1FIREWALLD.SERVICE(5) firewalld.service FIREWALLD.SERVICE(5)
2
3
4
6 firewalld.service - firewalld service configuration files
7
9 /etc/firewalld/services/service.xml
10 /usr/lib/firewalld/services/service.xml
11
12
13
15 A firewalld service configuration file provides the information of a
16 service entry for firewalld. The most important configuration options
17 are ports, modules and destination addresses.
18
19 This example configuration file shows the structure of a service
20 configuration file:
21
22 <?xml version="1.0" encoding="utf-8"?>
23 <service>
24 <short>My Service</short>
25 <description>description</description>
26 <port port="137" protocol="tcp"/>
27 <protocol value="igmp"/>
28 <module name="nf_conntrack_netbios_ns"/>
29 <destination ipv4="224.0.0.251" ipv6="ff02::fb"/>
30 </service>
31
32
33
35 The config can contain these tags and attributes. Some of them are
36 mandatory, others optional.
37
38 service
39 The mandatory service start and end tag defines the service. This tag
40 can only be used once in a service configuration file. There are
41 optional attributes for services:
42
43 version="string"
44 To give the service a version.
45
46 short
47 Is an optional start and end tag and is used to give an icmptype a more
48 readable name.
49
50 description
51 Is an optional start and end tag to have a description for a icmptype.
52
53 port
54 Is an optional empty-element tag and can be used several times to have
55 more than one port entry. All attributes of a port entry are mandatory:
56
57 port="string"
58 The port string can be a single port number or a port range
59 portid-portid or also empty to match a protocol only.
60
61 protocol="string"
62 The protocol value can either be tcp, udp, sctp or dccp.
63
64 For compatibility with older firewalld versions, it is possible to add
65 protocols with the port option where the port is empty. With the
66 addition of native protocol support in the service, this it not needed
67 anymore. These entries will automatically be converted to protocols.
68 With the next modification of the service file, the enries will be
69 listed as protocols.
70
71 protocol
72 Is an optional empty-element tag and can be used several times to have
73 more than one protocol entry. A protocol entry has exactly one
74 attribute:
75
76 value="string"
77 The protocol can be any protocol supported by the system. Please
78 have a look at /etc/protocols for supported protocols.
79
80 source-port
81 Is an optional empty-element tag and can be used several times to have
82 more than one source port entry. All attributes of a source port entry
83 are mandatory:
84
85 port="string"
86 The port string can be a single port number or a port range
87 portid-portid.
88
89 protocol="string"
90 The protocol value can either be tcp, udp, sctp or dccp.
91
92 module
93 Is an optional empty-element tag and can be used several times to
94 enable more than one netfilter kernel helper for the service. A module
95 entry has exactly one attribute:
96
97 name="string"
98 Defines the name of the kernel netfilter helper as a string.
99
100 destination
101 Is an optional empty-element tag and can be used only once. The
102 destination specifies the destination network as a network IP address
103 (optional with /mask), or a plain IP address. The use of hostnames is
104 not recommended, because these will only be resolved at service
105 activation and transmitted to the kernel. For more information in this
106 element, please have a look at --destination in iptables(8) and
107 ip6tables(8).
108
109 ipv4="address[/mask]"
110 The IPv4 destination address with optional mask.
111
112 ipv6="address[/mask]"
113 The IPv6 destination address with optional mask.
114
116 firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1),
117 firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5),
118 firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-
119 offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5),
120 firewalld.zone(5), firewalld.zones(5), firewalld.ipset(5),
121 firewalld.helper(5)
122
124 firewalld home page:
125 http://firewalld.org
126
127 More documentation with examples:
128 http://fedoraproject.org/wiki/FirewallD
129
131 Thomas Woerner <twoerner@redhat.com>
132 Developer
133
134 Jiri Popelka <jpopelka@redhat.com>
135 Developer
136
137
138
139firewalld 0.6.3 FIREWALLD.SERVICE(5)