FIREWALLD.DBUS(5)

📦

version 2.5.2 · 12 versions

2.5.2 · arch rolling, nixpkgs unstable, ubuntu stonking (latest)
2.1.2 · opensuse-leap 16.0
1.3.4 · centos-stream 9
2.4.3 · centos-stream 10, nixos 26.05
2.4.1 · alpine 3.24
2.3.2 · fedora 43
1.1.1 · ubuntu jammy
2.4.4 · fedora 44
2.4.0 · fedora 44
1.3.3 · debian bookworm
2.1.1 · ubuntu noble
2.3.1 · debian trixie, fedora 43, ubuntu questing, ubuntu resolute

, in arch rolling, nixpkgs unstable, ubuntu stonking

🌸 NAME 🌸

firewalld.dbus — literally the firewalld D-Bus interface description, bestie 💖 this is the manual page FIREWALLD.DBUS(5) and she is long so buckle up 🎀

🗺️ OBJECT PATHS 🗺️

okay so this is the basic firewalld object path structure, right? and the interfaces that get used at each path are explained down in the section called “INTERFACES” 👇

/org/fedoraproject/FirewallD1
  Interfaces
    org.fedoraproject.FirewallD1
    org.fedoraproject.FirewallD1.direct (deprecated)
    org.fedoraproject.FirewallD1.ipset
    org.fedoraproject.FirewallD1.policies (deprecated)
    org.fedoraproject.FirewallD1.zone
    org.freedesktop.DBus.Introspectable
    org.freedesktop.DBus.Properties

/org/fedoraproject/FirewallD1/config
  Interfaces
    org.fedoraproject.FirewallD1.config
    org.fedoraproject.FirewallD1.config.direct (deprecated)
    org.fedoraproject.FirewallD1.config.policies (deprecated)
    org.freedesktop.DBus.Introspectable
    org.freedesktop.DBus.Properties

/org/fedoraproject/FirewallD1/config/zone/i
  Interfaces
    org.fedoraproject.FirewallD1.config.zone
    org.freedesktop.DBus.Introspectable
    org.freedesktop.DBus.Properties

/org/fedoraproject/FirewallD1/config/service/i
  Interfaces:
    org.fedoraproject.FirewallD1.config.service
    org.freedesktop.DBus.Introspectable
    org.freedesktop.DBus.Properties

/org/fedoraproject/FirewallD1/config/ipset/i
  Interfaces
    org.fedoraproject.FirewallD1.config.ipset
    org.freedesktop.DBus.Introspectable
    org.freedesktop.DBus.Properties

/org/fedoraproject/FirewallD1/config/icmptype/i
  Interfaces
    org.fedoraproject.FirewallD1.config.icmptype
    org.freedesktop.DBus.Introspectable
    org.freedesktop.DBus.Properties

🔌 INTERFACES 🔌

👑 org.fedoraproject.FirewallD1

this one is the main character honestly 👑 she holds all the general runtime operations: reloading, panic mode, default zone stuff, grabbing services and icmp types and all their settings. like the whole vibe check of the running firewall.

⭐ Methods ⭐

authorizeAll() → Nothing — starts up authorization for the complete firewalld D-Bus interface. bestie this one is mostly for configuration applications, iykyk 🫶
completeReload() → Nothing — reloads the firewall completely, netfilter kernel modules and all 💀 and yeah, this will most likely terminate your active connections because state information gets lost. so obviously only touch this if your firewall is having severe problems — like, for example, there are state information problems and literally no connection can be established even with correct firewall rules 😭
disablePanicMode() → Nothing — turns panic mode off. after you disable it, connections that were already established might start working again — if panic mode was only on for a short period of time. no promises tho 🫠

possible errors: NOT_ENABLED, COMMAND_FAILED

resetToDefaults() → Nothing — resets the firewall to its default configuration, then reloads the firewall. heads up: this hits both the runtime and the permanent configuration ✨
enablePanicMode() → Nothing — turns panic mode on. every single incoming and outgoing packet gets dropped, and active connections will expire 💀 only enable this if there are serious problems with your network environment, like genuinely serious.

