: 
sudo firewall-cmd --permanent --add-port=22/tcp
   sudo firewall-cmd --reload
  1. Retry SSH connection.

Once the port is allowed, remote access is restored, allowing normal administration tasks.

Final Thoughts

While FirewallD is essential for security, blocking critical TCP ports can disrupt server functionality. Knowing which ports to check, how to open them, and how to stay proactive with firewall monitoring ensures a balance between security and network reliability.