FIREWALL-OFFLINE-C(1)

📦
version 2.5.2 · 12 versions
, in arch rolling, nixpkgs unstable, ubuntu stonking

💅 NAME 💅

firewall-offline-cmd — firewalld offline command line client. periodt. ✨

🦋 SYNOPSIS 🦋

firewall-offline-cmd [OPTIONS...]

🌸 DESCRIPTION 🌸

okay so firewall-offline-cmd is the offline command line client for the firewalld daemon. bestie, you should only use it when the firewalld service is not running 🛑. like, for example, to migrate from system-config-firewall/lokkit or in the install environment to configure firewall settings with kickstart.

some lokkit options can't be automatically converted, and they'll throw an error or warning at you 😭. this tool tries to convert as much as possible, but there are limitations — for example with custom rules, modules, and masquerading.

Check the firewall configuration after using this tool! 👀

✨ OPTIONS ✨

if you give no options at all, the config from /etc/sysconfig/system-config-firewall gets migrated. 💅

sequence options are the ones you can specify multiple times. the exit code is 0 if at least one item succeeded. the ALREADY_ENABLED (11), NOT_ENABLED (12), and ZONE_ALREADY_SET (16) errors are treated as succeeded. if there are issues while parsing the items, those are treated as warnings and won't change the result as long as there's a succeeded one. without any succeeded item, the exit code depends on the error codes. exactly one error code? that one is used. more than one? UNKNOWN_ERROR (254) is used. 😤

the following options are supported:

💖 General Options 💖

  • -h, --help — prints a short help text and exits 👋
  • -V, --version — prints the version string of firewalld and exits ✨
  • -q, --quiet — do not print status messages 🤫
  • --default-config — path to firewalld default configuration. this usually defaults to /usr/lib/firewalld 📂
  • --system-config — path to firewalld system (user) configuration. this usually defaults to /etc/firewalld 📂

💅 Status Options 💅

  • --enabled — enable the firewall. this option is a default option and will activate the firewall if not already enabled as long as the option --disabled is not given 🔥
  • --disabled — disable the firewall by disabling the firewalld service 💀
  • --check-config — run checks on the permanent (default and system) configuration. this includes XML validity and semantics. this may be used with --system-config to check the validity of handwritten configuration files before copying them to the standard location 📝✅
  • --reset-to-defaults — reset configuration to firewalld's default configuration 🔄

🍓 Lokkit Compatibility Options 🍓

these options are nearly identical to the options of lokkit. iykyk 💅

  • --migrate-system-config-firewall=file — migrate system-config-firewall configuration from the given file. No further 🤷
  • --addmodule=module — this option will result in a warning message and will be ignored. handling of netfilter helpers has been merged into services completely. adding or removing netfilter helpers outside of services is therefore not needed anymore. for more information on handling netfilter helpers in services, please have a look at firewalld.zone(5). 📖
  • --removemodule — this option will result in a warning message and will be ignored. handling of netfilter helpers has been merged into services completely. adding or removing netfilter helpers outside of services is therefore not needed anymore. for more information on handling netfilter helpers in services, please have a look at firewalld.zone(5). 📖
  • --remove-service=service — remove a service from the default zone. this option can be specified multiple times. the service is one of the firewalld provided services. to get a list of the supported services, use firewall-cmd --get-services ✨
  • -s service, --service=service — add a service to the default zone. this option can be specified multiple times. the service is one of the firewalld provided services. to get a list of the supported services, use firewall-cmd --get-services 💖
  • -p portid[-portid]:protocol, --port=portid[-portid]:protocol — add the port to the default zone. this option can be specified multiple times. the port can either be a single port number or a port range portid-portid. the protocol can either be tcp, udp, sctp, or dccp 🔌
  • -t interface, --trust=interface — this option will result in a warning message. mark an interface as trusted. this option can be specified multiple times. the interface will be bound to the trusted zone. if the interface is used in a NetworkManager managed connection or if there is an ifcfg file for this interface, the zone will be changed to the zone defined in the configuration as soon as it gets activated. to change the zone of a connection use nm-connection-editor and set the zone to trusted, for an ifcfg file, use an editor and add "ZONE=trusted". if the zone is not defined in the ifcfg file, the firewalld default zone will be used. 🏠
  • -m interface, --masq=interface — this option will result in a warning message. masquerading will be enabled in the default zone. the interface argument will be ignored. this is for IPv4 only. 📡
  • --custom-rules=[type:][table:]filename — this option will result in a warning message and will be ignored. custom rule files are not supported by firewalld. 💀
  • --forward-port=if=interface:port=port:proto=protocol[:toport=destination port:][:toaddr=destination address] — this option will result in a warning message. add the IPv4 forward port in the default zone. this option can be specified multiple times. the port can either be a single port number portid or a port range portid-portid. the protocol can either be tcp, udp, sctp, or dccp. the destination address is an IP address. 🌐
  • --block-icmp=icmptype — this option will result in a warning message. add an ICMP block for icmptype in the default zone. this option can be specified multiple times. the icmptype is one of the icmp types firewalld supports. to get a listing of supported icmp types: firewall-cmd --get-icmptypes 📋

