1FIREWALLD.SERVICE(5)           firewalld.service          FIREWALLD.SERVICE(5)
2
3
4

NAME

6       firewalld.service - firewalld service configuration files
7

SYNOPSIS

9       /etc/firewalld/services/service.xml
10       /usr/lib/firewalld/services/service.xml
11
12
13

DESCRIPTION

15       A firewalld service configuration file provides the information of a
16       service entry for firewalld. The most important configuration options
17       are ports, modules and destination addresses.
18
19       This example configuration file shows the structure of a service
20       configuration file:
21
22           <?xml version="1.0" encoding="utf-8"?>
23           <service>
24             <short>My Service</short>
25             <description>description</description>
26             <port port="137" protocol="tcp"/>
27             <protocol value="igmp"/>
28             <module name="nf_conntrack_netbios_ns"/>
29             <destination ipv4="224.0.0.251" ipv6="ff02::fb"/>
30             <include service="ssdp"/>
31             <helper name="ftp"/>
32           </service>
33
34
35

OPTIONS

37       The config can contain these tags and attributes. Some of them are
38       mandatory, others optional.
39
40   service
41       The mandatory service start and end tag defines the service. This tag
42       can only be used once in a service configuration file. There are
43       optional attributes for services:
44
45       version="string"
46           To give the service a version.
47
48   short
49       Is an optional start and end tag and is used to give an service a more
50       readable name.
51
52   description
53       Is an optional start and end tag to have a description for a service.
54
55   port
56       Is an optional empty-element tag and can be used several times to have
57       more than one port entry. All attributes of a port entry are mandatory:
58
59       port="string"
60           The port string can be a single port number or a port range
61           portid-portid or also empty to match a protocol only.
62
63       protocol="string"
64           The protocol value can either be tcp, udp, sctp or dccp.
65
66       For compatibility with older firewalld versions, it is possible to add
67       protocols with the port option where the port is empty. With the
68       addition of native protocol support in the service, this it not needed
69       anymore. These entries will automatically be converted to protocols.
70       With the next modification of the service file, the enries will be
71       listed as protocols.
72
73   protocol
74       Is an optional empty-element tag and can be used several times to have
75       more than one protocol entry. A protocol entry has exactly one
76       attribute:
77
78       value="string"
79           The protocol can be any protocol supported by the system. Please
80           have a look at /etc/protocols for supported protocols.
81
82   source-port
83       Is an optional empty-element tag and can be used several times to have
84       more than one source port entry. All attributes of a source port entry
85       are mandatory:
86
87       port="string"
88           The port string can be a single port number or a port range
89           portid-portid.
90
91       protocol="string"
92           The protocol value can either be tcp, udp, sctp or dccp.
93
94   module
95       This element is deprecated. Please use helper described below in the
96       section called “helper”.
97
98   destination
99       Is an optional empty-element tag and can be used only once. The
100       destination specifies the destination network as a network IP address
101       (optional with /mask), or a plain IP address. The use of hostnames is
102       not recommended, because these will only be resolved at service
103       activation and transmitted to the kernel. For more information in this
104       element, please have a look at --destination in iptables(8) and
105       ip6tables(8).
106
107       ipv4="address[/mask]"
108           The IPv4 destination address with optional mask.
109
110       ipv6="address[/mask]"
111           The IPv6 destination address with optional mask.
112
113   include
114       Is an optional empty-element tag and can be used several times to have
115       more than one include entry. An include entry has exactly one
116       attribute:
117
118       service="string"
119           The include can be any service supported by firewalld.
120
121           Warning:Firewalld will only check that the included service is a
122           valid service if it's applied to a zone.
123
124   helper
125       Is an optional empty-element tag and can be used several times to have
126       more than one helper entry. An helper entry has exactly one attribute:
127
128       name="string"
129           The helper can be any helper supported by firewalld.
130

SEE ALSO

132       firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1),
133       firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5),
134       firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-
135       offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5),
136       firewalld.zone(5), firewalld.zones(5), firewalld.policy(5),
137       firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5)
138

NOTES

140       firewalld home page:
141           http://firewalld.org
142
143       More documentation with examples:
144           http://fedoraproject.org/wiki/FirewallD
145

AUTHORS

147       Thomas Woerner <twoerner@redhat.com>
148           Developer
149
150       Jiri Popelka <jpopelka@redhat.com>
151           Developer
152
153       Eric Garver <eric@garver.life>
154           Developer
155
156
157
158firewalld 1.3.4                                           FIREWALLD.SERVICE(5)
Impressum