possible errors: ALREADY_ENABLED, COMMAND_FAILED

getAutomaticHelpers() → s — deprecated bestie, she always returns "no" 🙈
getDefaultZone() → s — returns the default zone. that's it, that's the method 💅
getHelperSettings(s: helper) → (sssssa(ss)) — returns the runtime settings of the given helper. if you want the permanent settings you gotta go look at org.fedoraproject.FirewallD1.config.helper.Methods.getSettings. the settings come in this format: version, name, description, family, module, and an array of ports.
- version (s): see the version attribute of the helper tag in firewalld.helper(5).
- name (s): see the short tag in firewalld.helper(5).
- description (s): see the description tag in firewalld.helper(5).
- family (s): see the family tag in firewalld.helper(5).
- module (s): see the module tag in firewalld.helper(5).
- ports (a(ss)): array of port and protocol pairs. see the port tag in firewalld.helper(5).

possible errors: INVALID_HELPER

getHelpers() → as — returns an array of helper names (s) in the runtime configuration. for the permanent configuration, go see org.fedoraproject.FirewallD1.config.Methods.listHelpers 🌈
getIcmpTypeSettings(s: icmptype) → (sssas) — returns the runtime settings of the given icmptype. permanent settings live over at org.fedoraproject.FirewallD1.config.icmptype.Methods.getSettings. format is: version, name, description, and an array of destinations.
- version (s): see the version attribute of the icmptype tag in firewalld.icmptype(5).
- name (s): see the short tag in firewalld.icmptype(5).
- description (s): see the description tag in firewalld.icmptype(5).
- destinations (as): array that's either empty or contains the strings 'ipv4' or 'ipv6', see the destination tag in firewalld.icmptype(5).

possible errors: INVALID_ICMPTYPE

getLogDenied() → s — returns the LogDenied value. if LogDenied is enabled, then logging rules get added right before the reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules, and also final reject and drop rules in zones. possible values are: all, unicast, broadcast, multicast and off. the default value is off ⭐
getServiceSettings(s: service) → (sssa(ss)asa{ss}asa(ss)) — deprecated! use org.fedoraproject.FirewallD1.Methods.getServiceSettings2 instead 🙈
getServiceSettings2(s: service) → s{sv} — returns the runtime settings of the given service. for the permanent settings see org.fedoraproject.FirewallD1.config.service.Methods.getSettings2. settings come as a dictionary indexed by keywords, and the type of each value is below. if a value is empty it may just be omitted, nbd 💅
- version (s): see the version attribute of the service tag in firewalld.service(5).
- name (s): see the short tag in firewalld.service(5).
- description (s): see the description tag in firewalld.service(5).
- ports (a(ss)): array of port and protocol pairs. see the port tag in firewalld.service(5).
- module names (as): array of kernel netfilter helpers, see the module tag in firewalld.service(5).
- destinations (a{ss}): dictionary of {IP family : IP address} where the 'IP family' key can be either 'ipv4' or 'ipv6'. see the destination tag in firewalld.service(5).
- protocols (as): array of protocols, see the protocol tag in firewalld.service(5).
- source_ports (a(ss)): array of port and protocol pairs. see the source-port tag in firewalld.service(5).
- includes (as): array of service includes, see the include tag in firewalld.service(5).
- helpers (as): array of service helpers, see the helper tag in firewalld.service(5).

possible errors: INVALID_SERVICE

getZoneSettings(s: zone) → (sssbsasa(ss)asba(ssss)asasasasa(ss)b) — deprecated! use org.fedoraproject.FirewallD1.zone.Methods.getZoneSettings2 instead 🙈
listIcmpTypes() → as — returns an array of names (s) of icmp types in the runtime configuration. for the permanent configuration see org.fedoraproject.FirewallD1.config.Methods.listIcmpTypes 🌈
listServices() → as — returns an array of service names (s) in the runtime configuration. for permanent configuration see org.fedoraproject.FirewallD1.config.Methods.listServices ✨
queryPanicMode() → b — returns true if panic mode is enabled, false otherwise. reminder: in panic mode all incoming and outgoing packets are dropped 💀
reload() → Nothing — reloads the firewall rules and keeps state information. the current permanent configuration becomes the new runtime configuration, which means every runtime-only change you made before the reload is gone with the reload — unless it was also in the permanent configuration 😭
runtimeToPermanent() → Nothing — makes the runtime settings permanent. it replaces the permanent settings with the runtime settings for zones, policies, services, icmptypes, and direct (deprecated).

