FIREWALL-CMD(1)

📦

version 2.5.2 · 12 versions

2.5.2 · arch rolling, nixpkgs unstable, ubuntu stonking (latest)
2.1.2 · opensuse-leap 16.0
1.3.4 · centos-stream 9
2.4.3 · centos-stream 10, nixos 26.05
2.4.1 · alpine 3.24
2.3.2 · fedora 43
1.1.1 · ubuntu jammy
2.4.4 · fedora 44
2.4.0 · fedora 44
1.3.3 · debian bookworm
2.1.1 · ubuntu noble
2.3.1 · debian trixie, fedora 43, ubuntu questing, ubuntu resolute

, in arch rolling, nixpkgs unstable, ubuntu stonking

💖 FIREWALL-CMD(1) — the `firewall-cmd` era 💖

okay bestie, welcome to firewall-cmd(1), aka the manual page for the firewalld command line client. pull up a chair, grab a strawberry 🍓, and let's get into it.

✨ NAME ✨

firewall-cmd — firewalld command line client

🌸 SYNOPSIS 🌸

firewall-cmd [OPTIONS...]

🦋 DESCRIPTION 🦋

So. firewall-cmd is the command line client of the firewalld daemon. She's basically the interface that lets you manage your runtime configuration and your permanent configuration. Two worlds, one icon. 👑

And here's the thing you have to internalize, fr fr: in firewalld, the runtime configuration is separated from the permanent configuration. What does that mean for you? It means things can get changed in the runtime configuration or in the permanent configuration. Separate places, separate vibes, and you get to pick which one you're messing with.

💅 OPTIONS 💅

First, let's talk about sequence options, because this is one of those things that's giving "important and also easy to misunderstand."

Sequence options are the ones you can specify multiple times. The exit code is 0 if there's at least one item that succeeded. And listen — the ALREADY_ENABLED (11), NOT_ENABLED (12) and also ZONE_ALREADY_SET (16) errors are treated as succeeded. Yes, really. They're not the enemy.

If there are issues while parsing the items, those get treated as warnings and they will not change the result, as long as there's one that succeeded. But if there's no succeeded item at all, then the exit code depends on the error codes:

If there's exactly one error code, that one gets used.
If there's more than one, then UNKNOWN_ERROR (254) gets used.

The following options are supported, and yes, we're doing all of them, no skips, no cap 👇

🔧 General Options

-h, --help — prints a short help text and then dips. help text says bye, exits.
-V, --version — prints the version string of firewalld. heads up bestie: this option is not combinable with other options. she's a solo act.
-q, --quiet — do not print status messages. silence is golden, periodt.

🩺 Status Options

--state — check whether the firewalld daemon is active (i.e. running). Returns an exit code 0 if it is active, RUNNING_BUT_FAILED if failure occurred on startup, NOT_RUNNING otherwise. See the section called “EXIT CODES”. It will also print the state to STDOUT. double duty, we love that.
--reload — reload firewall rules and keep state information. The current permanent configuration will become the new runtime configuration. iykyk: all runtime-only changes you made up until reload are lost with reload if they have not also been in the permanent configuration. 😭 that's just how she is.

Note: If FlushAllOnReload=no, runtime changes applied via the direct interface are not affected and will therefore stay in place until the firewalld daemon is restarted completely. For FlushAllOnReload, see firewalld.conf(5).

--complete-reload — reload firewall completely, even netfilter kernel modules. This will most likely terminate active connections, because state information is lost. This option should only be used in case of severe firewall problems. For example if there are state information problems that no connection can be established with correct firewall rules. it's giving "nuclear option, use with respect" 💀

Note: If FlushAllOnReload=no, runtime changes applied via the direct interface are not affected and will therefore stay in place until the firewalld daemon is restarted completely. For FlushAllOnReload, see firewalld.conf(5).

--runtime-to-permanent — save the active runtime configuration and overwrite the permanent configuration with it. The way this is supposed to work is that when you're configuring firewalld you do runtime changes only, and once you're happy with the configuration and you tested that it works the way you want, you save the configuration to disk. this is the "test drive first, commit later" pipeline and honestly? main character energy. ✨
--check-config — run checks on the permanent configuration. This includes XML validity and semantics. vibe check for your config files, literally.
--reset-to-defaults — reset configuration to firewalld's default configuration. factory reset moment.

🙈 Log Denied Options

--get-log-denied — print the log denied setting.
--set-log-denied=value — add logging rules right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules, and also final reject and drop rules in zones for the configured link-layer packet type. The possible values are: all, unicast, broadcast, multicast and off. The default setting is off, which disables the logging.

This is a runtime and permanent change and will also reload the firewall to be able to add the logging rules. two things at once, she's efficient.

👑 Permanent Options

--permanent — the permanent option --permanent can be used to set options permanently. These changes are not effective immediately — only after service restart/reload or system reboot. Without the --permanent option, a change will only be part of the runtime configuration.

If you want to make a change in runtime and permanent configuration, use the same call with and without the --permanent option. yep, twice. that's the move.

The --permanent option can be optionally added to all options further down where it is supported.

🌈 Zone Options

--get-default-zone — print default zone for connections and interfaces.
--set-default-zone=zone — set default zone for connections and interfaces where no zone has been selected. Setting the default zone changes the zone for the connections or interfaces that are using the default zone.

This is a runtime and permanent change.

--get-active-zones — print currently active zones altogether with interfaces and sources used in these zones. Active zones are zones that have a binding to an interface or source. The output format is:

zone1
  interfaces: interface1 interface2 ..
  sources: source1 ..
zone2
  interfaces: interface3 ..
zone3
  sources: source2 ..

If there are no interfaces or sources bound to the zone, the corresponding line will be omitted. no empty filler, she's tidy. 🎀

[--permanent] --get-zones — print predefined zones as a space separated list.
[--permanent] --get-services — print predefined services as a space separated list.
[--permanent] --get-icmptypes — print predefined icmptypes as a space separated list.
[--permanent] --get-zone-of-interface=interface — print the name of the zone the interface is bound to, or no zone.
[--permanent] --get-zone-of-source=source[/mask]|MAC|ipset:ipset — print the name of the zone the source is bound to, or no zone.
[--permanent] --info-zone=zone — print information about the zone zone. The output format is:

zone
  interfaces: interface1 ..
  sources: source1 ..
  services: service1 ..
  ports: port1 ..
  protocols: protocol1 ..
  forward-ports:
        forward-port1
        ..
  source-ports: source-port1 ..
  icmp-blocks: icmp-type1 ..
  rich rules:
        rich-rule1
        ..

