1FIREWALLD.POLICY(5) firewalld.policy FIREWALLD.POLICY(5)
2
3
4
6 firewalld.policy - firewalld policy configuration files
7
9 /etc/firewalld/policies/policy.xml
10
11 /usr/lib/firewalld/policies/policy.xml
12
14 A firewalld policy configuration file contains the information for a
15 policy. These are the policy descriptions, services, ports, protocols,
16 icmp-blocks, masquerade, forward-ports and rich language rules in an
17 XML file format. The file name has to be policy_name.xml where length
18 of policy_name is currently limited to 17 chars.
19
20 This is the structure of a policy configuration file:
21
22 <?xml version="1.0" encoding="utf-8"?>
23 <policy [version="versionstring"] [target="CONTINUE|ACCEPT|REJECT|DROP"] [priority="priority"]>
24 [ <ingress-zone name="zone"/> ]
25 [ <egress-zone name="zone"/> ]
26
27
28
29
30
31 [ <short>short description</short> ]
32 [ <description>description</description> ]
33 [ <service name="string"/> ]
34 [ <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> ]
35 [ <protocol value="protocol"/> ]
36 [ <icmp-block name="string"/> ]
37 [ <masquerade/> ]
38 [ <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="IP address"]/> ]
39 [ <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> ]
40 [
41 <rule [family="ipv4|ipv6"] [priority="priority"]>
42 [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]
43 [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ]
44 [
45 <service name="string"/> |
46 <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
47 <protocol value="protocol"/> |
48 <icmp-block name="icmptype"/> |
49 <icmp-type name="icmptype"/> |
50 <masquerade/> |
51 <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/>
52 ]
53 [
54 <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
55 <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
56 ]
57 [ <audit> [<limit value="rate/duration"/>] </audit> ]
58 [
59 <accept> [<limit value="rate/duration"/>] </accept> |
60 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
61 <drop> [<limit value="rate/duration"/>] </drop> |
62 <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
63 ]
64 </rule>
65 ]
66
67
68 </policy>
69
70
71 The config can contain these tags and attributes. Some of them are
72 mandatory, others optional.
73
74 policy
75 The mandatory policy start and end tag defines the policy. This tag can
76 only be used once in a policy configuration file. There are optional
77 attributes for policy:
78
79 version="string"
80 To give the policy a version.
81
82 target="CONTINUE|ACCEPT|REJECT|DROP"
83 Can be used to accept, reject or drop every packet that doesn't
84 match any rule (port, service, etc.). The CONTINUE is the default
85 and used for policies that are non-terminal.
86
87 ingress-zone
88 An optional element that can be used several times. It can be the name
89 of a firewalld zone or one of the symbolic zones: HOST, ANY. See
90 firewalld.policies(5) for information about symbolic zones.
91
92 egress-zone
93 An optional element that can be used several times. It can be the name
94 of a firewalld zone or one of the symbolic zones: HOST, ANY. See
95 firewalld.policies(5) for information about symbolic zones.
96
97 short
98 Is an optional start and end tag and is used to give a more readable
99 name.
100
101 description
102 Is an optional start and end tag to have a description.
103
104 service
105 Is an optional empty-element tag and can be used several times to have
106 more than one service entry enabled. A service entry has exactly one
107 attribute:
108
109 name="string"
110 The name of the service to be enabled. To get a list of valid
111 service names firewall-cmd --get-services can be used.
112
113 port
114 Is an optional empty-element tag and can be used several times to have
115 more than one port entry. All attributes of a port entry are mandatory:
116
117 port="portid[-portid]"
118 The port can either be a single port number portid or a port range
119 portid-portid.
120
121 protocol="tcp|udp|sctp|dccp"
122 The protocol can either be tcp, udp, sctp or dccp.
123
124 protocol
125 Is an optional empty-element tag and can be used several times to have
126 more than one protocol entry. All protocol has exactly one attribute:
127
128 value="string"
129 The protocol can be any protocol supported by the system. Please
130 have a look at /etc/protocols for supported protocols.
