1FIREWALLD.POLICY(5) firewalld.policy FIREWALLD.POLICY(5)
2
6 firewalld.policy - firewalld policy configuration files
7
9 /etc/firewalld/policies/policy.xml
10 /usr/lib/firewalld/policies/policy.xml
12
14 A firewalld policy configuration file contains the information for a
15 policy. These are the policy descriptions, services, ports, protocols,
16 icmp-blocks, masquerade, forward-ports and rich language rules in an
17 XML file format. The file name has to be policy_name.xml where length
18 of policy_name is currently limited to 17 chars.
19 This is the structure of a policy configuration file:
21 <?xml version="1.0" encoding="utf-8"?>
23 <policy [version="versionstring"] [target="CONTINUE|ACCEPT|REJECT|DROP"] [priority="priority"]>
24 [ <ingress-zone name="zone"/> ]
25 [ <egress-zone name="zone"/> ]
26 [ <short>short description</short> ]
32 [ <description>description</description> ]
33 [ <service name="string"/> ]
34 [ <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> ]
35 [ <protocol value="protocol"/> ]
36 [ <icmp-block name="string"/> ]
37 [ <masquerade/> ]
38 [ <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="IP address"]/> ]
39 [ <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> ]
40 [
41 <rule [family="ipv4|ipv6"] [priority="priority"]>
42 [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]
43 [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ]
44 [
45 <service name="string"/> |
46 <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
47 <protocol value="protocol"/> |
48 <icmp-block name="icmptype"/> |
49 <icmp-type name="icmptype"/> |
50 <masquerade/> |
51 <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/>
52 ]
53 [
54 <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
55 <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
56 ]
57 [ <audit> [<limit value="rate/duration"/>] </audit> ]
58 [
59 <accept> [<limit value="rate/duration"/>] </accept> |
60 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
61 <drop> [<limit value="rate/duration"/>] </drop> |
62 <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
63 ]
64 </rule>
65 ]
66 </policy>
69 The config can contain these tags and attributes. Some of them are
72 mandatory, others optional.
73 policy
75 The mandatory policy start and end tag defines the policy. This tag can
76 only be used once in a policy configuration file. There are optional
77 attributes for policy:
78 version="string"
80 To give the policy a version.
81 target="CONTINUE|ACCEPT|REJECT|DROP"
83 Can be used to accept, reject or drop every packet that doesn't
84 match any rule (port, service, etc.). The CONTINUE is the default
85 and used for policies that are non-terminal.
86 ingress-zone
88 An optional element that can be used several times. It can be the name
89 of a firewalld zone or one of the symbolic zones: HOST, ANY. See
90 firewalld.policies(5) for information about symbolic zones.
91 egress-zone
93 An optional element that can be used several times. It can be the name
94 of a firewalld zone or one of the symbolic zones: HOST, ANY. See
95 firewalld.policies(5) for information about symbolic zones.
96 short
98 Is an optional start and end tag and is used to give a more readable
99 name.
100 description
102 Is an optional start and end tag to have a description.
103 service
105 Is an optional empty-element tag and can be used several times to have
106 more than one service entry enabled. A service entry has exactly one
107 attribute:
108 name="string"
110 The name of the service to be enabled. To get a list of valid
111 service names firewall-cmd --get-services can be used.
112 port
114 Is an optional empty-element tag and can be used several times to have
115 more than one port entry. All attributes of a port entry are mandatory:
116 port="portid[-portid]"
118 The port can either be a single port number portid or a port range
119 portid-portid.
120 protocol="tcp|udp|sctp|dccp"
122 The protocol can either be tcp, udp, sctp or dccp.
123 protocol
125 Is an optional empty-element tag and can be used several times to have
126 more than one protocol entry. All protocol has exactly one attribute:
127 value="string"
129 The protocol can be any protocol supported by the system. Please
130 have a look at /etc/protocols for supported protocols.
131 icmp-block
133 Is an optional empty-element tag and can be used several times to have
134 more than one icmp-block entry. Each icmp-block tag has exactly one
135 mandatory attribute:
136 name="string"
138 The name of the Internet Control Message Protocol (ICMP) type to be
139 blocked. To get a list of valid ICMP types firewall-cmd
140 --get-icmptypes can be used.
141 masquerade
143 Is an optional empty-element tag. It can be used only once. If it's
144 present masquerading is enabled.
145 forward-port
147 Is an optional empty-element tag and can be used several times to have
148 more than one port or packet forward entry. There are mandatory and
149 also optional attributes for forward ports:
150 Mandatory attributes:
152 The local port and protocol to be forwarded.
153 port="portid[-portid]"
155 The port can either be a single port number portid or a port
156 range portid-portid.
157 protocol="tcp|udp|sctp|dccp"
159 The protocol can either be tcp, udp, sctp or dccp.
160 Optional attributes:
162 The destination of the forward. For local forwarding add to-port
163 only. For remote forwarding add to-addr and use to-port optionally
164 if the destination port on the destination machine should be
165 different.
166 to-port="portid[-portid]"
168 The destination port or port range to forward to. If omitted,
169 the value of the port= attribute will be used altogether with
170 the to-addr attribute.
171 to-addr="address"
173 The destination IP address either for IPv4 or IPv6.
174 source-port
176 Is an optional empty-element tag and can be used several times to have
177 more than one source port entry. All attributes of a source port entry
178 are mandatory:
179 port="portid[-portid]"
181 The port can either be a single port number portid or a port range
182 portid-portid.
183 protocol="tcp|udp|sctp|dccp"
185 The protocol can either be tcp, udp, sctp or dccp.
186 rule
188 Is an optional element tag and can be used several times to have more
189 than one rich language rule entry.
190 The general rule structure:
192 <rule [family="ipv4|ipv6"] [priority="priority"]>
194 [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]
195 [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ]
196 [
197 <service name="string"/> |
198 <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
199 <protocol value="protocol"/> |
200 <icmp-block name="icmptype"/> |
201 <icmp-type name="icmptype"/> |
202 <masquerade/> |
203 <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/> |
204 <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
205 ]
206 [
207 <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
208 <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
209 ]
210 [ <audit> [<limit value="rate/duration"/>] </audit> ]
211 [
212 <accept> [<limit value="rate/duration"/>] </accept> |
213 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
214 <drop> [<limit value="rate/duration"/>] </drop> |
215 <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
216 ]
217 </rule>
218 Rule structure for source black or white listing:
221 <rule [family="ipv4|ipv6"] [priority="priority"]>
223 <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/>
224 [
225 <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
226 <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
227 ]
228 [ <audit> [<limit value="rate/duration"/>] </audit> ]
229 <accept> [<limit value="rate/duration"/>] </accept> |
230 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
231 <drop> [<limit value="rate/duration"/>] </drop>
232 </rule>
233 For a full description on rich language rules, please have a look at
236 firewalld.richlanguage(5).
237
239 firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1),
240 firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5),
241 firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-
242 offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5),
243 firewalld.zone(5), firewalld.zones(5), firewalld.policy(5),
244 firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5)
245
247 firewalld home page:
248 http://firewalld.org
249 More documentation with examples:
251 http://fedoraproject.org/wiki/FirewallD
252
254 Thomas Woerner <twoerner@redhat.com>
255 Developer
256 Jiri Popelka <jpopelka@redhat.com>
258 Developer
259 Eric Garver <eric@garver.life>
261 Developer
262firewalld 1.3.4 FIREWALLD.POLICY(5)