[--permanent] --list-all-zones — list everything added for or enabled in all zones. The output format is:

zone1
  interfaces: interface1 ..
  sources: source1 ..
  services: service1 ..
  ports: port1 ..
  protocols: protocol1 ..
  forward-ports:
        forward-port1
        ..
  icmp-blocks: icmp-type1 ..
  rich rules:
        rich-rule1
        ..
..

--permanent --new-zone=zone — add a new permanent and empty zone.

Zone names must be alphanumeric and may additionally include characters: '_' and '-'.

--permanent --new-zone-from-file=filename [--name=zone] — add a new permanent zone from a prepared zone file, with an optional name override.
--permanent --delete-zone=zone — delete an existing permanent zone. bye bestie 🫶
--permanent --load-zone-defaults=zone — load zone default settings or report NO_DEFAULTS error.
--permanent --path-zone=zone — print path of the zone configuration file.

🧚 Policy Options

[--permanent] --get-policies — print predefined policies as a space separated list.
[--permanent] --info-policy=policy — print information about the policy policy.
[--permanent] --list-all-policies — list everything added for or enabled in all policies.
--permanent --new-policy=policy — add a new permanent policy.

Policy names must be alphanumeric and may additionally include characters: '_' and '-'.

--permanent --new-policy-from-file=filename [--name=policy] — add a new permanent policy from a prepared policy file, with an optional name override.
--permanent --path-policy=policy — print path of the policy configuration file.
--permanent --delete-policy=policy — delete an existing permanent policy.
--permanent --load-policy-defaults=policy — load the shipped defaults for a policy. Only applies to policies shipped with firewalld. Does not apply to user defined policies. read that again, it matters. 📌

🎀 Options to Adapt and Query Zones and Policies

Ok so this next group is a little different — options in this section affect only one particular zone or policy. If used with the --zone=zone or --policy=policy option, they affect the specified zone or policy. If both options are omitted, they affect the default zone (see --get-default-zone).

[--permanent] [--zone=zone] [--policy=policy] --list-all — list everything added or enabled.
--permanent [--zone=zone] [--policy=policy] --get-target — get the target.
--permanent [--zone=zone] [--policy=policy] --set-target=target — set the target.

For zones, target is one of: default, ACCEPT, DROP, REJECT

For policies, target is one of: CONTINUE, ACCEPT, DROP, REJECT

default is similar to REJECT, but it implicitly allows ICMP packets.

ACCEPT allows traffic to be forwarded from the zone, either to the same zone or other zones.

--permanent [--zone=zone] [--policy=policy] --set-description=description — set description.
--permanent [--zone=zone] [--policy=policy] --get-description — print description.
--permanent [--zone=zone] [--policy=policy] --set-short=description — set short description.
--permanent [--zone=zone] [--policy=policy] --get-short — print short description.
[--permanent] [--zone=zone] [--policy=policy] --list-services — list services added as a space separated list.
[--permanent] [--zone=zone] [--policy=policy] --add-service=service [--timeout=timeval] — add a service. This option can be specified multiple times (sequence option representation 💅). If a timeout is supplied, the rule will be active for the specified amount of time and will be removed automatically afterwards. timeval is either a number (of seconds) or a number followed by one of the characters s (seconds), m (minutes), h (hours), for example 20m or 1h.

The service is one of the firewalld provided services. To get a list of the supported services, use firewall-cmd --get-services.

The --timeout option is not combinable with the --permanent option. pick a lane, bestie. 🚫

okay quick note bestie — some services come with connection tracking helpers. And the ones that can operate in client mode (looking at you, tftp 💅) have to be added to an outbound policy, not a zone, or they will literally never kick in for your clients. Like, the helper just won't apply to the outbound traffic. The related traffic — the stuff the connection tracking helper defines on the return path (ingress) — that part gets allowed by the stateful firewall rules, so you're covered there. 🫶

Here's what an outbound policy for connection tracking helpers looks like:

# firewall-cmd --permanent --new-policy clientConntrack
# firewall-cmd --permanent --policy clientConntrack --add-ingress-zone HOST
# firewall-cmd --permanent --policy clientConntrack --add-egress-zone ANY
# firewall-cmd --permanent --policy clientConntrack --add-service tftp

[--permanent] [--zone=zone] [--policy=policy] --remove-service=service — takes a service out. You can say this option more than once, no cap.
[--permanent] [--zone=zone] [--policy=policy] --query-service=service — asks the universe "is this service in here or not?" Returns 0 if yeah, 1 if nope.
[--permanent] [--zone=zone] [--policy=policy] --list-ports — spills out every port you've added as a space-separated list. A port looks like portid[-portid]/protocol — so it's either a port-and-protocol pair, or a whole port range with a protocol attached. Cute and simple. ✨
[--permanent] [--zone=zone] [--policy=policy] --add-port=portid[-portid]/protocol [--timeout=timeval] — adds a port. Say it multiple times if you want, go off. And if you hand it a timeout, the rule stays live for exactly that long and then dips out automatically. timeval is either just a plain number (seconds, boo boring) or a number with one of these letters: s (seconds), m (minutes), h (hours) — like 20m or 1h. 🕐

The port is either one single port number, or a range written portid-portid. The protocol is one of tcp, udp, sctp or dccp.

🚨 heads up: --timeout and --permanent cannot be combined. Pick a lane.

[--permanent] [--zone=zone] [--policy=policy] --remove-port=portid[-portid]/protocol — bye bye port. Multiple times? Totally allowed.
[--permanent] [--zone=zone] [--policy=policy] --query-port=portid[-portid]/protocol — returns whether that port got added. 0 = true, 1 = otherwise.
[--permanent] [--zone=zone] [--policy=policy] --list-protocols — shows every protocol you've added, space-separated, all lined up pretty. 🌸
[--permanent] [--zone=zone] [--policy=policy] --add-protocol=protocol [--timeout=timeval] — adds a protocol. Stack it as many times as you need. If a timeout is supplied, the rule is active for that amount of time and then removes itself, dramatic exit. timeval is a number (seconds) or a number followed by one of s (seconds), m (minutes), h (hours) — 20m, 1h, you know the drill.

Your protocol can be literally any protocol the system supports. Go peek at /etc/protocols for the roster. 📋

And again: --timeout is not combinable with --permanent.

[--permanent] [--zone=zone] [--policy=policy] --remove-protocol=protocol — removes a protocol. Repeatable, of course.
[--permanent] [--zone=zone] [--policy=policy] --query-protocol=protocol — did the protocol get added? 0 if yes, 1 if no.
[--permanent] [--zone=zone] [--policy=policy] --list-source-ports — lists the source ports you added, space-separated. Port format is portid[-portid]/protocol. Slay. 💅
[--permanent] [--zone=zone] [--policy=policy] --add-source-port=portid[-portid]/protocol [--timeout=timeval] — adds a source port. Specify it multiple times if your heart desires. With a timeout, the rule lives for that long and then auto-dips. timeval = a number (seconds), or a number plus one of s (seconds), m (minutes), h (hours), e.g. 20m or 1h.