possible errors: RT_TO_PERM_FAILED

checkPermanentConfig() → Nothing — runs checks on the permanent configuration. super useful if somebody changed configuration files manually 👀

possible errors: any

setDefaultZone(s: zone) → Nothing — sets the default zone for connections and interfaces where no zone has been selected, to zone. setting the default zone changes the zone for the connections or interfaces that are using the default zone. and yeah, this is a runtime and permanent change, so it sticks 💅

possible errors: ZONE_ALREADY_SET, COMMAND_FAILED

setLogDenied(s: value) → Nothing — sets the LogDenied value to value. if LogDenied is enabled, then logging rules are added right before the reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules, and also final reject and drop rules in zones. possible values are: all, unicast, broadcast, multicast and off. the default value is off. this is a runtime and permanent change too 🎀

possible errors: ALREADY_SET, INVALID_VALUE

🦋 Signals 🦋

DefaultZoneChanged(s: zone) — emitted when the default zone has been changed to zone.
LogDeniedChanged(s: value) — emitted when the LogDenied value has been changed.
PanicModeDisabled() — emitted when panic mode has been deactivated.
PanicModeEnabled() — emitted when panic mode has been activated.
Reloaded() — emitted when firewalld has been reloaded. it also gets emitted for a complete reload, so yeah, she's consistent 💖

🧚 Properties 🧚

BRIDGE - b - (ro) — indicates whether the firewall has ethernet bridge support.
IPSet - b - (ro) — indicates whether the firewall has IPSet support.
IPSetTypes - as - (ro) — the supported IPSet types by ipset and firewalld 👑
IPv4 - b - (ro) — indicates whether the firewall has IPv4 support.
IPv4ICMPTypes - as - (ro) — the list of supported IPv4 ICMP types.

okay that's the main interface at the root path... and bestie we are so not done, there's a whole config side coming next 🌸

IPv6 — b — (ro) — tells you if the firewall can do IPv6 at all. yes/no energy ✨
IPv6_rpfilter — b — (ro) — is the reverse path filter test on an IPv6 packet turned on? if a reply to that packet would go out the same interface the packet came in on, the packet matches and gets accepted — otherwise, babes, it's dropped 💀
IPv6ICMPTypes — as — (ro) — the list of IPv6 ICMP types that are supported 🎀
nf_conntrach_helper_setting — b — (ro) — DEPRECATED. always False, it's giving legacy, don't get attached 🫶
nf_conntrack_helpers — a{sas} — (ro) — DEPRECATED. always hands you back an empty dictionary 📭
nf_nat_helpers — a{sas} — (ro) — DEPRECATED. also always an empty dictionary, twins fr 💅
interface_version — s — (ro) — the firewalld D-Bus interface version string 🔢
state — s — (ro) — where firewalld's at rn. can be INIT, FAILED, or RUNNING. in INIT it's starting up and initializing (main character getting ready ✨). in FAILED it fully started but hit a failure — not the vibe 😭
version — s — (ro) — the firewalld version string 🏷️

💖 org.fedoraproject.FirewallD1.ipset 💖

okay so the operations in this interface let you get, add, remove and query runtime ipset settings. want the permanent config instead? that's over at org.fedoraproject.FirewallD1.config.ipset bestie 👑

✨ Methods ✨

addEntry(s: ipset, s: entry) → as — adds a new entry to the ipset. the entry has to match the type of the ipset or it's not happening. if the ipset has the timeout option on, you literally can't see the entries because they're timing out automatically in the kernel, periodt. for the permanent version see org.fedoraproject.FirewallD1.config.ipset.Methods.addEntry.

Possible errors: INVALID_IPSET, IPSET_WITH_TIMEOUT

getEntries(s: ipset) → Nothing — grab all the entries added to the ipset. heads up: if the ipset is using the timeout option you cannot see the entries — they're auto-timing-out in the kernel, soz 🙈. return value is an array of entry. permanent version lives at org.fedoraproject.FirewallD1.config.ipset.Methods.getEntries.