🌈 Log Denied Options 🌈

  • --get-log-denied — print the log denied setting. 📜
  • --set-log-denied=value — add logging rules right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones for the configured link-layer packet type. the possible *value*s are: all, unicast, broadcast, multicast, and off. the default setting is off, which disables the logging. this is a runtime and permanent change and will also reload the firewall to be able to add the logging rules. 🔥

👑 Zone Options 👑

  • --get-default-zone — print default zone for connections and interfaces. 🏠
  • --set-default-zone=zone — set default zone for connections and interfaces where no zone has been selected. setting the default zone changes the zone for the connections or interfaces that are using the default zone. 🔄
  • --get-zones — print predefined zones as a space separated list. ✨
  • --get-services — print predefined services as a space separated list. 💖
  • --get-icmptypes — print predefined icmptypes as a space separated list. 📋
  • --get-zone-of-interface=interface — print the name of the zone the interface is bound to or no zone. 🤷
  • --get-zone-of-source=source[/mask]|MAC|ipset:ipset — print the name of the zone the source is bound to or no zone. 🔍
  • --info-zone=zone — print information about the zone zone. the output format is:
zone
  interfaces: interface1 ..
  sources: source1 ..
  services: service1 ..
  ports: port1 ..
  protocols: protocol1 ..
  forward-ports:
        forward-port1
        ..
  source-ports: source-port1 ..
  icmp-blocks: icmp-type1 ..
  rich rules:
        rich-rule1
        ..
  • --list-all-zones — list everything added for or enabled in all zones. the output format is:
zone1
  interfaces: interface1 ..
  sources: source1 ..
  services: service1 ..
  ports: port1 ..
  protocols: protocol1 ..
  forward-ports:
        forward-port1
        ..
  source-ports: source-port1 ..
  icmp-blocks: icmp-type1 ..
  rich rules:
        rich-rule1
        ..
..
  • --new-zone=zone — add a new permanent zone. zone names must be alphanumeric and may additionally include characters: _ and -. ✨
  • --new-zone-from-file=filename [--name=zone] — add a new permanent zone from a prepared zone file with an optional name override. 📁
  • --path-zone=zone — print path of the zone configuration file. 📂
  • --delete-zone=zone — delete an existing permanent zone. 🗑️

🧚 Policy Options 🧚

  • --get-policies — print predefined policies as a space separated list. 📜
  • --info-policy=policy — print information about the policy policy. 🔍
  • --list-all-policies — list everything added for or enabled in all policies. 📋
  • --new-policy=policy — add a new permanent policy. policy names must be alphanumeric and may additionally include characters: _ and -. ✨
  • --new-policy-from-file=filename [--name=policy] — add a new permanent policy from a prepared policy file with an optional name override. 📁
  • --path-policy=policy — print path of the policy configuration file. 📂
  • --delete-policy=policy — delete an existing permanent policy. 🗑️
  • --load-policy-defaults=policy — load the shipped defaults for a policy. only applies to policies shipped with firewalld. does not apply to user defined policies. 🚫

🎀 Options to Adapt and Query Zones and Policies 🎀

options in this section affect only one particular zone or policy. if used with --zone=zone or --policy=policy option, they affect the specified zone or policy. if both options are omitted, they affect the default zone (see --get-default-zone). 🎯

  • [--zone=zone] [--policy=policy] --list-all — list everything added or enabled. 📋
  • [--zone=zone] [--policy=policy] --get-target — get the target. 🎯
  • [--zone=zone] [--policy=policy] --set-target=target — set the target. for zones target is one of: default, ACCEPT, DROP, REJECT. for policies target is one of: CONTINUE, ACCEPT, DROP, REJECT. default is similar to REJECT, but it implicitly allows ICMP packets. 📦

ACCEPT lets traffic be forwarded out of the zone — either to the same zone or off to other zones, doesn't matter, it's all allowed. 💅

  • [--zone=zone] [--policy=policy] --set-description=description — sets the description. yes bestie, it's just a description. ✍️
  • [--zone=zone] [--policy=policy] --get-description — prints the description out loud.
  • [--zone=zone] [--policy=policy] --set-short=description — sets the short description (the little one, the mini me).
  • [--zone=zone] [--policy=policy] --get-short — prints that short description.
  • [--zone=zone] [--policy=policy] --list-services — lists every service as a space separated list. one long line of vibes.
  • [--zone=zone] [--policy=policy] --add-service=service — adds a service. you can throw this option in as many times as you want, it stacks. 🫶

The service has to be one of the services firewalld ships with. wanna see the whole roster? run firewall-cmd --get-services.