Port: single port number or a range portid-portid. Protocol: tcp, udp, sctp or dccp.

One more time for the people in the back: --timeout is not combinable with --permanent. 🙈

[--permanent] [--zone=zone] [--policy=policy] --remove-source-port=portid[-portid]/protocol — removes the source port. Yeah, you can run it multiple times.
[--permanent] [--zone=zone] [--policy=policy] --query-source-port=portid[-portid]/protocol — returns whether the source port has been added. 0 = true, 1 = otherwise.
[--permanent] [--zone=zone] [--policy=policy] --list-icmp-blocks — lists all the Internet Control Message Protocol (ICMP) type blocks that have been added, as one space-separated list. 🦋
[--permanent] [--zone=zone] [--policy=policy] --add-icmp-block=icmptype [--timeout=timeval] — adds an ICMP block for icmptype. Specify it multiple times, iconic. With a timeout supplied, the rule is active for that stretch and then removes itself automatically. timeval is a number (seconds) or a number followed by one of s (seconds), m (minutes), h (hours) — 20m, 1h, whatever.

The icmptype is one of the ICMP types firewalld supports. Want the full list of supported ICMP types? Run firewall-cmd --get-icmptypes and ✨ behold ✨.

Also (say it with me): --timeout is not combinable with --permanent.

[--permanent] [--zone=zone] [--policy=policy] --remove-icmp-block=icmptype — removes the ICMP block for icmptype. Multiple times, sure.
[--permanent] [--zone=zone] [--policy=policy] --query-icmp-block=icmptype — returns whether an ICMP block for icmptype has been added. 0 if true, 1 otherwise.
[--permanent] [--zone=zone] [--policy=policy] --list-forward-ports — lists IPv4 forward ports, space-separated. 🎀

For IPv6 forward ports? Bestie, go use the rich language.

[--permanent] [--zone=zone] [--policy=policy] --add-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] [--timeout=timeval] — adds the IPv4 forward port. Can be specified multiple times. With a timeout, the rule stays active for the specified amount of time and is then removed automatically. timeval is a number (seconds) or a number followed by one of s (seconds), m (minutes), h (hours) — for example 20m or 1h.

The port is a single port number portid or a port range portid-portid. The protocol is tcp, udp, sctp or dccp. The destination address is a simple IP address.

--timeout is not combinable with --permanent. 🚫

For IPv6 forward ports, please use the rich language.

Note: IP forwarding will be implicitly enabled if toaddr is specified. Not a suggestion, it just happens.

Note: When this option is used with --policy, the firewall backend cannot determine the egress zone. See section UNKNOWN DESTINATIONS for the whole saga. 💀

[--permanent] [--zone=zone] [--policy=policy] --remove-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] — removes the IPv4 forward port. Specify it multiple times, no problem.

IPv6 forward ports: rich language, bestie. That's the way.

[--permanent] [--zone=zone] [--policy=policy] --query-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] — returns whether that IPv4 forward port has been added. 0 if true, 1 otherwise.

(IPv6 forward ports → rich language. You know the vibe by now. 🌈)

[--permanent] [--zone=zone] [--policy=policy] --add-masquerade [--timeout=timeval] — turns on IPv4 masquerade. If you supply a timeout, masquerading stays active for that amount of time. timeval is a number (seconds) or a number followed by one of s (seconds), m (minutes), h (hours), e.g. 20m or 1h. Masquerading is the move when your machine is a router and machines hooked up over an interface in another zone should be able to use that first connection. Main character routing energy, honestly. 👑

--timeout is not combinable with --permanent.

For IPv6 masquerading, please use the rich language.

Note: IP forwarding gets implicitly enabled. Automatically. Surprise.

Note (Linux < 5.5): with the iptables backend, a policy may not enable masquerade if an ingress zone has assigned interfaces. The nftables backend doesn't have that restriction, but it does need Linux v5.5+ to actually function properly — otherwise it will silently fail. Silent. Failure. The worst kind. 😭

[--permanent] [--zone=zone] [--policy=policy] --remove-masquerade — turns IPv4 masquerade off. And if masquerading had been enabled with a timeout, this disables it too.

For IPv6 masquerading, please use the rich language.

[--permanent] [--zone=zone] [--policy=policy] --query-masquerade — returns whether IPv4 masquerading has been enabled. 0 = true, 1 = otherwise.

For IPv6 masquerading, please use the rich language.

[--permanent] [--zone=zone] [--policy=policy] --list-rich-rules — lists the rich language rules you've added, one per line (newline-separated). 🧚
[--permanent] [--zone=zone] [--policy=policy] --add-rich-rule='rule' [--timeout=timeval] — adds the rich language rule 'rule'. This option can be specified multiple times. Supply a timeout and the rule will be active for that amount of time before it removes itself automatically. timeval is a number (seconds) or a number followed by one of s (seconds), m (minutes), h (hours) — 20m or 1h, take your pick.

For the rich language rule syntax, go read firewalld.richlanguage(5).

And yes — --timeout is not combinable with --permanent. 💖

[--permanent] [--zone=zone] [--policy=policy] --remove-rich-rule='rule' — removes the rich language rule 'rule'. Can be specified multiple times.

For the rich language rule syntax, hit up firewalld.richlanguage(5).

[--permanent] [--zone=zone] [--policy=policy] --query-rich-rule='rule' — returns whether a rich language rule 'rule' has been added. 0 if true, 1 otherwise.

For the rich language rule syntax, please have a look at firewalld.richlanguage(5).

⭐ Options to Adapt and Query Zones ⭐

Okay so everything in this lil section only touches one particular zone. Use it with the --zone=zone option and it affects that specified zone. Leave the option out and it hits the default zone instead (go check --get-default-zone if you forgot which one that is 💜).