Possible errors: INVALID_IPSET, IPSET_WITH_TIMEOUT

getIPSetSettings(s: ipset) → (ssssa{ss}as) — returns the runtime settings of the given ipset. for the permanent ones see org.fedoraproject.FirewallD1.config.ipset.Methods.getSettings. settings come in this format: version, name, description, type, dictionary of options and array of entries 📋
- version (s): see the version attribute of the ipset tag in firewalld.ipset(5).
- name (s): see the short tag in firewalld.ipset(5).
- description (s): see the description tag in firewalld.ipset(5).
- type (s): see the type attribute of the ipset tag in firewalld.ipset(5).
- options (a{ss}): dictionary of {option : value}. see the options tag in firewalld.ipset(5).
- entries (as): array of entries, see the entry tag in firewalld.ipset(5).

Possible errors: INVALID_IPSET

getIPSets() → as — returns an array of ipset names (s) in the runtime configuration. want the permanent config? go look at org.fedoraproject.FirewallD1.config.Methods.listIPSets 🌈
queryEntry(s: ipset, s: entry) → b — tells you whether that entry has been added to the ipset or not. permanent operation is at org.fedoraproject.FirewallD1.config.ipset.Methods.queryEntry.

Possible errors: INVALID_IPSET

queryIPSet(s: ipset) → b — tells you whether the ipset is even defined in the runtime configuration 👀
removeEntry(s: ipset, s: entry) → as — yeets an entry out of the ipset. permanent version: org.fedoraproject.FirewallD1.config.ipset.Methods.removeEntry.

Possible errors: INVALID_IPSET, IPSET_WITH_TIMEOUT

setEntries(as: entries) → Nothing — sets the list of entries to entries, permanently. permanent operation lives at org.fedoraproject.FirewallD1.config.ipset.Methods.setEntries. see the entry tag in firewalld.ipset(5) 📝

🔔 Signals 🔔

EntryAdded(s: ipset, s: entry) — fires when an entry has been added to the ipset 🎉
EntryRemoved(s: ipset, s: entry) — fires when an entry has been removed from the ipset bye bestie 👋

🚨 org.fedoraproject.FirewallD1.direct 🚨

DEPRECATED the direct interface is deprecated, no cap. it will be removed in a future release. it's superseded by policies, see firewalld.policies(5). don't build your whole personality on it 💀

this interface gives you a way more direct line to the firewall. it lets you do runtime manipulation of chains and rules. for the permanent configuration see the org.fedoraproject.FirewallD1.config.direct interface 🔧

✨ Methods ✨

addChain(s: ipv, s: table, s: chain) → Nothing — adds a new chain to table for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). make sure there's no other chain with this name already, bestie. and yes, there are already basic chains you can use with the direct methods — INPUT_direct for example. these chains get jumped into before the chains for zones, so every rule you put into INPUT_direct gets checked before the rules in zones. for permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.addChain.

Possible errors: INVALID_IPV, INVALID_TABLE, ALREADY_ENABLED, COMMAND_FAILED

addPassthrough(s: ipv, as: args) → Nothing — adds a tracked passthrough rule with the arguments args for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). the only valid commands in args are -A/--append, -I/--insert and -N/--new-chain. this method is (unlike the passthrough method) tracked, meaning firewalld actually remembers it 🧠. it's useful with org.fedoraproject.FirewallD1.Methods.runtimeToPermanent. permanent operation: org.fedoraproject.FirewallD1.config.direct.Methods.addPassthrough.

Possible errors: INVALID_IPV, ALREADY_ENABLED, COMMAND_FAILED

addRule(s: ipv, s: table, s: chain, i: priority, as: args) → Nothing — adds a rule with the arguments args to chain in table with priority for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). the priority is what orders the rules: priority 0 means the rule goes on top of the chain, and the higher the priority the further down the rule lands ⬇️. rules with the same priority are on the same level and the order between them is not fixed and may change 😭. so if you need a rule to land after another one, use a low priority for the first and a higher one for the following. for permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.addRule.