Note: some services define connection tracking helpers, and helpers that might operate in client mode (like tftp) have to be added to an outbound policy, not a zone, if you want them to actually work for clients. otherwise the helper just won't get applied to the outbound traffic. the related traffic — the stuff the connection tracking helper defines — does get allowed on the return path (ingress) by the stateful firewall rules, so at least there's that. 😌

Here's what an outbound policy for connection tracking helpers looks like:

# firewall-cmd --new-policy clientConntrack
# firewall-cmd --policy clientConntrack --add-ingress-zone HOST
# firewall-cmd --policy clientConntrack --add-egress-zone ANY
# firewall-cmd --policy clientConntrack --add-service tftp
  • [--zone=zone] --remove-service-from-zone=service — removes a service from a zone. can be specified multiple times. if you skip zone, the default zone gets used. 🙈
  • [--policy=policy] --remove-service-from-policy=service — removes a service from a policy. can be specified multiple times.
  • [--zone=zone] [--policy=policy] --query-service=service — tells you whether that service has been added. returns 0 if true, 1 otherwise.
  • [--zone=zone] [--policy=policy] --list-ports — lists the ports as a space separated list. a port looks like portid[-portid]/protocol, so it's either a port-and-protocol pair or a port range with a protocol. 🎀
  • [--zone=zone] [--policy=policy] --add-port=portid[-portid]/protocol — adds the port. can be specified multiple times.

The port can be a single port number or a port range portid-portid. The protocol can be tcp, udp, sctp or dccp.

  • [--zone=zone] [--policy=policy] --remove-port=portid[-portid]/protocol — removes the port. can be specified multiple times.
  • [--zone=zone] [--policy=policy] --query-port=portid[-portid]/protocol — tells you whether that port has been added. returns 0 if true, 1 otherwise.
  • [--zone=zone] [--policy=policy] --list-protocols — lists the protocols as a space separated list.
  • [--zone=zone] [--policy=policy] --add-protocol=protocol — adds the protocol. can be specified multiple times. okay and then the page just casually drops this in the middle with zero context: timeval is either a number (of seconds) or a number followed by one of the characters s (seconds), m (minutes), h (hours), for example 20m or 1h. 😭 i'm not gonna pretend that makes sense here, i'm just telling you what it says.

The protocol can be any protocol your system supports. go peek at /etc/protocols for the supported list. 🦋

  • [--zone=zone] [--policy=policy] --remove-protocol=protocol — removes the protocol. can be specified multiple times.
  • [--zone=zone] [--policy=policy] --query-protocol=protocol — tells you whether that protocol has been added. returns 0 if true, 1 otherwise.
  • [--zone=zone] [--policy=policy] --list-icmp-blocks — lists the Internet Control Message Protocol (ICMP) type blocks as a space separated list. ✨
  • [--zone=zone] [--policy=policy] --add-icmp-block=icmptype — adds an ICMP block for icmptype. can be specified multiple times.

The icmptype is one of the icmp types firewalld supports. want the full list? firewall-cmd --get-icmptypes.

  • [--zone=zone] [--policy=policy] --remove-icmp-block=icmptype — removes the ICMP block for icmptype. can be specified multiple times.
  • [--zone=zone] [--policy=policy] --query-icmp-block=icmptype — tells you whether an ICMP block for icmptype has been added. returns 0 if true, 1 otherwise.
  • [--zone=zone] [--policy=policy] --list-forward-ports — lists the IPv4 forward ports as a space separated list.

For IPv6 forward ports, bestie, you gotta use the rich language. 💜

  • --add-forward-port
[--zone=zone] [--policy=policy]
--add-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

Adds the IPv4 forward port. can be specified multiple times.

The port can be a single port number portid or a port range portid-portid. The protocol can be tcp, udp, sctp or dccp. The destination address is a simple IP address.

For IPv6 forward ports, use the rich language.

Note: IP forwarding gets implicitly enabled if toaddr is specified. no asking, it just happens. 🔥
Note: when this option is used with --policy, it's impossible for the firewall backend to figure out the egress zone. go read the section UNKNOWN DESTINATIONS in firewall-cmd(1) for the whole story.
  • --remove-forward-port
[--zone=zone] [--policy=policy]
--remove-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

Removes the IPv4 forward port. can be specified multiple times.