[--permanent] [--zone=zone] --add-icmp-block-inversion — enables ICMP block inversion.
[--permanent] [--zone=zone] --remove-icmp-block-inversion — ok so turn ICMP block inversion OFF bestie, it's giving "let the pings through" energy 💫
[--permanent] [--zone=zone] --query-icmp-block-inversion — asks the universe "is ICMP block inversion on?" and reports back. Returns 0 if true, 1 otherwise. no cap 🫶
[--permanent] [--zone=zone] --add-forward — switch on intra zone forwarding, slay ✨
[--permanent] [--zone=zone] --remove-forward — switch off intra zone forwarding, bye bestie 💅
[--permanent] [--zone=zone] --query-forward — is intra zone forwarding enabled?? Returns 0 if true, 1 otherwise 🌸
--permanent [--zone=zone] --get-priority — grab the priority of the zone, pulling up 🌟
--permanent [--zone=zone] --set-priority — set the zone's priority for packet classification. this sets BOTH the ingress and the egress priority at once, two birds one stone fr fr 🐦
--permanent [--zone=zone] --get-ingress-priority — get the ingress priority of the zone 👑
--permanent [--zone=zone] --set-ingress-priority — set the zone's ingress priority for packet classification 🎀
--permanent [--zone=zone] --get-egress-priority — get the egress priority of the zone 🦋
--permanent [--zone=zone] --set-egress-priority — set the zone's egress priority for packet classification 💖

💅 Options to Adapt and Query Policies 💅

okay so these options are like, super into ONE particular policy only. you literally HAVE to pass --policy=policy with them or it's not gonna work. it's giving "commitment issues but make it firewalld" 😭

--permanent --policy=policy --get-priority — get the priority, periodt 🌟
--permanent --policy=policy --set-priority=priority — set the priority. this priority thing decides the relative ordering of policies, it's the vibe check for who goes first. it's an integer value between -32768 and 32767 where -1 is the default value for new policies and 0 is reserved for internal use. lowkey important!! 🚨

if a priority is < 0, then the policy's rules will execute before all rules in all zones. it's jumping the line bestie 💨

if a priority is > 0, then the policy's rules will execute after all rules in all zones. fashionably late 💅

[--permanent] --policy=policy --list-ingress-zones — list ingress zones that were added, as a space separated list 🌸
[--permanent] --policy=policy --add-ingress-zone=zone — add an ingress zone. you can specify this option multiple times, go off 🔥

the ingress zone is one of the firewalld provided zones OR one of the pseudo-zones: HOST, ANY.

HOST is used for traffic originating from the host machine, i.e. the host running firewalld.

ANY is used for traffic originating from any zone. think of it like a wild card for zones. BUT it does not include traffic originating from the host machine — use HOST for that. this distinction is so real, iykyk 😌

[--permanent] --policy=policy --remove-ingress-zone=zone — remove an ingress zone. also can be specified multiple times 🎀
[--permanent] --policy=policy --query-ingress-zone=zone — return whether the zone has been added. Returns 0 if true, 1 otherwise 🫶
[--permanent] --policy=policy --list-egress-zones — list egress zones added, as a space separated list ✨
[--permanent] --policy=policy --add-egress-zone=zone — add an egress zone. can be specified multiple times, no cap 💫

the egress zone is one of the firewalld provided zones OR one of the pseudo-zones: HOST, ANY.

for clarification on HOST and ANY see option --add-ingress-zone. (spoiler: it's up there ⬆️)

[--permanent] --policy=policy --remove-egress-zone=zone — remove an egress zone. yep, can be specified multiple times 🌈
[--permanent] --policy=policy --query-egress-zone=zone — return whether the zone has been added. Returns 0 if true, 1 otherwise. slay 💅
[--permanent] --policy=policy|--policy-set=policy-set --add-disable — administratively disable a policy. a disabled policy will not activate. it's on do-not-disturb mode fr 😴
[--permanent] --policy=policy|--policy-set=policy-set --remove-disable — remove the administratively disable from a policy. lets a policy activate again, welcome back bestie 🥳
[--permanent] --policy=policy --query-disable — return if the policy is administratively disabled 🌸

🦋 Options to Handle Bindings of Interfaces 🦋

okay so binding an interface to a zone means the zone settings get used to restrict traffic via that interface. that's the whole vibe ✨

periodt, these options affect only ONE particular zone. if you use them with the --zone=zone option, they affect the zone zone. if you skip the option, they affect the default zone (see --get-default-zone).

for a list of predefined zones use firewall-cmd --get-zones.

an interface name is a string up to 16 characters long, and it may NOT contain ' ', '/', '!' and '*'. so no wild shenanigans bestie 🚫

[--permanent] [--zone=zone] --list-interfaces — list interfaces bound to zone zone, as a space separated list. if zone is omitted, default zone will be used 📋
[--permanent] [--zone=zone] --add-interface=interface — bind interface interface to zone zone. if zone is omitted, default zone will be used 💖

if the interface is under control of NetworkManager, it is at first connected to change the zone for the connection that is using the interface. if this fails, the zone binding is created in firewalld and the limitations below apply. for interfaces that are not under control of NetworkManager, firewalld tries to change the ZONE setting in the ifcfg file, if the file exists.

as an end user you don't need this in most cases, because NetworkManager (or legacy network service) adds interfaces into zones automatically (according to the ZONE= option from the ifcfg-interface file) if NM_CONTROLLED=no is not set. you should only do it if there's no /etc/sysconfig/network-scripts/ifcfg-interface file. if there IS such a file and you add interface to zone with this --add-interface option, make sure the zone is the same in both cases, otherwise the behavior would be undefined. 💀 please also have a look at the firewalld(1) man page in the Concepts section. for permanent association of interface with a zone, see also 'How to set or change a zone for a connection?' in firewalld.zones(5).

[--permanent] [--zone=zone] --change-interface=interface — if the interface is under control of NetworkManager, it is at first connected to change the zone for the connection that is using the interface. if this fails, the zone binding is created in firewalld and the limitations below apply. for interfaces that are not under control of NetworkManager, firewalld tries to change the ZONE setting in the ifcfg file, if the file exists.

change the zone that interface interface is bound to, to zone zone. it's basically --remove-interface followed by --add-interface, glow up moment ✨. if the interface has not been bound to a zone before, it behaves like --add-interface. if zone is omitted, default zone will be used.

[--permanent] [--zone=zone] --query-interface=interface — query whether interface interface is bound to zone zone. Returns 0 if true, 1 otherwise 🫶
[--permanent] --remove-interface=interface — if the interface is under control of NetworkManager, it is at first connected to change the zone for the connection that is using the interface. if this fails, the zone binding is created in firewalld and the limitations below apply.

for the addition or change of interfaces that are not under control of NetworkManager: firewalld tries to change the ZONE setting in the ifcfg file, if an ifcfg file exists that is using the interface.

only for the removal of interfaces that are not under control of NetworkManager: firewalld is NOT trying to change the ZONE setting in the ifcfg file. this is needed to make sure that an ifdown of the interface will not result in a reset of the zone setting to the default zone. only the zone binding is then removed in firewalld then.

removes the binding of interface interface from the zone it was previously added to. it's out girlie 👋

🌸 Options to Handle Bindings of Sources 🌸

binding a source to a zone means the zone settings will be used to restrict traffic from that source. that's the tea ☕

a source address or address range is either an IP address or a network IP address with a mask for IPv4 or IPv6 or a MAC address or an ipset with the ipset: prefix. for IPv4, the mask can be a network mask or a plain number. for IPv6 the mask is a plain number. the use of host names is not supported. soz, no cute domain names here 🙈

these options affect only ONE particular zone. if you use them with the --zone=zone option, they affect the zone zone. if the option is omitted, they affect the default zone (see --get-default-zone).

for a list of predefined zones use firewall-cmd [--permanent] --get-zones.

