How to Start/Stop and Enable/Disable FirewallD and Iptables Firewall in Linux

Firewall is a software that acts as a shield between user’s system and external network allowing some packets to pass while discarding other’s. Firewall commonly operates on network layer i.e. on IP packets both Ipv4 and Ipv6.

Whether a packet will pass or will be bocked, depends on the rules against such type of packets in the firewall. These rules can be built-in or user-defined ones. Each packet which enters the network has to pass through this shield which verifies it against rules defined in it for such type of packets.

Each rule has a target action which is to be applied in case the packet fails to satisfy it. On Linux systems, firewall as a service is provided by many softwares, most common which are: firewalld and iptables.

In Linux there are many different types of firewalls used, but most standard ones are Iptables and Firewalld, which is going to discuss in this article.

What is FirewallD

FirewallD is the Dynamic Firewall Manager of Linux systems. This service is used to configure the network connections, thus deciding which external network or internal packets to allow traversing the network and which to block.

It allows two types of configurations, permanent and runtime. Runtime configurations will get lost ones the service is restarted while the permanent ones get retained across the system boot so that they are followed every time the service gets active.

Corresponding to these configurations, firewallD has two directories, default/fallback one (/usr/lib/firewall) which is lost ones system is updated and the system configuration (/etc/firewall) which remains permanent and overrides the default one if given. This is found as a default service in RHEL/CentOS 7 and Fedora 18.

What is Iptables

Iptables is another service which decides to allow, drop or return IP packets. Iptables service manages Ipv4 packets while Ip6tables manages Ipv6 packets. This service manages a list of tables where each table is maintained for different purpose like: ‘filter‘ table is for firewall rules, ‘nat‘ table is consulted in case of new connection, ‘mangle‘ in case of packet alterations and so on.

Each table further has chains which can be built-in or user-defined where a chain signifies a set of rules which are applies to a packet, thus deciding what the target action for that packet should be i.e. it must be ALLOWED, BLOCKED or RETURNED. This service is a default service on systems like: RHEL/CentOS 6/5 and Fedora, ArchLinux, Ubuntu etc.

To learn more about firewalls, follow the following links:

  1. Understanding IPtables Firewall Basics and Tips
  2. Configure Iptables Firewall in Linux
  3. Configure FirewallD in Linux
  4. Useful FirewallD Rules to Manage Firewall in Linux
  5. How to Control Network Traffic Using FirewallD and Iptables

In this article we will explain how to start, stop or restart Iptables and FirewallD services in Linux.

How to Start/Stop and Enable/Disable FirewallD Service

If you’re using CentOS/RHEL 7 or Fedora 18+ versions, you should follow below instructions to manage FirewallD service.

Start FirewallD Service
# systemctl start firewalld 
Stop FirewallD Service
# systemctl stop firewalld
Check the Status of FirewallD
# systemctl status firewalld
Check the State of FirewallD
# firewall-cmd --state

As an alternative, you can disable the firewalld service so that it doesn’t apply rules to packets and enable ones needed again.

Disable FirewallD Service
# systemctl disable firewalld
Enable FirewallD Service
# systemctl enable firewalld
Mask FirewallD Service
# systemctl mask firewalld

Also, you can mask the firewall service which creates a symbolic link of the firewall.service to /dev/null, thus disabling the service.

Unmask FirewallD Service
# systemctl unmask firewalld

This is reverse of masking the service. This removes the symlink of the service created during masking, thus re-enabling the service.

How to Start/Stop and Enable/Disable IPtables Service

On RHEL/CentOS 6/5/4 and Fedora 12-18 iptables firewall comes as pre and later, the iptables service can be installed via:

# yum install iptables-services

Then, the service can be started, stopped or restarted via following commands:

Start Iptables Service
# systemctl start iptables
# service iptables start
Stop Iptables Service
# systemctl stop iptables
# service iptables stop
Disable Iptables Service
# systemctl disable iptables
# service iptables save
# service iptables stop
Enable Iptables Service
# systemctl enable iptables
# service iptables start
Check Status of Iptables Service
# systemctl status iptables
# service iptables status

On Ubuntu and some other Linux distributions however, ufw is the command which is used to manage the iptables firewall service. Ufw provides an easy interface for the user to handle the iptables firewall service.

Enable Ufw Iptables Firewall
$ sudo ufw enable
Disable Ufw Iptables Firewall
$ sudo ufw disable
Check Status of Ufw Iptables Firewall
# sudo ufw status 

However, if you want to list chains in iptables which contains all the rules following command can help you achieve the same:

# iptables -L -n -v


These are the techniques which can help you start, stop, disable and enable the packet management services in Linux Based Systems. Different Linux distros can have different services as default, like: Ubuntu can have iptables as the default and pre-installed service, while CentOS can have firewalld as the default configured service for managing incoming and outgoing of IP packets.

Presented in this article are the most common tricks to manage these services on almost all Linux Distros, however, if you find something and would like to add on to this article, your comments are always welcome.

Gunjit Khera
Currently a Computer Science student and a geek when it comes to Operating System and its concepts. Have 1+ years of experience in Linux and currently doing a research on its internals along with developing applications for Linux on python and C.

Each tutorial at TecMint is created by a team of experienced Linux system administrators so that it meets our high-quality standards.

Join the TecMint Weekly Newsletter (More Than 156,129 Linux Enthusiasts Have Subscribed)
Was this article helpful? Please add a comment or buy me a coffee to show your appreciation.


Leave a Reply
  1. Hi, the first 2 commands are incorrect.

    # systemctl firewalld start >> should be >> # systemctl start firewalld
    # systemctl firewalld stop >> should be >> # systemctl stop firewalld

  2. Hello, great post.
    Im starting to set some rules in my laptop, just a question, I have 2 NIC; eth0 and eth1. Both have internet connection, so i cant deny internet package from eth1? Thanks

    • @Kevin,

      Yes, you can deny Internet traffic on particular NIC, in your case it is eth1 and the rule for iptables is:

      # iptables -I INPUT -i eth1 -j DROP

Got Something to Say? Join the Discussion...

Thank you for taking the time to share your thoughts with us. We appreciate your decision to leave a comment and value your contribution to the discussion. It's important to note that we moderate all comments in accordance with our comment policy to ensure a respectful and constructive conversation.

Rest assured that your email address will remain private and will not be published or shared with anyone. We prioritize the privacy and security of our users.