For IPv6 forward ports, use the rich language.

  • --query-forward-port
[--zone=zone] [--policy=policy]
--query-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

Tells you whether that IPv4 forward port has been added. returns 0 if true, 1 otherwise.

For IPv6 forward ports, use the rich language.

  • [--zone=zone] [--policy=policy] --list-source-ports — lists the source ports as a space separated list. a port looks like portid[-portid]/protocol.
  • [--zone=zone] [--policy=policy] --add-source-port=portid[-portid]/protocol — adds the source port. can be specified multiple times.

The port can be a single port number or a port range portid-portid. The protocol can be tcp, udp, sctp or dccp.

  • [--zone=zone] [--policy=policy] --remove-source-port=portid[-portid]/protocol — removes the source port. can be specified multiple times.
  • [--zone=zone] [--policy=policy] --query-source-port=portid[-portid]/protocol — tells you whether that source port has been added. returns 0 if true, 1 otherwise.
  • [--zone=zone] [--policy=policy] --add-masquerade — enables IPv4 masquerade. masquerading hits different when your machine is a router and machines hanging off an interface in another zone should be able to use the first connection. 🧚

For IPv6 masquerading, use the rich language.

Note: IP forwarding gets implicitly enabled. again. it's not optional. 💀
  • [--zone=zone] [--policy=policy] --remove-masquerade — disables IPv4 masquerade.

For IPv6 masquerading, use the rich language.

  • [--zone=zone] [--policy=policy] --query-masquerade — tells you whether IPv4 masquerading has been enabled. returns 0 if true, 1 otherwise.

For IPv6 masquerading, use the rich language.

  • [--zone=zone] [--policy=policy] --list-rich-rules — lists the rich language rules as a newline separated list. (newline separated, not space separated — she's different, she's special 💅)
  • [--zone=zone] [--policy=policy] --add-rich-rule='rule' — adds the rich language rule 'rule'. can be specified multiple times.

For the rich language rule syntax, go look at firewalld.richlanguage(5). 📖

  • [--zone=zone] [--policy=policy] --remove-rich-rule='rule' — removes the rich language rule 'rule'. can be specified multiple times.

For the rich language rule syntax, go look at firewalld.richlanguage(5).

  • [--zone=zone] [--policy=policy] --query-rich-rule='rule' — tells you whether a rich language rule 'rule' has been added. returns 0 if true, 1 otherwise.

For the rich language rule syntax, go look at firewalld.richlanguage(5).

🎀 Options to Adapt and Query Zones 🎀

Everything in this lil section affects one particular zone. use it with --zone=zone and it hits that zone. leave the option out and it hits the default zone instead (peep --get-default-zone). 👑

  • [--zone=zone] --add-icmp-block-inversion — enables ICMP block inversion.
  • [--zone=zone] --remove-icmp-block-inversion — disables ICMP block inversion.
  • [--zone=zone] --query-icmp-block-inversion — tells you whether ICMP block inversion is enabled. returns 0 if true, 1 otherwise.
  • [--zone=zone] --add-forward — enables intra zone forwarding.
  • [--zone=zone] --remove-forward — disables intra zone forwarding.
  • [--zone=zone] --query-forward — tells you whether intra zone forwarding is enabled. returns 0 if true, 1 otherwise.
  • [--zone=zone] --get-priority — gets the zone's priority.
  • [--zone=zone] --set-priority — sets the zone's priority for packet classification. this sets both the ingress and egress priority, two for one, ate. ✨
  • [--zone=zone] --get-ingress-priority — gets the zone's ingress priority.
  • [--zone=zone] --set-ingress-priority — sets the zone's ingress priority for packet classification.
  • [--zone=zone] --get-egress-priority — gets the zone's egress priority.
  • [--zone=zone] --set-egress-priority — sets the zone's egress priority for packet classification.

👑 Options to Adapt and Query Policies 👑

These ones affect one particular policy, so you must pass --policy=policy with them. no negotiating. 💅

  • --policy=policy --get-priority — gets the priority.
  • --policy=policy --set-prioritypriority — sets the priority. (yes bestie, the page really does glue it together like that, i'm just the messenger 🙈)

The priority decides the relative ordering of policies. it's an integer between -32768 and 32767, where -1 is the default value for new policies, and 0 is reserved for internal use. no touching. ⚠️

If a priority is < 0, then the policy's rules execute before all rules in all zones.

If a priority is > 0, then the policy's rules execute after all rules in all zones.

