I just installed centos 7, few days ago
my CentOS version : Linux release 7.6.1810 (Core)
this is my first time using centos 7, but i am very familiar with centos 6


Is firewalld started/enabled as default when centos rebooted?


after started using this command
service firewalld start

why i cant access any ports anymore, like 2087 (WHM), 21 (FTP) or any ports?
do i need to set them all, like below?
firewall-cmd --permanent --zone=public --add-port=2087/tcp
firewall-cmd --permanent --zone=public --add-port=21/tcp


i can access them again after run this command
service firewalld stop


thank you for your answer

Welcome to LinuxQuestions.

Similar to CentOS 6 the default firewall is enabled and only allows ssh traffic. While service still works you should become familiar with the systemctl command.

Yes, the posted commands will open the associated ports but you should reload the firewall.
firewall-cmd --reload

whoa, so if starting/enabling firewalld i need to run all of these manually?

firewall-cmd --permanent --zone=public --add-port=2087/tcp
firewall-cmd --permanent --zone=public --add-port=21/tcp
firewall-cmd --reload


is there tutorial/complete list port i need to add?

if we are already using CSF in cpanel, do we still need firewalld? are they both handling the same thing?

this is answer from cpanel people https://forums.cpanel.net/threads/fi.../#post-2448543 , but i want answer from linux centos people too here

The --permanent option saves the new rules but does not change the run time environment. Reloading the rules is necessary to update the running firewall.

Not using the --permanent option changes run time but they are not saved.

Once the rules are saved they are automatically loaded when the firewall starts at boot time.

What ports you need to add depends on what services you run and what you want to make available to the outside world (LAN or WAN). There are many firewalld guides/tutorials.

https://www.linode.com/docs/security...lld-on-centos/

By default, both Centos 6 and 7 block all ports except 22. Centos 6 doesn’t have the firewalld and you need to use other tools to unblock ports.

That depends on the applications you are running. If you run a webserver, open ports 80 and 443. In case of an iSCSI target, 3260, and so on.

Note that firewall-cmd also has an add-service option, which opens the required ports and might do other things for difficult services like ftp.