1FIREWALLD.SERVICE(5)           firewalld.service          FIREWALLD.SERVICE(5)
2
3
4

NAME

6       firewalld.service - firewalld service configuration files
7

SYNOPSIS

9       /etc/firewalld/services/service.xml
10       /usr/lib/firewalld/services/service.xml
11
12
13

DESCRIPTION

15       A firewalld service configuration file provides the information of a
16       service entry for firewalld. The most important configuration options
17       are ports, modules and destination addresses.
18
19       This example configuration file shows the structure of a service
20       configuration file:
21
22           <?xml version="1.0" encoding="utf-8"?>
23           <service>
24             <short>My Service</short>
25             <description>description</description>
26             <port port="137" protocol="tcp"/>
27             <protocol value="igmp"/>
28             <module name="nf_conntrack_netbios_ns"/>
29             <destination ipv4="224.0.0.251" ipv6="ff02::fb"/>
30             <include service="ssdp"/>
31           </service>
32
33
34

OPTIONS

36       The config can contain these tags and attributes. Some of them are
37       mandatory, others optional.
38
39   service
40       The mandatory service start and end tag defines the service. This tag
41       can only be used once in a service configuration file. There are
42       optional attributes for services:
43
44       version="string"
45           To give the service a version.
46
47   short
48       Is an optional start and end tag and is used to give an icmptype a more
49       readable name.
50
51   description
52       Is an optional start and end tag to have a description for a icmptype.
53
54   port
55       Is an optional empty-element tag and can be used several times to have
56       more than one port entry. All attributes of a port entry are mandatory:
57
58       port="string"
59           The port string can be a single port number or a port range
60           portid-portid or also empty to match a protocol only.
61
62       protocol="string"
63           The protocol value can either be tcp, udp, sctp or dccp.
64
65       For compatibility with older firewalld versions, it is possible to add
66       protocols with the port option where the port is empty. With the
67       addition of native protocol support in the service, this it not needed
68       anymore. These entries will automatically be converted to protocols.
69       With the next modification of the service file, the enries will be
70       listed as protocols.
71
72   protocol
73       Is an optional empty-element tag and can be used several times to have
74       more than one protocol entry. A protocol entry has exactly one
75       attribute:
76
77       value="string"
78           The protocol can be any protocol supported by the system. Please
79           have a look at /etc/protocols for supported protocols.
80
81   source-port
82       Is an optional empty-element tag and can be used several times to have
83       more than one source port entry. All attributes of a source port entry
84       are mandatory:
85
86       port="string"
87           The port string can be a single port number or a port range
88           portid-portid.
89
90       protocol="string"
91           The protocol value can either be tcp, udp, sctp or dccp.
92
93   module
94       Is an optional empty-element tag and can be used several times to
95       enable more than one netfilter kernel helper for the service. A module
96       entry has exactly one attribute:
97
98       name="string"
99           Defines the name of the kernel netfilter helper as a string.
100
101   destination
102       Is an optional empty-element tag and can be used only once. The
103       destination specifies the destination network as a network IP address
104       (optional with /mask), or a plain IP address. The use of hostnames is
105       not recommended, because these will only be resolved at service
106       activation and transmitted to the kernel. For more information in this
107       element, please have a look at --destination in iptables(8) and
108       ip6tables(8).
109
110       ipv4="address[/mask]"
111           The IPv4 destination address with optional mask.
112
113       ipv6="address[/mask]"
114           The IPv6 destination address with optional mask.
115
116   include
117       Is an optional empty-element tag and can be used several times to have
118       more than one include entry. An include entry has exactly one
119       attribute:
120
121       service="string"
122           The include can be any service supported by firewalld.
123
124           Warning:Firewalld will only check that the included service is a
125           valid service if it's applied to a zone.
126

SEE ALSO

128       firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1),
129       firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5),
130       firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-
131       offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5),
132       firewalld.zone(5), firewalld.zones(5), firewalld.ipset(5),
133       firewalld.helper(5)
134

NOTES

136       firewalld home page:
137           http://firewalld.org
138
139       More documentation with examples:
140           http://fedoraproject.org/wiki/FirewallD
141

AUTHORS

143       Thomas Woerner <twoerner@redhat.com>
144           Developer
145
146       Jiri Popelka <jpopelka@redhat.com>
147           Developer
148
149
150
151firewalld 0.7.2                                           FIREWALLD.SERVICE(5)
Impressum