[--permanent] [--zone=zone] --list-sources — list sources bound to zone zone, as a space separated list. if zone is omitted, default zone will be used 👑
[--permanent] [--zone=zone] --add-source=source[/mask]|MAC|ipset:ipset — bind the source to zone zone. if zone is omitted, default zone will be used 💫
[--zone=zone] --change-source=source[/mask]|MAC|ipset:ipset — change the zone that the source is bound to, to zone zone. it's basically --remove-source followed by --add-source. if the source has not been bound to a zone before, it behaves like --add-source. if zone is omitted, default zone will be used ✨
[--permanent] [--zone=zone] --query-source=source[/mask]|MAC|ipset:ipset — query whether the source is bound to the zone zone. Returns 0 if true, 1 otherwise 🎀
[--permanent] --remove-source=source[/mask]|MAC|ipset:ipset — remove the binding of the source from the zone it was previously added to 🦋

🌈 IPSet Options 🌈

--get-ipset-types — print the supported ipset types, pulling up the menu 😌
--permanent --new-ipset=ipset --type=type [--family=inet|inet6] [--option=key[=value]] — add a new permanent and empty ipset, specifying the type and optionally the family and options like timeout, hashsize and maxelem. for more information please have a look at the ipset(8) man page 📖

ipset names must be alphanumeric and may additionally include characters: '_' and '-'. so cute but rules are rules 💅

--permanent --new-ipset-from-file=filename [--name=ipset] — add a new permanent ipset from a prepared ipset file, with an optional name override 🌟
--permanent --delete-ipset=ipset — delete an existing permanent ipset. bye bestie 😭
--permanent --load-ipset-defaults=ipset — load ipset default settings or report NO_DEFAULTS error 🚨
[--permanent] --info-ipset=ipset — print information about the ipset ipset. the output format is:

ipset
  type: type
  options: option1[=value1] ..
  entries: entry1 ..

[--permanent] --get-ipsets — print predefined ipsets as a space separated list 🔥
--permanent --ipset=ipset --set-description=description — set a new description to the ipset 📝
--permanent --ipset=ipset --get-description — print description for the ipset 🫶
--permanent --ipset=ipset --set-short=description — set short description to the ipset ✂️
--permanent --ipset=ipset --get-short — prints the short description for the ipset, bestie ✨
[--permanent] --ipset=ipset --add-entry=entry — drops a shiny new entry into the ipset 💖

Adding an entry to an ipset that has the timeout option is allowed, but heads up: firewalld does not track those entries. Not it being sneaky about it 🙈

[--permanent] --ipset=ipset --remove-entry=entry — yeets entry out of the ipset 🫶
[--permanent] --ipset=ipset --query-entry=entry — tells you whether entry has been added to the ipset. Returns 0 if true, 1 otherwise.

Careful bestie 😭 — querying an ipset that has a timeout will straight up error. Entries are not tracked for ipsets with a timeout. Periodt.

[--permanent] --ipset=ipset --get-entries — lists every entry in the ipset 🌈
[--permanent] --ipset=ipset --add-entries-from-file=filename — loads a whole batch of new entries into the ipset from a file. For every entry that's in the file but already in the ipset, you get a warning printed. She's just letting you know 💅

The file should have one entry per line. Lines starting with a hash or a semicolon are ignored. Empty lines too. Clean girl aesthetic ✨

[--permanent] --ipset=ipset --remove-entries-from-file=filename — removes existing entries from the ipset, using filename as the source. For every entry that's listed in the file but not in the ipset, a warning gets printed.

Same file rules, bestie: one entry per line, lines starting with a hash or semicolon ignored, empty lines ignored too 🌸

--permanent --path-ipset=ipset — prints the path of the ipset configuration file 📁

🎀 Service Options 🎀

Options in this section affect only one particular service. One service, one little universe 💖

[--permanent] --info-service=service — prints info about the service service. The output format is:

service
  ports: port1 ..
  protocols: protocol1 ..
  source-ports: source-port1 ..
  helpers: helper1 ..
  destination: ipv1:address1 ..

The following options are only usable in the permanent configuration. So lock in 🔒

--permanent --new-service=service — adds a brand new permanent and empty service. Blank canvas energy 🎨

Service names must be alphanumeric and may additionally include the characters '_' and '-'. No funny business ✋

--permanent --new-service-from-file=filename [--name=service] — adds a new permanent service from a prepared service file, with an optional name override. Slay, reuse the template 👑
--permanent --delete-service=service — deletes an existing permanent service. Gone, bye, no notes 💀
--permanent --load-service-defaults=service — loads service default settings, or reports a NO_DEFAULTS error. Sometimes the defaults just aren't there, and that's the vibe check 😭
--permanent --path-service=service — prints the path of the service configuration file 🗂️
--permanent --service=service --set-description=description — sets a new description on the service ✍️
--permanent --service=service --get-description — prints the description for the service 📖
--permanent --service=service --set-short=description — sets the short description on the service 🌸
--permanent --service=service --get-short — prints the short description for the service ✨
--permanent --service=service --add-port=portid[-portid]/protocol — adds a new port to the permanent service 🔥
--permanent --service=service --remove-port=portid[-portid]/protocol — removes a port from the permanent service 🫶
--permanent --service=service --query-port=portid[-portid]/protocol — returns whether that port has been added to the permanent service. Yes or no bestie 💅
--permanent --service=service --get-ports — lists the ports added to the permanent service 🌈
--permanent --service=service --add-protocol=protocol — adds a new protocol to the permanent service 👑
--permanent --service=service --remove-protocol=protocol — removes a protocol from the permanent service 💀
--permanent --service=service --query-protocol=protocol — returns whether that protocol has been added to the permanent service 🔍
--permanent --service=service --get-protocols — lists the protocols added to the permanent service ✨
--permanent --service=service --add-source-port=portid[-portid]/protocol — adds a new source port to the permanent service 💖
--permanent --service=service --remove-source-port=portid[-portid]/protocol — removes a source port from the permanent service 🎀
--permanent --service=service --query-source-port=portid[-portid]/protocol — returns whether that source port has been added to the permanent service 🔍
--permanent --service=service --get-source-ports — lists the source ports added to the permanent service 🌸
--permanent --service=service --add-helper=helper — adds a new helper to the permanent service 🧚
--permanent --service=service --remove-helper=helper — removes a helper from the permanent service 🫶
--permanent --service=service --query-helper=helper — returns whether that helper has been added to the permanent service 💅
--permanent --service=service --get-service-helpers — lists the helpers added to the permanent service ✨
--permanent --service=service --set-destination=ipv:address[/mask] — sets the destination for ipv to address[/mask] in the permanent service 🎯
--permanent --service=service --remove-destination=ipv — removes the destination for ipv from the permanent service 🗑️
--permanent --service=service --query-destination=ipv:address[/mask] — returns whether the destination ipv to address[/mask] has been set in the permanent service 🔍
--permanent --service=service --get-destinations — lists the destinations added to the permanent service 🌈
--permanent --service=service --add-include=service — adds a new include to the permanent service 💖
--permanent --service=service --remove-include=service — removes an include from the permanent service 🫶
--permanent --service=service --query-include=service — returns whether that include has been added to the permanent service 🔍
--permanent --service=service --get-includes — lists the includes added to the permanent service ✨

