semanage Allow and Delete ports in CentOS

The commands are for CentOS, but should work on Fedora and RedHat.

If semanage is not installed refer to here.

You would typically use this along with the systems firewall to allow a port through.  Guide for firewalld and iptables.  If you change it in the firewall and fail to add/edit it in semanage you can potentially get weird behavior like sshd not wanting to start after changing the port.

Add port

semanage port -a -t ssh_port_t tcp 2222

The above command allows the sshd service to start, using port 2222.

List allowed ports

semanage port -l

You can use grep to filter the results


[admin@localhost ~]# semanage port -l | grep ssh
ssh_port_t tcp 2222, 22
[admin@localhost ~]#

Delete port

semanage port -d -p tcp 2222

Other examples

Allow SNMP

semanage port -a -t snmp_port_t tcp 2222


Allow KDE Connect through firewall


sudo firewall-cmd --zone=public --permanent --add-port=1714-1764/tcp
sudo firewall-cmd --zone=public --permanent --add-port=1714-1764/udp
sudo systemctl restart firewalld.service

UFW firewall

sudo ufw allow 1714:1764/udp
sudo ufw allow 1714:1764/tcp
sudo ufw reload

More information

How to Allow a Port Through Firewalld

Note: If you have SELinux enabled you’ll need to allow the port in semanage.

Basic syntax

 firewall-cmd --zone=public --add-port=(port number)/(protocal)

So the command to allow port 80 through the firewall would be

firewall-cmd --zone=public --add-port=http/tcp
firewall-cmd --zone=public --add-port=80/tcp

The above command only works for the running instance of firewalld.  If you want to add the port permanetely you need to run the above command and then run it again with “–permanent” added to the end of the command.


firewall-cmd --zone=public --add-port=http/tcp
firewall-cmd --zone=public --add-port=http/tcp --permanent