131
132 icmp-block
133 Is an optional empty-element tag and can be used several times to have
134 more than one icmp-block entry. Each icmp-block tag has exactly one
135 mandatory attribute:
136
137 name="string"
138 The name of the Internet Control Message Protocol (ICMP) type to be
139 blocked. To get a list of valid ICMP types firewall-cmd
140 --get-icmptypes can be used.
141
142 masquerade
143 Is an optional empty-element tag. It can be used only once. If it's
144 present masquerading is enabled.
145
146 forward-port
147 Is an optional empty-element tag and can be used several times to have
148 more than one port or packet forward entry. There are mandatory and
149 also optional attributes for forward ports:
150
151 Mandatory attributes:
152 The local port and protocol to be forwarded.
153
154 port="portid[-portid]"
155 The port can either be a single port number portid or a port
156 range portid-portid.
157
158 protocol="tcp|udp|sctp|dccp"
159 The protocol can either be tcp, udp, sctp or dccp.
160
161 Optional attributes:
162 The destination of the forward. For local forwarding add to-port
163 only. For remote forwarding add to-addr and use to-port optionally
164 if the destination port on the destination machine should be
165 different.
166
167 to-port="portid[-portid]"
168 The destination port or port range to forward to. If omitted,
169 the value of the port= attribute will be used altogether with
170 the to-addr attribute.
171
172 to-addr="address"
173 The destination IP address either for IPv4 or IPv6.
174
175 source-port
176 Is an optional empty-element tag and can be used several times to have
177 more than one source port entry. All attributes of a source port entry
178 are mandatory:
179
180 port="portid[-portid]"
181 The port can either be a single port number portid or a port range
182 portid-portid.
183
184 protocol="tcp|udp|sctp|dccp"
185 The protocol can either be tcp, udp, sctp or dccp.
186
187 rule
188 Is an optional element tag and can be used several times to have more
189 than one rich language rule entry.
190
191 The general rule structure:
192
193 <rule [family="ipv4|ipv6"] [priority="priority"]>
194 [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]
195 [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ]
196 [
197 <service name="string"/> |
198 <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
199 <protocol value="protocol"/> |
200 <icmp-block name="icmptype"/> |
201 <icmp-type name="icmptype"/> |
202 <masquerade/> |
203 <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/> |
204 <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
205 ]
206 [
207 <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
208 <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
209 ]
210 [ <audit> [<limit value="rate/duration"/>] </audit> ]
211 [
212 <accept> [<limit value="rate/duration"/>] </accept> |
213 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
214 <drop> [<limit value="rate/duration"/>] </drop> |
215 <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
216 ]
217 </rule>
218
219
220 Rule structure for source black or white listing:
221
222 <rule [family="ipv4|ipv6"] [priority="priority"]>
223 <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/>
224 [
225 <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
226 <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
227 ]
228 [ <audit> [<limit value="rate/duration"/>] </audit> ]
229 <accept> [<limit value="rate/duration"/>] </accept> |
230 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
231 <drop> [<limit value="rate/duration"/>] </drop>
232 </rule>
233
234
235 For a full description on rich language rules, please have a look at
236 firewalld.richlanguage(5).
237
239 firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1),
240 firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5),
241 firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-
242 offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5),
243 firewalld.zone(5), firewalld.zones(5), firewalld.policy(5),
244 firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5)
245
247 firewalld home page:
248 http://firewalld.org
249
250 More documentation with examples:
251 http://fedoraproject.org/wiki/FirewallD
252
254 Thomas Woerner <twoerner@redhat.com>
255 Developer
256
257 Jiri Popelka <jpopelka@redhat.com>
258 Developer
259
260 Eric Garver <eric@garver.life>
261 Developer
262
263
264
265firewalld 1.3.4 FIREWALLD.POLICY(5)