1FIREWALLD.POLICY(5) firewalld.policy FIREWALLD.POLICY(5)
2
6 firewalld.policy - firewalld policy configuration files
7
9 /etc/firewalld/policies/policy.xml
10 /usr/lib/firewalld/policies/policy.xml
12
14 A firewalld policy configuration file contains the information for a
15 policy. These are the policy descriptions, services, ports, protocols,
16 icmp-blocks, masquerade, forward-ports and rich language rules in an
17 XML file format. The file name has to be policy_name.xml where length
18 of policy_name is currently limited to 17 chars.
19 This is the structure of a policy configuration file:
21 <?xml version="1.0" encoding="utf-8"?>
23 <policy [version="versionstring"] [target="CONTINUE|ACCEPT|REJECT|DROP"] [priority="priority"]>
24 [ <ingress-zone name="zone"/> ]
25 [ <egress-zone name="zone"/> ]
26 [ <short>short description</short> ]
32 [ <description>description</description> ]
33 [ <service name="string"/> ]
34 [ <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> ]
35 [ <protocol value="protocol"/> ]
36 [ <icmp-block name="string"/> ]
37 [ <masquerade/> ]
38 [ <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="IP address"]/> ]
39 [ <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> ]
40 [
41 <rule [family="ipv4|ipv6"]>
42 [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]
43 [ <destination address="address[/mask]" [invert="True"]/> ]
44 [
45 <service name="string"/> |
46 <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
47 <protocol value="protocol"/> |
48 <icmp-block name="icmptype"/> |
49 <icmp-type name="icmptype"/> |
50 <masquerade/> |
51 <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/>
52 ]
53 [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> ]
54 [ <audit> [<limit value="rate/duration"/>] </audit> ]
55 [
56 <accept> [<limit value="rate/duration"/>] </accept> |
57 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
58 <drop> [<limit value="rate/duration"/>] </drop> |
59 <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
60 ]
61 </rule>
62 ]
63 </policy>
66 The config can contain these tags and attributes. Some of them are
69 mandatory, others optional.
70 policy
72 The mandatory policy start and end tag defines the policy. This tag can
73 only be used once in a policy configuration file. There are optional
74 attributes for policy:
75 version="string"
77 To give the policy a version.
78 target="CONTINUEACCEPT|REJECT|DROP"
80 Can be used to accept, reject or drop every packet that doesn't
81 match any rule (port, service, etc.). The CONTINUE is the default
82 and used for policies that an non-terminal.
83 ingress-zone
85 An optional element that can be used several times. It can be the name
86 of a firewalld zone or one of the symbolic zones: HOST, ANY. See
87 firewalld.policies(5) for information about symbolic zones.
88 egress-zone
90 An optional element that can be used several times. It can be the name
91 of a firewalld zone or one of the symbolic zones: HOST, ANY. See
92 firewalld.policies(5) for information about symbolic zones.
93 short
95 Is an optional start and end tag and is used to give a more readable
96 name.
97 description
99 Is an optional start and end tag to have a description.
100 service
102 Is an optional empty-element tag and can be used several times to have
103 more than one service entry enabled. A service entry has exactly one
104 attribute:
105 name="string"
107 The name of the service to be enabled. To get a list of valid
108 service names firewall-cmd --list=services can be used.
109 port
111 Is an optional empty-element tag and can be used several times to have
112 more than one port entry. All attributes of a port entry are mandatory:
113 port="portid[-portid]"
115 The port can either be a single port number portid or a port range
116 portid-portid.
117 protocol="tcp|udp|sctp|dccp"
119 The protocol can either be tcp, udp, sctp or dccp.
120 protocol
122 Is an optional empty-element tag and can be used several times to have
123 more than one protocol entry. All protocol has exactly one attribute:
124 value="string"
126 The protocol can be any protocol supported by the system. Please
127 have a look at /etc/protocols for supported protocols.
128 icmp-block
130 Is an optional empty-element tag and can be used several times to have
131 more than one icmp-block entry. Each icmp-block tag has exactly one
132 mandatory attribute:
133 name="string"
135 The name of the Internet Control Message Protocol (ICMP) type to be
136 blocked. To get a list of valid ICMP types firewall-cmd
137 --list=icmptypes can be used.
138 masquerade
140 Is an optional empty-element tag. It can be used only once. If it's
141 present masquerading is enabled.
142 forward-port
144 Is an optional empty-element tag and can be used several times to have
145 more than one port or packet forward entry. There are mandatory and
146 also optional attributes for forward ports:
147 Mandatory attributes:
149 The local port and protocol to be forwarded.
150 port="portid[-portid]"
152 The port can either be a single port number portid or a port
153 range portid-portid.
154 protocol="tcp|udp|sctp|dccp"
156 The protocol can either be tcp, udp, sctp or dccp.
157 Optional attributes:
159 The destination of the forward. For local forwarding add to-port
160 only. For remote forwarding add to-addr and use to-port optionally
161 if the destination port on the destination machine should be
162 different.
163 to-port="portid[-portid]"
165 The destination port or port range to forward to. If omitted,
166 the value of the port= attribute will be used altogether with
167 the to-addr attribute.
168 to-addr="address"
170 The destination IP address either for IPv4 or IPv6.
171 source-port
173 Is an optional empty-element tag and can be used several times to have
174 more than one source port entry. All attributes of a source port entry
175 are mandatory:
176 port="portid[-portid]"
178 The port can either be a single port number portid or a port range
179 portid-portid.
180 protocol="tcp|udp|sctp|dccp"
182 The protocol can either be tcp, udp, sctp or dccp.
183 rule
185 Is an optional element tag and can be used several times to have more
186 than one rich language rule entry.
187 The general rule structure:
189 <rule [family="ipv4|ipv6"]>
191 [ <source address="address[/mask]" [invert="True"]/> ]
192 [ <destination address="address[/mask]" [invert="True"]/> ]
193 [
194 <service name="string"/> |
195 <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
196 <protocol value="protocol"/> |
197 <icmp-block name="icmptype"/> |
198 <icmp-type name="icmptype"/> |
199 <masquerade/> |
200 <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/> |
201 <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
202 ]
203 [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ]
204 [ <audit> [<limit value="rate/duration"/>] </audit> ]
205 [
206 <accept> [<limit value="rate/duration"/>] </accept> |
207 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
208 <drop> [<limit value="rate/duration"/>] </drop> |
209 <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
210 ]
211 </rule>
212 Rule structure for source black or white listing:
215 <rule [family="ipv4|ipv6"]>
217 <source address="address[/mask]" [invert="True"]/>
218 [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ]
219 [ <audit> [<limit value="rate/duration"/>] </audit> ]
220 <accept> [<limit value="rate/duration"/>] </accept> |
221 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
222 <drop> [<limit value="rate/duration"/>] </drop>
223 </rule>
224 For a full description on rich language rules, please have a look at
227 firewalld.richlanguage(5).
228
230 firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1),
231 firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5),
232 firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-
233 offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5),
234 firewalld.zone(5), firewalld.zones(5), firewalld.policy(5),
235 firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5)
236
238 firewalld home page:
239 http://firewalld.org
240 More documentation with examples:
242 http://fedoraproject.org/wiki/FirewallD
243
245 Thomas Woerner <twoerner@redhat.com>
246 Developer
247 Jiri Popelka <jpopelka@redhat.com>
249 Developer
250 Eric Garver <eric@garver.life>
252 Developer
253firewalld 0.9.3 FIREWALLD.POLICY(5)