firewalld.service(5) [centos man page]
FIREWALLD.SERVICE(5) firewalld.service FIREWALLD.SERVICE(5) NAME
firewalld.service - firewalld service configuration files SYNOPSIS
/etc/firewalld/services/service.xml /usr/lib/firewalld/services/service.xml DESCRIPTION
A firewalld service configuration file provides the information of a service entry for firewalld. The most important configuration options are ports, modules and destination addresses. This example configuration file shows the structure of an service configuration file: <?xml version="1.0" encoding="utf-8"?> <service> <short>My Service</short> <description>description</description> <port port="137" protocol="tcp"/> <module name="nf_conntrack_netbios_ns"/> <destination ipv4="224.0.0.251" ipv6="ff02::fb"/> </service> OPTIONS
The config can contain these tags and attributes. Some of them are mandatory, others optional. service The mandatory service start and end tag defines the service. This tag can only be used once in a service configuration file. There are optional attributes for services: version="string" To give the service a version. short Is an optional start and end tag and is used to give an icmptype a more readable name. description Is an optional start and end tag to have a description for a icmptype. port Is an optional empty-element tag and can be used several times to have more than one port entry. All attributes of a port entry are mandatory: port="string" The port string can be a single port number or a port range portid-portid or also empty to match a protocol only. protocol="string" If a port is given, the protocol value can either be tcp or udp. If no port is given, it can be any protocol from /etc/protocols to have a protocol match only. module Is an optional empty-element tag and can be used several times to enable more than one netfilter kernel helper for the service. A module entry has exactly one attribute: name="string" Defines the name of the kernel netfilter helper as a string. destination Is an optional empty-element tag and can be used only once. The destination specifies the destination network as a network IP address (optional with /mask), or a plain IP address. The use of hostnames is not recommended, because these will only be resolved at service activation and transmitted to the kernel. For more information in this element, please have a look at --destination in iptables(8) and ip6tables(8). ipv4="address[/mask]" The IPv4 destination address with optional mask. ipv6="address[/mask]" The IPv6 destination address with optional mask. SEE ALSO
firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1), firewalld.conf(5), firewalld.direct(5), firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5), firewalld.zones(5) NOTES
firewalld home page at fedorahosted.org: http://fedorahosted.org/firewalld/ More documentation with examples: http://fedoraproject.org/wiki/FirewallD AUTHORS
Thomas Woerner <twoerner@redhat.com> Developer Jiri Popelka <jpopelka@redhat.com> Developer firewalld 0.3.9 FIREWALLD.SERVICE(5)
Check Out this Related Man Page
FIREWALLD.ZONE(5) firewalld.zone FIREWALLD.ZONE(5) NAME
firewalld.zone - firewalld zone configuration files SYNOPSIS
/etc/firewalld/zones/zone.xml /usr/lib/firewalld/zones/zone.xml DESCRIPTION
A firewalld zone configuration file contains the information for a zone. These are the zone description, services, ports, icmp-blocks, masquerade, forward-ports and rich language rules in an XML file format. The file name has to be zone_name.xml where length of zone_name is currently limited to 17 chars. This is the structure of a zone configuration file: <?xml version="1.0" encoding="utf-8"?> <zone [version="versionstring"] [target="ACCEPT|%%REJECT%%|DROP"]> [ <short>short description</short> ] [ <description>description</description> ] [ <interface name="string"/> ] [ <source address="address[/mask]"/> ] [ <service name="string"/> ] [ <port port="portid[-portid]" protocol="tcp|udp"/> ] [ <icmp-block name="string"/> ] [ <masquerade/> ] [ <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="ipv4address"]/> ] [ <rule [family="ipv4|ipv6"]> [ <source address="address[/mask]" [invert="bool"]/> ] [ <destination address="address[/mask]" [invert="bool"]/> ] [ <service name="string"/> | <port port="portid[-portid]" protocol="tcp|udp"/> | <protocol value="protocol"/> | <icmp-block name="icmptype"/> | <masquerade/> | <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="address"]/> ] [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ] [ <audit> [<limit value="rate/duration"/>] </audit> ] [ <accept/> | <reject [type="rejecttype"]/> | <drop/> ] </rule> ] </zone> The config can contain these tags and attributes. Some of them are mandatory, others optional. zone The mandatory zone start and end tag defines the zone. This tag can only be used once in a zone configuration file. There are optional attributes for zones: version="string" To give the zone a version. target="ACCEPT|%%REJECT%%|DROP" Can be used to accept, reject or drop every packet. The ACCEPT target is used in the trusted zone, every packet will be