On 15/08/2022 14:10, Samuel Bächler via BitFolk Users wrote: That's because when you stop firewalld, there is no firewall any more :) The default policy is "allow" start it and add some rules. There will be some default zones defined by the debian installation for example, to see which "zones" (sets of rules associated with an interface, usually) firewalld is currently using: # firewall-cmd --get-active-zones public interfaces: eth0 zone2 interfaces: eth0:1 You can get the rules (which firewalld sees as "services" or "ports") for a given service like this: # firewall-cmd --info-zone public public target: default icmp-block-inversion: no interfaces: sources: services: http https imaps smtp smtp-submission ssh ports: 2022/tcp 1025/tcp protocols: forward: no masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: you can see what a particular service means like this: # firewall-cmd --info-service smtp-submission smtp-submission ports: 587/tcp protocols: source-ports: modules: destination: includes: helpers: To see all the zones and rules: # firewall-cmd --list-all-zones [... lots of output, probably ...] Lots more (very good) docs here: https://firewalld.org/documentation/ Stuart