  • --policy=policy --list-ingress-zones — lists the ingress zones as a space separated list.
  • --policy=policy --add-ingress-zone=zone — adds an ingress zone. can be specified multiple times.

The ingress zone is one of the firewalld provided zones, or one of the pseudo-zones: HOST, ANY. 🌈

HOST is used for traffic originating from the host machine — y'know, the host that's running firewalld.

ANY is for traffic coming from any zone, fr — think of it as a lil wildcard but for zones 💫. But heads up bestie: it does NOT include traffic from the host machine itself — for that you gotta use HOST. Periodt.

  • --policy=policy --remove-ingress-zone=zone — takes an ingress zone off the list 🚮. You can drop this option in multiple times, it stacks.
  • --policy=policy --query-ingress-zone=zone — asks "is this zone in there?" 👀 Returns 0 if yes, 1 if no.
  • --policy=policy --list-egress-zones — spills all the egress zones you added, as one space-separated list ✨.
  • --policy=policy --add-egress-zone=zone — adds an egress zone 🎀. Stackable, hit it multiple times.
  • --policy=policy --remove-egress-zone=zone — removes an egress zone 🚮, also stackable.

The egress zone is one of the zones firewalld hands out, or one of the pseudo-zones: HOST, ANY.

For the tea on HOST and ANY, scroll back up to the --add-ingress-zone option 🌸.

  • --policy=policy --query-egress-zone=zone — checks if that zone's been added. Returns 0 if true, 1 if not.
  • --policy=policy|--policy-set=policy-set --add-disable — administratively disables a policy 😴. A disabled policy just will not activate, simple as that.
  • --policy=policy|--policy-set=policy-set --remove-disable — lifts that administrative disable 💅. Now the policy is allowed to activate again.
  • --policy=policy --query-disable — tells you whether the policy is administratively disabled 🔍.

🎀 Options to Handle Bindings of Interfaces 🎀

Binding an interface to a zone means this zone's settings are the ones restricting traffic through that interface 🔒. It's giving "this zone owns this interface."

Options in this section affect only one particular zone, okay? If you use them with --zone=zone, they hit the zone zone. If you leave that option out, they hit the default zone (peep --get-default-zone).

For a list of predefined zones, run firewall-cmd --get-zones ✨.

An interface name is a string up to 16 characters long, and it may not contain ' ', '/', '!' and '*' 🚫.

  • [--zone=zone] --list-interfaces — lists the interfaces bound to zone zone, space separated 💖. Omit zone and it uses the default zone.
  • [--zone=zone] --add-interface=interface — binds interface interface to zone zone 🫶. Omit zone, default zone it is.
  • [--zone=zone] --change-interface=interface — moves the interface interface over to zone zone 🔄. Omit zone and default zone gets it. If the old zone and new zone are literally the same, the call just gets ignored, no error, no drama 🙈. If the interface was never bound to any zone before, it acts like --add-interface.
  • [--zone=zone] --query-interface=interface — asks whether interface interface is bound to zone zone. Returns 0 if true, 1 if not.
  • [--zone=zone] --remove-interface=interface — unbinds interface interface from zone zone 🌸. Omit zone, default zone applies.

🌈 Options to Handle Bindings of Sources 🌈

Binding a source to a zone means this zone's settings are what restrict traffic from that source 🔐.

A source address or address range can be an IP address, or a network IP address with a mask (for IPv4 or IPv6), or a MAC address, or an ipset using the ipset: prefix 🎯. For IPv4 the mask can be a network mask or just a plain number. For IPv6 the mask is a plain number. And ngl — host names are not supported, so don't even try it bestie 😭.

Options in this section affect only one particular zone. Use --zone=zone and they affect the zone zone. Leave it out, and they affect the default zone (see --get-default-zone).

For a list of predefined zones, hit up firewall-cmd --get-zones ✨.

  • [--zone=zone] --list-sources — lists the sources bound to zone zone, space separated 💫. No zone? Default zone steps in.
  • [--zone=zone] --add-source=source[/mask]|MAC|ipset:ipset — binds the source to zone zone 🫶. No zone, default zone.
  • [--zone=zone] --change-source=source[/mask]|MAC|ipset:ipset — changes which zone the source is bound to, over to zone zone 🔄. No zone, default zone. If old zone and new zone match exactly, the call is ignored without an error, no cap 🙈. If the source was never bound to a zone before, it behaves like --add-source.
  • [--zone=zone] --query-source=source[/mask]|MAC|ipset:ipset — checks whether that source is bound to zone zone. Returns 0 if true, 1 otherwise.
  • [--zone=zone] --remove-source=source[/mask]|MAC|ipset:ipset — removes the binding of that source from zone zone 🚮. No zone, default zone.