🦋 Helper Options 🦋

Options in this section affect only one particular helper. Just the one, she's the main character 💅

[--permanent] --info-helper=helper — prints info about the helper helper. The output format is:

helper
  family: family
  module: module
  ports: port1 ..

The following options are only usable in the permanent configuration. Permanent mode only, bestie 🔒

--permanent --new-helper=helper --module=nf_conntrack_module [--family=ipv4|ipv6] — adds a new permanent helper with module and optionally family defined. Build-a-helper workshop 🧸

Helper names must be alphanumeric and may additionally include the character '-'. That's it, that's the rule ✋

--permanent --new-helper-from-file=filename [--name=helper] — adds a new permanent helper from a prepared helper file, with an optional name override 👑
--permanent --delete-helper=helper — deletes an existing permanent helper 💀
--permanent --load-helper-defaults=helper — loads helper default settings, or reports a NO_DEFAULTS error 😭
--permanent --path-helper=helper — prints the path of the helper configuration file 🗂️
[--permanent] --get-helpers — prints the predefined helpers as a space separated list ✨
--permanent --helper=helper --set-description=description — sets a new description on the helper ✍️
--permanent --helper=helper --get-description — prints the description for the helper 📖
--permanent --helper=helper --set-short=description — sets the short description on the helper 🌸
--permanent --helper=helper --get-short — prints the short description for the helper ✨
--permanent --helper=helper --add-port=portid[-portid]/protocol — adds a new port to the permanent helper 🔥
--permanent --helper=helper --remove-port=portid[-portid]/protocol — removes a port from the permanent helper 🫶
--permanent --helper=helper --query-port=portid[-portid]/protocol — returns whether that port has been added to the permanent helper 🔍
--permanent --helper=helper --get-ports — lists the ports added to the permanent helper 🌈
--permanent --helper=helper --set-module=description — sets the module description for the helper 🧩
--permanent --helper=helper --get-module — prints the module description for the helper 📖
--permanent --helper=helper --set-family=description — sets the family description for the helper 👨‍👩‍👧
--permanent --helper=helper --get-family — prints the family description of the helper 📖

🌈 Internet Control Message Protocol (ICMP) type Options 🌈

Options in this section affect only one particular icmptype. One icmptype and only one 💖

[--permanent] --info-icmptype=icmptype — prints info about the icmptype icmptype. The output format is:

icmptype
  destination: ipv1 ..

The following options are only usable in the permanent configuration. Permanent only, no cap 🔒

--permanent --new-icmptype=icmptype — adds a brand new permanent and empty icmptype ✨

ICMP type names must be alphanumeric and may additionally include the characters '_' and '-'. Stay in your lane, names 😌

--permanent --new-icmptype-from-file=filename [--name=icmptype] — adds a new permanent icmptype from a prepared icmptype file, with an optional name override 👑
--permanent --delete-icmptype=icmptype — deletes an existing permanent icmptype 💀
--permanent --load-icmptype-defaults=icmptype — loads icmptype default settings, or reports a NO_DEFAULTS error 😭
--permanent --icmptype=icmptype --set-description=description — sets a new description on the icmptype ✍️
--permanent --icmptype=icmptype --get-description — prints the description for the icmptype 📖
--permanent --icmptype=icmptype --set-short=description — sets the short description on the icmptype 🌸
--permanent --icmptype=icmptype --get-short — prints the short description for the icmptype ✨
--permanent --icmptype=icmptype --add-destination=ipv — enables the destination for ipv in the permanent icmptype. ipv is one of ipv4 or ipv6. Pick one bestie, there are only two 💅
--permanent --icmptype=icmptype --remove-destination=ipv — disables the destination for ipv in the permanent icmptype. ipv is one of ipv4 or ipv6.
--permanent --icmptype=icmptype --query-destination=ipv — returns whether the destination for ipv is enabled in the permanent icmptype. ipv is one of ipv4 or ipv6.
--permanent --icmptype=icmptype --get-destinations — lists the destinations in the permanent icmptype 🌈
--permanent --path-icmptype=icmptype — prints the path of the icmptype configuration file 🗂️

💀 Direct Options 💀

DEPRECATED

The direct interface has been deprecated. It will be removed in a future release. It is superseded by policies, see firewalld.policies(5).

Not me being the bearer of bad news 😭 but yeah, she's on her way out. Use policies instead, bestie.

The direct options give a more direct access to the firewall. These options require the user to know basic iptables concepts, i.e. table (filter/mangle/nat/...), chain (INPUT/OUTPUT/FORWARD/...), commands (-A/-D/-I/...), parameters (-p/-s/-d/-j/...) and targets (ACCEPT/DROP/REJECT/...). So like, hard mode iptables lore 🧠✨

Direct options should be used only as a last resort when it's not possible to use, for example, --add-service=service or --add-rich-rule='rule'. Last resort only, she said what she said 💅

⚠️ Warning: Direct rules behavior is different depending on the value of FirewallBackend. See CAVEATS in firewalld.direct(5).

