---
title: "How to Install and Setup FireWall on Amazon Linux 2"
description: "How to install and configure firewalld on Amazon Linux 2, including zones, services, and ports."
author: "Mohammad Abu Mattar"
canonical: https://mkabumattar.com/blog/post/how-to-install-and-setup-firewall-on-amazon-linux-2
---

# How to Install and Setup FireWall on Amazon Linux 2

## Introduction

This tutorial covers installing and configuring firewalld on Amazon Linux 2, including setting the default zone and managing services and ports.

## Prerequisites

To follow along with this tutorial, you will need:

- An Amazon Linux 2 EC2 instance with a public IP address.
- A user with sudo privileges.

## Install and set up firewalld on Amazon Linux 2

### Step 1: install firewalld

Before we can install firewalld, we must first update the system.

```shell
# Update the system
sudo yum update -y
```

Now that the system has been updated, we can install firewalld.

```shell
# Install FireWall
sudo yum install firewalld -y
```

Next, after installing firewalld, it's time to verify whether the _iptables_ service is running.

```shell
# Check if the iptables service is running
sudo systemctl status iptables
```

If the _iptables_ service is running, we need to stop it.

```shell
# Stop the iptables service
sudo systemctl stop iptables
```

Now that the _iptables_ service is stopped, we can start the firewalld service.

```shell
# Start the FireWall service
sudo systemctl start firewalld
```

To verify that the firewalld service is running, we can use the following command.

```shell
# Check if the FireWall service is running
sudo systemctl status firewalld
```

A newly installed firewalld service is not enabled at boot by default. To enable it, we can use the following command.

```shell
# Enable the FireWall service
sudo systemctl enable firewalld
```

### Step 2: configure firewalld

Now that the firewalld service is running, we can configure it. Allow HTTP, HTTPS, and SSH in the public zone, then reload.

```shell
# Configure the FireWall service
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --permanent --zone=public --add-service=ssh
sudo firewall-cmd --reload
```

To list the zones firewalld ships with:

```shell
# List Firewalld Zones
sudo firewall-cmd --get-zones
```

To list the predefined services firewalld knows about:

```shell
# List Services Default Zone
sudo firewall-cmd --get-services
```

To verify that the default zone is configured the way we expect, we can use the following command.

```shell
# Check the FireWall service configuration
sudo firewall-cmd --list-all
```

To dump the full configuration of every zone at once:

```shell
# List All Firewalld Zones
sudo firewall-cmd --list-all-zones
```

### Step 3: set the default firewalld zone

To set the default firewalld zone, we can use the following command.

```shell
# Set up the default Firewalld zone
sudo firewall-cmd --set-default-zone=public
```

### Step 4: check the firewall status

To check the firewalld status, we can use the following command.

```shell
# Check the FireWall status
sudo firewall-cmd --state
```

### Step 5: assigning services to firewalld zones

Before we assign services to a zone, let's check that firewalld is running and see which zones are currently active.

```shell
# Assign services to Firewalld zones
firewall-cmd --state
firewall-cmd --get-active-zones
```

### Step 6: adding services to firewalld zones

To add and remove services and ports on a zone, we can use the following commands.

```shell
# Add services to Firewalld zones
firewall-cmd --add-service=rtmp

# Remove services from Firewalld zones
firewall-cmd --zone=public --remove-service=rtmp

# add port to zone
firewall-cmd --zone=public --add-port=80/tcp --permanent

# remove port from zone
firewall-cmd --zone=public --remove-port=80/tcp --permanent
```

## Conclusion

This covered installing and configuring firewalld on Amazon Linux 2: enabling the service, setting the default zone, and managing services and ports.

## References

- [Firewalld Official Website](https://firewalld.org/)
- [Firewalld Documentation - Introduction to firewalld](https://firewalld.org/documentation/man-pages/firewalld.html)
- [Firewalld Documentation - firewall-cmd](https://firewalld.org/documentation/man-pages/firewall-cmd.html)
- [Amazon EC2 User Guide for Linux Instances](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts.html)
- [Security Groups for your VPC - AWS Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) (Note: AWS Security Groups act as a primary firewall)
- [Managing software on your Linux instance - AWS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/managing-software.html)
- [Controlling Services with systemctl - Red Hat](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system_administrators_guide/sect-managing_services_with_systemd-services) (Amazon Linux is RHEL-based)
- [Using firewalld - Fedora Project Docs](https://docs.fedoraproject.org/en-US/quick-docs/firewalld/)
- [Understanding Firewalld Zones - DigitalOcean](https://www.digitalocean.com/community/tutorials/how-to-set-up-a-firewall-using-firewalld-on-centos-7#understanding-firewalld-zones)
- [AWS - Amazon Linux 2 AMI Information](https://aws.amazon.com/amazon-linux-2/)
- [iptables Tutorial - Netfilter project](https://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO.html) (For context, as firewalld is a frontend for netfilter)