💜 IPSet Options 💜

  • --new-ipset=ipset --type=ipset type [--option=ipset option[=value]] — makes a brand new permanent ipset, and you get to name the type plus optional options ✨.

ipset names gotta be alphanumeric and may additionally include these characters: '_' and '-' 🎀.

  • --new-ipset-from-file=filename [--name=ipset] — makes a new permanent ipset from a prepared ipset file, with an optional name override 📄.
  • --delete-ipset=ipset — deletes an existing permanent ipset 🚮.
  • --info-ipset=ipset — prints the deets about the ipset ipset 🔍. The output format is:
ipset
  type: type
  options: option1[=value1] ..
  entries: entry1 ..
  • --get-ipsets — prints all the predefined ipsets, space separated list 🌸.
  • --ipset=ipset --add-entry=entry — adds a new entry to the ipset 🫶.
  • --ipset=ipset --remove-entry=entry — removes an entry from the ipset 🚮.
  • --ipset=ipset --query-entry=entry — returns whether that entry's been added to the ipset. Returns 0 if true, 1 otherwise.
  • --ipset=ipset --get-entries — lists every entry in the ipset 💫.
  • --ipset=ipset --add-entries-from-file=filename — adds new entries to the ipset, straight from the file 📄. For every entry that's in the file but already in the ipset, a warning gets printed ⚠️.

The file should have an entry per line. Lines starting with a hash or a semicolon are ignored, and so are empty lines 🚫.

  • --ipset=ipset --remove-entries-from-file=filename — removes existing entries from the ipset, based on the file ✂️. For every entry listed in the file but not in the ipset, a warning gets printed ⚠️.

The file should have an entry per line. Lines starting with a hash or a semicolon are ignored, and empty lines too 🚫.

  • --ipset=ipset --set-description=description — sets a new description on the ipset 📝.
  • --ipset=ipset --get-description — prints the description for the ipset 👀.
  • --ipset=ipset --set-short=description — sets a new short description on the ipset 🎀.
  • --ipset=ipset --get-short — prints the short description for the ipset ✨.
  • --path-ipset=ipset — prints the path of the ipset's configuration file 📁.

🦋 Service Options 🦋

  • --info-service=service — prints the deets about service service 🔍. The output format is:
service
  ports: port1 ..
  protocols: protocol1 ..
  source-ports: source-port1 ..
  helpers: helper1 ..
  destination: ipv1:address1 ..
  • --new-service=service — adds a brand new permanent service 💖.

Service names must be alphanumeric, and may additionally include these characters: '_' and '-' 🎀.

  • --new-service-from-file=filename [--name=service] — adds a new permanent service from a prepared service file, with an optional name override 📄.
  • --delete-service=service — deletes an existing permanent service 🚮.
  • --path-service=service — prints the path of the service's configuration file 📁.
  • --service=service --set-description=description — sets a new description on the service 📝.
  • --service=service --get-description — prints the description for the service 👀.
  • --service=service --set-short=description — sets a short description on the service 🎀.
  • --service=service --get-short — prints the short description for the service ✨.
  • --service=service --add-port=portid[-portid]/protocol — adds a new port to the permanent service 🫶.
  • --service=service --remove-port=portid[-portid]/protocol — removes a port from the permanent service 🚮.
  • --service=service --query-port=portid[-portid]/protocol — returns whether the port has been added to the permanent service 👀.
  • --service=service --get-ports — lists the ports added to the permanent service 💫.
  • --service=service --add-protocol=protocol — adds a new protocol to the permanent service 🫶.
  • --service=service --remove-protocol=protocol — removes a protocol from the permanent service 🚮.
  • --service=service --query-protocol=protocol — returns whether the protocol has been added to the permanent service 👀.
  • --service=service --get-protocols — lists the protocols added to the permanent service 💫.
  • --service=service --add-source-port=portid[-portid]/protocol — adds a new source port to the permanent service 🫶.
  • --service=service --remove-source-port=portid[-portid]/protocol — removes a source port from the permanent service 🚮.
  • --service=service --query-source-port=portid[-portid]/protocol — returns whether the source port has been added to the permanent service 👀.
  • --service=service --get-source-ports — lists the source ports added to the permanent service 💫.
  • --service=service --add-helper=helper — adds a new helper to the permanent service 🫶.
  • --service=service --remove-helper=helper — removes a helper from the permanent service 🚮.
  • --service=service --query-helper=helper — returns whether the helper has been added to the permanent service 👀.
  • --service=service --get-service-helpers — lists the helpers added to the permanent service 💫.
  • --service=service --set-destination=ipv:address[/mask] — sets the destination for ipv to address[/mask] in the permanent service 🎯.
  • --service=service --remove-destination=ipv — removes the destination for ipv from the permanent service 🚮.
  • --service=service --query-destination=ipv:address[/mask] — returns whether the destination ipv to address[/mask] has been set in the permanent service 👀.
  • --service=service --get-destinations — lists the destinations added to the permanent service 💫.
  • --service=service --add-include=service — adds a new include to the permanent service 🫶.
  • --service=service --remove-include=service — removes an include from the permanent service 🚮.
  • --service=service --query-include=service — returns whether the include has been added to the permanent service 👀.
  • --service=service --get-includes — lists the includes added to the permanent service 💫.

