turn on firewalld

firewall.conf

@@ -0,0 +1,15 @@
+# Allowed through firewalld (default zone) by install and update.
+# Removing an entry here does not close it; use firewall-cmd for that.
+
+# firewalld service names (see `firewall-cmd --get-services`)
+FIREWALL_SERVICES=(
+  ssh            # remote login
+  dhcpv6-client  # IPv6 address from the router
+  mdns           # Avahi: <hostname>.local
+  cockpit        # Cockpit web console, port 9090
+)
+
+# Extra ports, e.g. for pm2 apps: "3000/tcp"
+# Docker containers' published ports don't need to be listed here.
+FIREWALL_PORTS=(
+)