AvailabilitySign inBook a DemoJoin Waitlist
Back to Learning
RHCSA · EX200Beginner

Linux Firewalld & iptables Policy

firewall-cmd returned success and the port is still closed. Find the zone the interface actually belongs to, live, right below.

Interactive simSecurityLinuxFirewall

Symptom

Zone-based firewalld policy, iptables/nftables rule chains, and troubleshooting a host that's silently dropping traffic.

Your mission

Inspect, recover, then verify

Format

Linux shell

Start interactive labSee the investigation plan ↓Need a hint? Reveal the root cause ↓
Linux Firewalld: The Rule in the Wrong Zone

Investigate before you configure.

Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.

Observe the symptom and link state.

Diagnose by comparing the protocol evidence.

Verify the expected device state and confirm the original symptom is resolved.

Console access: Linux

This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.

Need a hint?

Reveal the root cause when you're ready.

Try the investigation first, then use this as your escape hatch, not a dead end.

Locked

Sign up with your email to open Linux Firewalld & iptables Policy, free. You get the root cause and the full step-by-step fix.

No spam. The fix lands in your inbox too. Signing up includes 4 guided labs free, tracked against your email. After that, the Learning Pass unlocks every remaining lab.

Lab debrief

Turn the session into a repeatable troubleshooting pattern.

Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.

The problem

A service is supposed to be reachable on its assigned port, and firewalld reports a rule allowing it, but connections from a test client are silently dropped anyway.

What you'll practice

  • Configure firewalld zones and assign interfaces/services to them
  • Write and order iptables/nftables rule chains by hand
  • Open and restrict specific ports and services safely
  • Use firewall-cmd runtime vs. permanent configuration correctly
  • Diagnose a host that's silently dropping traffic

The topology

A single RHEL host sits between two test clients, so every zone and rule change has an immediately visible effect on real traffic, exactly the setup RHCSA firewall questions assume.

Commands to run yourself

The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.

Which zone owns which interface
firewall-cmd --get-active-zones
Inspect the public zone
firewall-cmd --list-all --zone=public
Inspect the internal zone
firewall-cmd --list-all --zone=internal

Topology diagram

Fact-checked references

The commands and behaviour in this lab were checked against these primary references.

Frequently asked

Do I need to install RHEL myself?

No. A fully licensed RHEL host with firewalld and iptables/nftables is ready at session start. You configure policy, not the OS.

Is this relevant to the RHCSA exam?

Yes. Firewalld zones and basic packet filtering are explicit RHCSA (EX200) objectives, and this lab drills exactly that scope.

Ready to run this lab yourself?

No setup, no image sourcing. Book a session or ask for a live demo.

View availabilityBook a demo