1FIREWALLD.POLICY(5) firewalld.policy FIREWALLD.POLICY(5)
2
6 firewalld.policy - firewalld policy configuration files
7
9 /etc/firewalld/policies/policy.xml
10 /usr/lib/firewalld/policies/policy.xml
12
14 A firewalld policy configuration file contains the information for a
15 policy. These are the policy descriptions, services, ports, protocols,
16 icmp-blocks, masquerade, forward-ports and rich language rules in an
17 XML file format. The file name has to be policy_name.xml where length
18 of policy_name is currently limited to 17 chars.
19 This is the structure of a policy configuration file:
21 <?xml version="1.0" encoding="utf-8"?>
23 <policy [version="versionstring"] [target="CONTINUE|ACCEPT|REJECT|DROP"] [priority="priority"]>
24 [ <ingress-zone name="zone"/> ]
25 [ <egress-zone name="zone"/> ]
26 [ <short>short description</short> ]
32 [ <description>description</description> ]
33 [ <service name="string"/> ]
34 [ <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> ]
35 [ <protocol value="protocol"/> ]
36 [ <icmp-block name="string"/> ]
37 [ <masquerade/> ]
38 [ <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="IP address"]/> ]
39 [ <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> ]
40 [
41 <rule [family="ipv4|ipv6"] [priority="priority"]>
42 [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]
43 [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ]
44 [
45 <service name="string"/> |
46 <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
47 <protocol value="protocol"/> |
48 <icmp-block name="icmptype"/> |
49 <icmp-type name="icmptype"/> |
50 <masquerade/> |
51 <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/>
52 ]
53 [
54 <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
55 <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
56 ]
57 [ <audit> [<limit value="rate/duration"/>] </audit> ]
58 [
59 <accept> [<limit value="rate/duration"/>] </accept> |
60 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
61 <drop> [<limit value="rate/duration"/>] </drop> |
62 <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
63 ]
64 </rule>
65 ]
66 </policy>
69 The config can contain these tags and attributes. Some of them are
72 mandatory, others optional.
73 policy
75 The mandatory policy start and end tag defines the policy. This tag can
76 only be used once in a policy configuration file. There are optional
77 attributes for policy:
78 version="string"
80 To give the policy a version.
81 target="CONTINUE|ACCEPT|REJECT|DROP"
83 Can be used to accept, reject or drop every packet that doesn't
84 match any rule (port, service, etc.). The CONTINUE is the default
85 and used for policies that are non-terminal.
86 ingress-zone
88 An optional element that can be used several times. It can be the name
89 of a firewalld zone or one of the symbolic zones: HOST, ANY. See
90 firewalld.policies(5) for information about symbolic zones.
91 egress-zone
93 An optional element that can be used several times. It can be the name
94 of a firewalld zone or one of the symbolic zones: HOST, ANY. See
95 firewalld.policies(5) for information about symbolic zones.
96 short
98 Is an optional start and end tag and is used to give a more readable
99 name.
100 description
102 Is an optional start and end tag to have a description.
103 service
105 Is an optional empty-element tag and can be used several times to have
106 more than one service entry enabled. A service entry has exactly one
107 attribute:
108 name="string"
110 The name of the service to be enabled. To get a list of valid
111 service names firewall-cmd --get-services can be used.
112 port
114 Is an optional empty-element tag and can be used several times to have
115 more than one port entry. All attributes of a port entry are mandatory:
116 port="portid[-portid]"
118 The port can either be a single port number portid or a port range
119 portid-portid.
120 protocol="tcp|udp|sctp|dccp"
122 The protocol can either be tcp, udp, sctp or dccp.
123 protocol
125 Is an optional empty-element tag and can be used several times to have
126 more than one protocol entry. All protocol has exactly one attribute:
127 value="string"
129 The protocol can be any protocol supported by the system. Please
130 have a look at /etc/protocols for supported protocols.
