1FIREWALLD.SERVICE(5) firewalld.service FIREWALLD.SERVICE(5)
2
3
4
6 firewalld.service - firewalld service configuration files
7
9 /etc/firewalld/services/service.xml
10 /usr/lib/firewalld/services/service.xml
11
12
13
15 A firewalld service configuration file provides the information of a
16 service entry for firewalld. The most important configuration options
17 are ports, modules and destination addresses.
18
19 This example configuration file shows the structure of a service
20 configuration file:
21
22 <?xml version="1.0" encoding="utf-8"?>
23 <service>
24 <short>My Service</short>
25 <description>description</description>
26 <port port="137" protocol="tcp"/>
27 <protocol value="igmp"/>
28 <module name="nf_conntrack_netbios_ns"/>
29 <destination ipv4="224.0.0.251" ipv6="ff02::fb"/>
30 <include service="ssdp"/>
31 <helper name="ftp"/>
32 </service>
33
34
35
37 The config can contain these tags and attributes. Some of them are
38 mandatory, others optional.
39
40 service
41 The mandatory service start and end tag defines the service. This tag
42 can only be used once in a service configuration file. There are
43 optional attributes for services:
44
45 version="string"
46 To give the service a version.
47
48 short
49 Is an optional start and end tag and is used to give an service a more
50 readable name.
51
52 description
53 Is an optional start and end tag to have a description for a service.
54
55 port
56 Is an optional empty-element tag and can be used several times to have
57 more than one port entry. All attributes of a port entry are mandatory:
58
59 port="string"
60 The port string can be a single port number or a port range
61 portid-portid or also empty to match a protocol only.
62
63 protocol="string"
64 The protocol value can either be tcp, udp, sctp or dccp.
65
66 For compatibility with older firewalld versions, it is possible to add
67 protocols with the port option where the port is empty. With the
68 addition of native protocol support in the service, this it not needed
69 anymore. These entries will automatically be converted to protocols.
70 With the next modification of the service file, the enries will be
71 listed as protocols.
72
73 protocol
74 Is an optional empty-element tag and can be used several times to have
75 more than one protocol entry. A protocol entry has exactly one
76 attribute:
77
78 value="string"
79 The protocol can be any protocol supported by the system. Please
80 have a look at /etc/protocols for supported protocols.
81
82 source-port
83 Is an optional empty-element tag and can be used several times to have
84 more than one source port entry. All attributes of a source port entry
85 are mandatory:
86
87 port="string"
88 The port string can be a single port number or a port range
89 portid-portid.
90
91 protocol="string"
92 The protocol value can either be tcp, udp, sctp or dccp.
93
94 module
95 This element is deprecated. Please use helper described below in the
96 section called “helper”.
97
98 destination
99 Is an optional empty-element tag and can be used only once. The
100 destination specifies the destination network as a network IP address
101 (optional with /mask), or a plain IP address. The use of hostnames is
102 not recommended, because these will only be resolved at service
103 activation and transmitted to the kernel. For more information in this
104 element, please have a look at --destination in iptables(8) and
105 ip6tables(8).
106
107 ipv4="address[/mask]"
108 The IPv4 destination address with optional mask.
109
110 ipv6="address[/mask]"
111 The IPv6 destination address with optional mask.
112
113 include
114 Is an optional empty-element tag and can be used several times to have
115 more than one include entry. An include entry has exactly one
116 attribute:
117
118 service="string"
119 The include can be any service supported by firewalld.
120
121 Warning:Firewalld will only check that the included service is a
122 valid service if it's applied to a zone.
123
124 helper
125 Is an optional empty-element tag and can be used several times to have
126 more than one helper entry. An helper entry has exactly one attribute:
127
128 name="string"
129 The helper can be any helper supported by firewalld.
130
132 firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1),
133 firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5),
134 firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-
135 offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5),
136 firewalld.zone(5), firewalld.zones(5), firewalld.policy(5),
137 firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5)
138
140 firewalld home page:
141 http://firewalld.org
142
143 More documentation with examples:
144 http://fedoraproject.org/wiki/FirewallD
145
147 Thomas Woerner <twoerner@redhat.com>
148 Developer
149
150 Jiri Popelka <jpopelka@redhat.com>
151 Developer
152
153 Eric Garver <eric@garver.life>
154 Developer
155
156
157
158firewalld 0.9.3 FIREWALLD.SERVICE(5)