🌟 Helper Options 🌟

Options in this section affect only one particular helper 🧚.

  • --info-helper=helper — prints the deets about the helper helper 🔍. The output format is:
helper
  family: family
  module: module
  ports: port1 ..
The following options are only usable in the permanent configuration. ⚠️
  • --new-helper=helper --module=nf_conntrack_module [--family=ipv4|ipv6] — spawns a brand new permanent helper, with the module set, and the family too if you want it. Helper names must be alphanumeric, and you're also allowed to sprinkle in the character '-'. ✨
  • --new-helper-from-file=filename [--name=helper] — builds a new permanent helper out of a helper file you already prepped, with an optional name override if you're feeling spicy.
  • --delete-helper=helper — deletes a permanent helper that already exists. bye bestie 💅
  • --load-helper-defaults=helper — loads the helper's default settings, or hits you with a NO_DEFAULTS error. no in-between. 😤
  • --path-helper=helper — prints the path of the helper's configuration file.
  • --get-helpers — prints the predefined helpers as a space separated list.
  • --helper=helper --set-description=description — sets a new description on the helper.
  • --helper=helper --get-description — prints the description for the helper.
  • --helper=helper --set-short=description — sets the short description on the helper.
  • --helper=helper --get-short — prints the short description for the helper.
  • --helper=helper --add-port=portid[-portid]/protocol — adds a new port to the permanent helper.
  • --helper=helper --remove-port=portid[-portid]/protocol — removes a port from the permanent helper.
  • --helper=helper --query-port=portid[-portid]/protocol — returns whether that port has been added to the permanent helper or not.
  • --helper=helper --get-ports — lists the ports added to the permanent helper.
  • --helper=helper --set-module=description — sets the module description for the helper.
  • --helper=helper --get-module — prints the module description for the helper.
  • --helper=helper --set-family=description — sets the family description for the helper.
  • --helper=helper --get-family — prints the family description of the helper.

🦋 Internet Control Message Protocol (ICMP) type Options 🦋

  • --info-icmptype=icmptype — prints all the info about the icmptype icmptype. The output format is, exactly:
icmptype
  destination: ipv1 ..
  • --new-icmptype=icmptype — adds a new permanent icmptype.

ICMP type names must be alphanumeric, and may additionally include the characters '_' and '-'. iykyk 🎀

  • --new-icmptype-from-file=filename [--name=icmptype] — adds a new permanent icmptype from an icmptype file you prepared earlier, with an optional name override.
  • --delete-icmptype=icmptype — deletes an existing permanent icmptype.
  • --icmptype=icmptype --set-description=description — sets a new description on the icmptype.
  • --icmptype=icmptype --get-description — prints the description for the icmptype.
  • --icmptype=icmptype --set-short=description — sets the short description on the icmptype.
  • --icmptype=icmptype --get-short — prints the short description for the icmptype.
  • --icmptype=icmptype --add-destination=ipv — enables destination for ipv in the permanent icmptype. ipv is one of ipv4 or ipv6. 🌈
  • --icmptype=icmptype --remove-destination=ipv — disables destination for ipv in the permanent icmptype. ipv is one of ipv4 or ipv6.
  • --icmptype=icmptype --query-destination=ipv — returns whether the destination for ipv is enabled in the permanent icmptype. ipv is one of ipv4 or ipv6.
  • --icmptype=icmptype --get-destinations — lists the destinations in the permanent icmptype.
  • --path-icmptype=icmptype — prints the path of the icmptype configuration file.

💀 Direct Options 💀

DEPRECATED 🚨 The direct interface has been deprecated. It will be removed in a future release. It is superseded by policies, see firewalld.policies(5).