Okay bestie, listen — the first argument of each one of these options has to be ipv4, ipv6 or eb. With ipv4 it's for IPv4 (iptables(8)), with ipv6 it's for IPv6 (ip6tables(8)), and with eb it's for ethernet bridges (ebtables(8)). Periodt, that's the rules of the game. 🎀

[--permanent] --direct --get-all-chains — grabs every chain that's been added to all the tables. Note bestie: this one only cares about chains you previously added with --direct --add-chain. Nothing else. 💅
[--permanent] --direct --get-chains { ipv4 | ipv6 | eb } table — gets every chain added to table as a space separated list. Again, only chains you previously added with --direct --add-chain show up here. rigorous.
[--permanent] --direct --add-chain { ipv4 | ipv6 | eb } table chain — adds a brand new chain called chain to table. Pls make sure there's no other chain with that name already, okay? don't be messy. 😭

There are already basic chains built for you to use with direct options — for example the INPUT_direct chain (run iptables-save | grep direct and you'll see all of them, iykyk). These chains get jumped into before the chains for zones, which means every rule you put into INPUT_direct gets checked before the rules in zones. priority queen behavior. 👑

[--permanent] --direct --remove-chain { ipv4 | ipv6 | eb } table chain — removes the chain named chain from table. Only chains previously added with --direct --add-chain can be removed this way, no sneaky exceptions. 💀
[--permanent] --direct --query-chain { ipv4 | ipv6 | eb } table chain — tells you whether a chain named chain exists in table. Returns 0 if true, 1 otherwise. And yes, only chains previously added with --direct --add-chain count here. 🦋
[--permanent] --direct --get-all-rules — gets every rule added to every chain in every table, as a newline separated list of the priority and arguments. Only rules previously added with --direct --add-rule, so don't expect it to manifest anything else. ✨
[--permanent] --direct --get-rules { ipv4 | ipv6 | eb } table chain — gets every rule added to chain in table, as a newline separated list of the priority and arguments. Again: only rules previously added with --direct --add-rule. consistent queen.
[--permanent] --direct --add-rule { ipv4 | ipv6 | eb } table chain priority args — adds a rule with the arguments args to chain in table, with priority priority. 🎀

The priority is what orders your rules, bestie. Priority 0 means the rule goes on top of the chain, and with a higher priority the rule gets added further down. Rules with the same priority sit on the same level, and the order of those is not fixed and may change. So if you need a rule to definitely land after another one, give the first one a low priority and the following one a higher priority. That's the whole trick, no cap. 🌈

[--permanent] --direct --remove-rule { ipv4 | ipv6 | eb } table chain priority args — removes the rule with priority and the arguments args from chain in table. Only rules previously added with --direct --add-rule can be removed this way. linear, clean, iconic. 💅
[--permanent] --direct --remove-rules { ipv4 | ipv6 | eb } table chain — removes all rules in the chain named chain that exists in table. This one only concerns rules previously added with --direct --add-rule in this chain. bye bye rules 🫶
[--permanent] --direct --query-rule { ipv4 | ipv6 | eb } table chain priority args — returns whether a rule with priority and the arguments args exists in chain in table. Returns 0 if true, 1 otherwise. And yes, only rules previously added with --direct --add-rule are in scope here. 👑
--direct --passthrough { ipv4 | ipv6 | eb } args — passes a command straight through to the firewall. args can be all iptables, ip6tables and ebtables command line arguments. Heads up bestie: this command is untracked, which means firewalld is not able to provide information about this command later on — not even a listing of the untracked passthroughs. it's giving mystery 🕵️‍♀️ (there is no --permanent here, so don't try it.)
[--permanent] --direct --get-all-passthroughs — gets all passthrough rules as a newline separated list of the ipv value and arguments. ✨
[--permanent] --direct --get-passthroughs { ipv4 | ipv6 | eb } — gets all passthrough rules for the ipv value as a newline separated list of the priority and arguments. 🌸
[--permanent] --direct --add-passthrough { ipv4 | ipv6 | eb } args — adds a passthrough rule with the arguments args for the ipv value. 💖
[--permanent] --direct --remove-passthrough { ipv4 | ipv6 | eb } args — removes a passthrough rule with the arguments args for the ipv value. 💀
[--permanent] --direct --query-passthrough { ipv4 | ipv6 | eb } args — returns whether a passthrough rule with the arguments args exists for the ipv value. Returns 0 if true, 1 otherwise. 🦋

🚨 Panic Options 🚨

--panic-on — enables panic mode. All incoming and outgoing packets are dropped, and active connections will expire. Enable this only if there are serious problems with your network environment — for example if the machine is getting hacked in. 🚨😭

This is a runtime only change.

--panic-off — disables panic mode. After disabling it, established connections might work again, if panic mode was enabled for a short period of time. we're so back. 🫶

This is a runtime only change.

--query-panic — returns 0 if panic mode is enabled, 1 otherwise. vibe check on the panic. 💅

🌸 EXAMPLES 🌸

💖 Example 1

Enable the http service in the default zone. This is a runtime only change, i.e. effective until restart.

firewall-cmd --add-service=http

🌈 Example 2

Enable port 443/tcp immediately and permanently in the default zone. To make the change effective immediately and also after restart we need two commands. The first command makes the change in runtime configuration, i.e. makes it effective immediately, until restart. The second command makes the change in permanent configuration, i.e. makes it effective after restart. two commands, one slay. 👑

firewall-cmd --add-port=443/tcp
firewall-cmd --permanent --add-port=443/tcp

🦋 UNKNOWN DESTINATIONS 🦋

Some features occur at a point in the packet processing pipeline when it's impossible to determine the destination of the packet, e.g. prerouting. As a consequence, firewalld can only use the ingress interface/source to dispatch zones and policies, and packets get dispatched without considering the egress. it's giving "where are you going? we don't know her" 💀

Since the egress cannot be determined, the order of precedence is determined by the policy's priority.

The following features are subject to this behavior:

--add-forward-port
--add-rich-rule rule ... forward-port ...
--add-rich-rule rule ... mark ...

remember this one, bestie, it will show up in a quiz. 🌸

okay so bestie, exit codes are literally the receipts of what just happened. 💅

When everything is ✨perfect✨, firewall-cmd exits with 0. Zero. Nothing. Clean. Iconic. When it fails tho? The output turns red (dramatic, we love), and the exit code is either 2 if you fumbled the command-line options, or one of the following error codes in all the other cases. Keep this list in your notes app fr fr, iykyk. 📌

