Show Table of Contents
5.14. Using the Direct Interface
It is possible to add and remove chains during runtime by using the
--direct option with the firewall-cmd tool. A few examples are presented here. See the firewall-cmd(1) man page for more information.
It is dangerous to use the direct interface if you are not very familiar with iptables as you could inadvertently cause a breach in the firewall.
The direct interface mode is intended for services or applications to add specific firewall rules during runtime. The rules can be made permanent by adding the
--permanent option using the firewall-cmd --permanent --direct command or by modifying /etc/firewalld/direct.xml. See man firewalld.direct(5) for information on the /etc/firewalld/direct.xml file.
5.14.1. Adding a Rule using the Direct Interface
To add a rule to the “IN_public_allow” chain, enter the following command as
root:
~]#firewall-cmd --direct --add-rule ipv4 filter IN_public_allow \0 -m tcp -p tcp --dport 666 -j ACCEPT
Add the
--permanent option to make the setting persistent.
5.14.2. Removing a Rule using the Direct Interface
To remove a rule from the “IN_public_allow” chain, enter the following command as
root:
~]#firewall-cmd --direct --remove-rule ipv4 filter IN_public_allow \0 -m tcp -p tcp --dport 666 -j ACCEPT
Add the
--permanent option to make the setting persistent.
5.14.3. Listing Rules using the Direct Interface
To list the rules in the “IN_public_allow” chain, enter the following command as
root:
~]# firewall-cmd --direct --get-rules ipv4 filter IN_public_allow
Note that this command (the
--get-rules option) only lists rules previously added using the --add-rule option. It does not list existing iptables rules added by other means.
Where did the comment section go?
Red Hat's documentation publication system recently went through an upgrade to enable speedier, more mobile-friendly content. We decided to re-evaluate our commenting platform to ensure that it meets your expectations and serves as an optimal feedback mechanism. During this redesign, we invite your input on providing feedback on Red Hat documentation via the discussion platform.