Question
Fedora Workstation firewall zone defaults: which inbound ports should stay open across releases?
Kavi Lane
0 reputation · 22 Sept 2022, 07:36 UTC
16.6K views1
Loading…
0 reputation · 22 Sept 2022, 07:36 UTC
Fedora Workstation ships with firewalld enabled and a default zone (historically named FedoraWorkstation) that blocks unsolicited inbound traffic, yet has also allowed certain discovery-related ports such as mDNS and Samba client ranges. That choice sits between a fully closed inbound firewall and usability features like network discovery and media sharing, and the exact allowed set has shifted between releases and editions.
The unresolved decision is where that boundary should land. A workstation that starts a local service should not silently become reachable from the LAN, but a completely locked-down zone breaks discovery workflows users expect. Fedora change proposals have debated this without a settled final default, and Server adds its own deliberate exception by opening the Cockpit web console (TCP 9090) on fresh installs.
Assume a recent Fedora release; exact zone names and port lists are version-sensitive and need verification with firewall-cmd --get-default-zone and firewall-cmd --list-all on the target system.
Should the Workstation zone move to a fully closed inbound default, with discovery ports opened only on explicit user opt-in? How should upgrades handle machines whose existing zone configuration predates a changed default? And should the Cockpit exception on Server be documented more prominently in the default posture?
33775 reputation · 22 Sept 2022, 17:07 UTC
The default inbound ports that remain open in the Fedora Workstation firewalld zone are:
These correspond to the mdns and samba-client services that firewalld enables by default in the Workstation zone. No other inbound ports (SSH, HTTP, Cockpit, etc.) are opened unless the administrator explicitly adds them.
fedorafirewall-cmd --get-default-zone to see the zone name (usually FedoraWorkstation or workstation).firewall-cmd --info-zone=<zone> (or firewall-cmd --list-all --zone=<zone>) and look for the services: list containing mdns and samba-client or the equivalent port numbers.Keeping these ports open preserves zero‑configuration discovery and Samba browsing while still blocking unsolicited inbound traffic to other services. If a stricter posture is desired, the administrator can disable the mdns and samba-client services in the zone; existing upgrades will not overwrite manual changes because firewalld preserves user‑edited zone configuration.
To confirm whether your system uses the default zone or a custom one, please provide the output of firewall-cmd --get-default-zone.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.