ALREADY_ENABLED — code 11, aka bestie it's already enabled 🙈
NOT_ENABLED — code 12, it's not enabled, so…
COMMAND_FAILED — code 13, the command just did not eat 💀
NO_IPV6_NAT — code 14, no IPv6 NAT happening here
PANIC_MODE — code 15, full panic mode activated 😭
ZONE_ALREADY_SET — code 16, that zone is already set
UNKNOWN_INTERFACE — code 17, the interface is a mystery to us
ZONE_CONFLICT — code 18, zones are beefing
BUILTIN_CHAIN — code 19, it's giving builtin chain energy
EBTABLES_NO_REJECT — code 20, ebtables said no reject
NOT_OVERLOADABLE — code 21, can't overload it, sorry
NO_DEFAULTS — code 22, there are no defaults
BUILTIN_ZONE — code 23, builtin zone moment
BUILTIN_SERVICE — code 24, builtin service moment
BUILTIN_ICMPTYPE — code 25, builtin icmptype moment
NAME_CONFLICT — code 26, name conflict, rude
NAME_MISMATCH — code 27, the names don't match
PARSE_ERROR — code 28, parsing said nope
ACCESS_DENIED — code 29, access denied, bye 👋
UNKNOWN_SOURCE — code 30, unknown source
RT_TO_PERM_FAILED — code 31, rt to perm failed
IPSET_WITH_TIMEOUT — code 32, ipset with timeout
BUILTIN_IPSET — code 33, builtin ipset
ALREADY_SET — code 34, it's already set bestie
MISSING_IMPORT — code 35, missing import
DBUS_ERROR — code 36, dbus error 😵
BUILTIN_HELPER — code 37, builtin helper
NOT_APPLIED — code 38, not applied
INVALID_ACTION — code 100, that action is invalid
INVALID_SERVICE — code 101, that service is invalid
INVALID_PORT — code 102, that port is invalid
INVALID_PROTOCOL — code 103, that protocol is invalid
INVALID_INTERFACE — code 104, that interface is invalid
INVALID_ADDR — code 105, that address is invalid
INVALID_FORWARD — code 106, that forward is invalid
INVALID_ICMPTYPE — code 107, that icmptype is invalid
INVALID_TABLE — code 108, that table is invalid
INVALID_CHAIN — code 109, that chain is invalid
INVALID_TARGET — code 110, that target is invalid
INVALID_IPV — code 111, that ipv is invalid
INVALID_ZONE — code 112, that zone is invalid
INVALID_PROPERTY — code 113, that property is invalid
INVALID_VALUE — code 114, that value is invalid
INVALID_OBJECT — code 115, that object is invalid
INVALID_NAME — code 116, that name is invalid
INVALID_FILENAME — code 117, that filename is invalid
INVALID_DIRECTORY — code 118, that directory is invalid
INVALID_TYPE — code 119, that type is invalid
INVALID_SETTING — code 120, that setting is invalid
INVALID_DESTINATION — code 121, that destination is invalid
INVALID_RULE — code 122, that rule is invalid
INVALID_LIMIT — code 123, that limit is invalid
INVALID_FAMILY — code 124, that family is invalid
INVALID_LOG_LEVEL — code 125, that log level is invalid
INVALID_AUDIT_TYPE — code 126, that audit type is invalid
INVALID_MARK — code 127, that mark is invalid
INVALID_CONTEXT — code 128, that context is invalid
INVALID_COMMAND — code 129, that command is invalid
INVALID_USER — code 130, that user is invalid
INVALID_UID — code 131, that uid is invalid
INVALID_MODULE — code 132, that module is invalid
INVALID_PASSTHROUGH — code 133, that passthrough is invalid
INVALID_MAC — code 134, that mac is invalid
INVALID_IPSET — code 135, that ipset is invalid
INVALID_ENTRY — code 136, that entry is invalid
INVALID_OPTION — code 137, that option is invalid
INVALID_HELPER — code 138, that helper is invalid
INVALID_PRIORITY — code 139, that priority is invalid
INVALID_POLICY — code 140, that policy is invalid
INVALID_LOG_PREFIX — code 141, that log prefix is invalid
INVALID_NFLOG_GROUP — code 142, that nflog group is invalid
INVALID_NFLOG_QUEUE — code 143, that nflog queue is invalid
INVALID_SOURCE — code 144, that source is invalid
MISSING_TABLE — code 200, missing table
MISSING_CHAIN — code 201, missing chain
MISSING_PORT — code 202, missing port
MISSING_PROTOCOL — code 203, missing protocol
MISSING_ADDR — code 204, missing addr
MISSING_NAME — code 205, missing name
MISSING_SETTING — code 206, missing setting
MISSING_FAMILY — code 207, missing family

aaaand here's the rest of the exit-code lineup, bestie — the dramatic finale of the table from earlier:

RUNNING_BUT_FAILED — 251 😭
NOT_RUNNING — 252 💀
NOT_AUTHORIZED — 253 🔒
UNKNOWN_ERROR — 254 🙈

okay so special tea for the --query-* options: successful queries return 0, unsuccessful ones return 1, and if an actual error happened, then the table above is what applies. periodt. 💅

👀 SEE ALSO 👀

go read these next, they're all iconic:

📝 NOTES 📝

firewalld home page: http://firewalld.org 🌐💖

💖 AUTHORS 💖

Thomas Woerner <twoerner@redhat.com> — Developer
Jiri Popelka <jpopelka@redhat.com> — Developer
Eric Garver <eric@garver.life> — Developer

and that's a wrap on this absolute saga 💫 this page comes from firewalld 2.5.2, and it's the FIREWALL-CMD(1) manual. no cap, you made it to the end, ily 🫶✨

📦 where this page comes from

arch rolling: firewalld 2.5.2-1 · GPL-2.0-or-later
nixpkgs unstable: firewalld 2.5.2
ubuntu stonking: firewalld 2.5.2-1 · GPL-2.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-02: a language model's rewrite of the original, under its terms

FIREWALL-CMD(1)

💖 FIREWALL-CMD(1) — the firewall-cmd era 💖

✨ NAME ✨

🌸 SYNOPSIS 🌸

🦋 DESCRIPTION 🦋

💅 OPTIONS 💅

🔧 General Options

🩺 Status Options

🙈 Log Denied Options

👑 Permanent Options

🌈 Zone Options

🧚 Policy Options

🎀 Options to Adapt and Query Zones and Policies

⭐ Options to Adapt and Query Zones ⭐

💅 Options to Adapt and Query Policies 💅

🦋 Options to Handle Bindings of Interfaces 🦋

🌸 Options to Handle Bindings of Sources 🌸

🌈 IPSet Options 🌈

🎀 Service Options 🎀

🦋 Helper Options 🦋

🌈 Internet Control Message Protocol (ICMP) type Options 🌈

💀 Direct Options 💀

🚨 Panic Options 🚨

🌸 EXAMPLES 🌸

💖 Example 1

🌈 Example 2

🦋 UNKNOWN DESTINATIONS 🦋

👀 SEE ALSO 👀

📝 NOTES 📝

💖 AUTHORS 💖

💖 FIREWALL-CMD(1) — the `firewall-cmd` era 💖