The direct options hand you a way more direct hookup to the firewall. They require you to already know basic iptables concepts, like table (filter/mangle/nat/...), chain (INPUT/OUTPUT/FORWARD/...), commands (-A/-D/-I/...), parameters (-p/-s/-d/-j/...) and targets (ACCEPT/DROP/REJECT/...). so like, actual grown-up iptables knowledge, no cap.

Direct options should be used only as a last resort, when it's genuinely not possible to use, for example, --add-service=service or --add-rich-rule='rule' instead. it's giving "emergency exit only" 🫶

⚠️ Warning: Direct rules behavior is different depending on the value of FirewallBackend. See CAVEATS in firewalld.direct(5).

The first argument of each option has to be ipv4 or ipv6 or eb. With ipv4 it will be for IPv4 (iptables(8)), with ipv6 for IPv6 (ip6tables(8)) and with eb for ethernet bridges (ebtables(8)). ✨

  • --direct --get-all-chains — gets all chains added to all tables.

This option concerns only chains previously added with --direct --add-chain. 👑

  • --direct --get-chains { ipv4 | ipv6 | eb } table — gets all chains added to table as a space separated list.

This option concerns only chains previously added with --direct --add-chain.

  • --direct --add-chain { ipv4 | ipv6 | eb } table chain — adds a new chain with the name chain to table.

There already exist basic chains to use with direct options — for example the INPUT_direct chain (run iptables-save | grep direct to see all of them). These chains are jumped into before chains for zones, i.e. every rule you put into INPUT_direct will be checked before rules in zones. 💅

  • --direct --remove-chain { ipv4 | ipv6 | eb } table chain — removes the chain with the name chain from table.
  • --direct --query-chain { ipv4 | ipv6 | eb } table chain — returns whether a chain with the name chain exists in table. Returns 0 if true, 1 otherwise.

This option concerns only chains previously added with --direct --add-chain.

  • --direct --get-all-rules — gets all rules added to all chains in all tables, as a newline separated list of the priority and arguments.
  • --direct --get-rules { ipv4 | ipv6 | eb } table chain — gets all rules added to chain in table, as a newline separated list of the priority and arguments.
  • --direct --add-rule { ipv4 | ipv6 | eb } table chain priority args — adds a rule with the arguments args to chain in table with priority priority.

The priority orders your rules. Priority 0 means the rule gets added on top of the chain, and with a higher priority the rule gets added further down. Rules with the same priority sit on the same level, and the order of those rules is not fixed and may change. So if you need to guarantee a rule lands after another one, use a low priority for the first and a higher one for the following. 🧚

  • --direct --remove-rule { ipv4 | ipv6 | eb } table chain priority args — removes a rule with priority and the arguments args from chain in table.
  • --direct --remove-rules { ipv4 | ipv6 | eb } table chain — removes all rules in the chain with the name chain that exists in table.

This option concerns only rules previously added with --direct --add-rule in this chain.

  • --direct --query-rule { ipv4 | ipv6 | eb } table chain priority args — returns whether a rule with priority and the arguments args exists in chain in table. Returns 0 if true, 1 otherwise.
  • --direct --get-all-passthroughs — gets all permanent passthrough rules as a newline separated list of the ipv value and arguments.
  • --direct --get-passthroughs { ipv4 | ipv6 | eb } — gets all permanent passthrough rules for the ipv value as a newline separated list of the priority and arguments.
  • --direct --add-passthrough { ipv4 | ipv6 | eb } args — adds a permanent passthrough rule with the arguments args for the ipv value.
  • --direct --remove-passthrough { ipv4 | ipv6 | eb } args — removes a permanent passthrough rule with the arguments args for the ipv value.
  • --direct --query-passthrough { ipv4 | ipv6 | eb } args — returns whether a permanent passthrough rule with the arguments args exists for the ipv value. Returns 0 if true, 1 otherwise.

👑 Policy Options 👑

  • --policy-server — changes Polkit actions to 'server' (more restricted) 🔒
  • --policy-desktop — changes Polkit actions to 'desktop' (less restricted) 🔓

🌸 SEE ALSO 🌸

firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1), firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5), firewalld.icmptype(5), firewall-offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5), firewalld.zones(5), firewalld.policy(5), firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5)

🫶 NOTES 🫶

firewalld home page:

http://firewalld.org

⭐ AUTHORS ⭐

  • Thomas Woerner <twoerner@redhat.com> — Developer
  • Jiri Popelka <jpopelka@redhat.com> — Developer
  • Eric Garver <eric@garver.life> — Developer

and that's the whole page bestie, you made it to the end 🎀💖 this was firewalld 2.5.2, serving you the FIREWALL-OFFLINE-C(1) manual page — now go forth and firewall offline, iconically ✨👑

📦 where this page comes from