Identity

Unit: firewalld.service
Config: /etc/firewalld/ (zones, services, rich rules — user overrides)
Default zones/services: /usr/lib/firewalld/ (system-provided; don't edit)
Custom zones: /etc/firewalld/zones/
Custom services: /etc/firewalld/services/
Backend: nftables (default since firewalld 0.6); legacy iptables still supported
Logs: journalctl -u firewalld
Install: dnf install firewalld (default on RHEL/Fedora); apt install firewalld

Key Operations

Goal	Command
Check if running	`sudo firewall-cmd --state`
Get default zone	`sudo firewall-cmd --get-default-zone`
List all zones	`sudo firewall-cmd --get-zones`
List active zones + interfaces	`sudo firewall-cmd --get-active-zones`
List services in zone	`sudo firewall-cmd --zone=public --list-services`