accepted. The %%REJECT%% target is used in the block zone, every packet will be rejected with the default firewalld reject type. The DROP target is used in the drop zone, every packet will be dropped. The default target is {chain}_ZONE_{zone} and will be used if the target is not specified. If other than the default target is used, all settings except interface and source are ignored, because the first rule created in firewall for this zone is 'jump to target'. short Is an optional start and end tag and is used to give a zone a more readable name. description Is an optional start and end tag to have a description for a zone. interface Is an optional empty-element tag and can be used several times. It can be used to bind an interface to a zone. An interface entry has exactly one attribute: name="string" The name of the interface to be bound to the zone. source Is an optional empty-element tag and can be used several times. It can be used to bind a source address or source address range to a zone. A source entry has exactly one attribute: address="address[/mask]" The source to be bound to the zone. The source is either an IP address or a network IP address with a mask for IPv4 or IPv6. The network family (IPv4/IPv6) will be automatically discovered. For IPv4, the mask can be a network mask or a plain number. For IPv6 the mask is a plain number. The use of host names is not supported. service Is an optional empty-element tag and can be used several times to have more than one service entry enabled. A service entry has exactly one attribute: name="string" The name of the service to be enabled. To get a list of valid service names firewall-cmd --list=services can be used. port Is an optional empty-element tag and can be used several times to have more than one port entry. All attributes of a port entry are mandatory: port="portid[-portid]" The port can either be a single port number portid or a port range portid-portid. protocol="tcp|udp" The protocol can either be tcp or udp. icmp-block Is an optional empty-element tag and can be used several times to have more than one icmp-block entry. Each icmp-block tag has exactly one mandatory attribute: name="string" The name of the Internet Control Message Protocol (ICMP) type to be blocked. To get a list of valid ICMP types firewall-cmd --list=icmptypes can be used. masquerade Is an optional empty-element tag. It can be used only once in a zone configuration and is not usable for IPv6. If it's present masquerading is enabled for the zone. If you want to enable masquerading, you should enable it in the zone bound to the external interface. forward-port Is an optional empty-element tag and can be used several times to have more than one port or packet forward entry. This is for IPv4 only. Use rich language rules for IPv6. There are mandatory and also optional attributes for forward ports: Mandatory attributes: The local port and protocol to be forwarded. port="portid[-portid]" The port can either be a single port number portid or a port range portid-portid. protocol="tcp|udp" The protocol can either be tcp or udp. Optional attributes: The destination of the forward. For local forwarding add to-port only. For remote forwarding add to-addr and use to-port optionally if the destination port on the destination machine should be different. to-port="portid[-portid]" The destination port or port range to forward to. If omitted, the value of the port= attribute will be used altogether with the to-addr attribute. to-addr="address" The destination IPv4 IP address. rule Is an optional element tag and can be used several times to have more than one rich language rule entry. The general rule structure: <rule [family="ipv4|ipv6"]/> [ <source address="address[/mask]" [invert="bool"]/> ] [ <destination address="address[/mask]" [invert="bool"]/> ] [ <service name="string"/> | <port port="portid[-portid]" protocol="tcp|udp"/> | <protocol value="protocol"/> | <icmp-block name="icmptype"/> | <masquerade/> | <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="address"]/> ] [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ] [ <audit> [<limit value="rate/duration"/>] </audit> ] [ <accept/> | <reject [type="rejecttype"]/> | <drop/> ] </rule> Rule structure for source black or white listing: <rule [family="ipv4|ipv6"]/> <source address="address[/mask]" [family="bool"]/> [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ] [ <audit> [<limit value="rate/duration"/>] </audit> ] <accept/> | <reject [type="rejecttype"]/> | <drop/> </rule> For a full description on rich language rules, please have a look at firewalld.richlanguage(5). SEE ALSO
firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1), firewalld.conf(5), firewalld.direct(5), firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5), firewalld.zones(5) NOTES
firewalld home page at fedorahosted.org: http://fedorahosted.org/firewalld/ More documentation with examples: http://fedoraproject.org/wiki/FirewallD AUTHORS
Thomas Woerner <twoerner@redhat.com> Developer Jiri Popelka <jpopelka@redhat.com> Developer firewalld 0.3.9 FIREWALLD.ZONE(5)