Restricting network access with firewalld and firewall-cmd (services, ports, zones, --permanent, --reload)

A host firewall decides which incoming network connections reach services on the machine. RHEL uses firewalld, a service that manages the kernel's packet filtering (nftables) for you. You describe what to allow in terms of zones, services and ports, and firewalld builds the low-level rules. firewall-cmd is the command-line client, and firewalld must be running for it to work (systemctl enable --now firewalld).