131 icmp-block
133 Is an optional empty-element tag and can be used several times to have
134 more than one icmp-block entry. Each icmp-block tag has exactly one
135 mandatory attribute:
136 name="string"
138 The name of the Internet Control Message Protocol (ICMP) type to be
139 blocked. To get a list of valid ICMP types firewall-cmd
140 --get-icmptypes can be used.
141 tcp-mss-clamp
143 Is an optional empty-element tag and can be used several times. If left
144 empty maximum segment size is set to 'pmtu'. This tag has exactly one
145 optional attribute:
146 value="string"
148 Value can set maximum segment size to 'pmtu' (Path Maximum
149 Transmission Unit) or a user-defined value that is greater than or
150 equal to 536.
151 masquerade
153 Is an optional empty-element tag. It can be used only once. If it's
154 present masquerading is enabled.
155 forward-port
157 Is an optional empty-element tag and can be used several times to have
158 more than one port or packet forward entry. There are mandatory and
159 also optional attributes for forward ports:
160 Mandatory attributes:
162 The local port and protocol to be forwarded.
163 port="portid[-portid]"
165 The port can either be a single port number portid or a port
166 range portid-portid.
167 protocol="tcp|udp|sctp|dccp"
169 The protocol can either be tcp, udp, sctp or dccp.
170 Optional attributes:
172 The destination of the forward. For local forwarding add to-port
173 only. For remote forwarding add to-addr and use to-port optionally
174 if the destination port on the destination machine should be
175 different.
176 to-port="portid[-portid]"
178 The destination port or port range to forward to. If omitted,
179 the value of the port= attribute will be used altogether with
180 the to-addr attribute.
181 to-addr="address"
183 The destination IP address either for IPv4 or IPv6.
184 source-port
186 Is an optional empty-element tag and can be used several times to have
187 more than one source port entry. All attributes of a source port entry
188 are mandatory:
189 port="portid[-portid]"
191 The port can either be a single port number portid or a port range
192 portid-portid.
193 protocol="tcp|udp|sctp|dccp"
195 The protocol can either be tcp, udp, sctp or dccp.
196 rule
198 Is an optional element tag and can be used several times to have more
199 than one rich language rule entry.
200 The general rule structure:
202 <rule [family="ipv4|ipv6"] [priority="priority"]>
204 [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]
205 [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ]
206 [
207 <service name="string"/> |
208 <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
209 <protocol value="protocol"/> |
210 <icmp-block name="icmptype"/> |
211 <icmp-type name="icmptype"/> |
212 <masquerade/> |
213 <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/> |
214 <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
215 ]
216 [
217 <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
218 <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
219 ]
220 [ <audit> [<limit value="rate/duration"/>] </audit> ]
221 [
222 <accept> [<limit value="rate/duration"/>] </accept> |
223 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
224 <drop> [<limit value="rate/duration"/>] </drop> |
225 <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
226 ]
227 </rule>
228 Rule structure for source black or white listing:
231 <rule [family="ipv4|ipv6"] [priority="priority"]>
233 <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/>
234 [
235 <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
236 <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
237 ]
238 [ <audit> [<limit value="rate/duration"/>] </audit> ]
239 <accept> [<limit value="rate/duration"/>] </accept> |
240 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
241 <drop> [<limit value="rate/duration"/>] </drop>
242 </rule>
243 For a full description on rich language rules, please have a look at
246 firewalld.richlanguage(5).
247
249 firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1),
250 firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5),
251 firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-
252 offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5),
253 firewalld.zone(5), firewalld.zones(5), firewalld.policy(5),
254 firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5)
255
257 firewalld home page:
258 http://firewalld.org
259 More documentation with examples:
261 http://fedoraproject.org/wiki/FirewallD
262
264 Thomas Woerner <twoerner@redhat.com>
265 Developer
266 Jiri Popelka <jpopelka@redhat.com>
268 Developer
269 Eric Garver <eric@garver.life>
271 Developer
272firewalld 1.2.3 FIREWALLD.POLICY(5)