Possible errors: INVALID_IPV, INVALID_TABLE, ALREADY_ENABLED, COMMAND_FAILED

getAllChains() → a(sss) — gets all chains added to all tables, in the format: ipv, table, chain. this only concerns chains previously added with addChain. return value is an array of (ipv, table, chain). permanent operation is at org.fedoraproject.FirewallD1.config.direct.Methods.getAllChains 🧵
- ipv (s): either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).
- table (s): one of filter, mangle, nat, raw, security
- chain (s): name of a chain.
getAllPassthroughs() → a(sas) — gets all the tracked passthrough rules added in all ipv types, in the format: ipv, rule. only rules previously added with addPassthrough are in here. return value is an array of (ipv, array of arguments). permanent operation: org.fedoraproject.FirewallD1.config.direct.Methods.getAllPassthroughs 🎀
- ipv (s): either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).
- arguments (as): array of commands, parameters and other iptables/ip6tables/ebtables command line options.
getAllRules() → a(sssias) — gets all rules added to all chains in all tables, in the format: ipv, table, chain, priority, rule. this only concerns rules previously added with addRule. return value is an array of (ipv, table, chain, priority, array of arguments). permanent operation: org.fedoraproject.FirewallD1.config.direct.Methods.getAllRules 🔥
- ipv (s): either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).
- table (s): one of filter, mangle, nat, raw, security
- chain (s): name of a chain.
- priority (i): used to order rules.
- arguments (as): array of commands, parameters and other iptables/ip6tables/ebtables command line options.
getChains(s: ipv, s: table) → as — returns an array of chain names (s) added to table for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). only chains previously added with addChain count here. for permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.getChains ⛓️

Possible errors: INVALID_IPV, INVALID_TABLE

getPassthroughs(s: ipv) → aas — gets the tracked passthrough rules added in either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). only rules previously added with addPassthrough show up. return value is an array of (array of arguments). permanent operation: org.fedoraproject.FirewallD1.config.direct.Methods.getPassthroughs 🫶
- arguments (as): array of commands, parameters and other iptables/ip6tables/ebtables command line options.
getRules(s: ipv, s: table, s: chain) → a(ias) — gets all rules added to chain in table for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). only rules previously added with addRule are involved. return value is an array of (priority, array of arguments). for permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.getRules 📜
- priority (i): used to order rules.
- arguments (as): array of commands, parameters and other iptables/ip6tables/ebtables command line options.

Possible errors: INVALID_IPV, INVALID_TABLE

passthrough(s: ipv, as: args) → s — bestie, this one just hands your command straight to the firewall. ipv is either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). And args can be all iptables, ip6tables and ebtables command line arguments. And yes, args can be all iptables, ip6tables and ebtables command line arguments — she said it twice, she meant it twice ✨ This command is untracked, which means firewalld is not able to provide information about this command later on. So like… she does it and then forgets it ever happened 💀

Possible errors: COMMAND_FAILED

queryChain(s: ipv, s: table, s: chain) → b — Returns whether a chain exists in table, where ipv is either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). This concerns only chains previously added with addChain. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.queryChain.

Possible errors: INVALID_IPV, INVALID_TABLE

queryPassthrough(s: ipv, as: args) → b — Returns whether a tracked passthrough rule with the arguments args exists, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). This concerns only rules previously added with addPassthrough. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.queryPassthrough.

Possible errors: INVALID_IPV

queryRule(s: ipv, s: table, s: chain, i: priority, as: args) → b — Returns whether a rule with priority and the arguments args exists in chain in table, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). This concerns only rules previously added with addRule. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.queryRule.

Possible errors: INVALID_IPV, INVALID_TABLE

removeAllPassthroughs() → Nothing — Removes all passthrough rules previously added with addPassthrough. Like, every single one. Gone. Nothing returned, just vibes 🫶
removeChain(s: ipv, s: table, s: chain) → Nothing — Removes a chain from table, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). Only chains previously added with addChain can be removed this way. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.removeChain.

Possible errors: INVALID_IPV, INVALID_TABLE, NOT_ENABLED, COMMAND_FAILED

removePassthrough(s: ipv, as: args) → Nothing — Removes a tracked passthrough rule with arguments args, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). Only rules previously added with addPassthrough can be removed this way. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.removePassthrough.

Possible errors: INVALID_IPV, NOT_ENABLED, COMMAND_FAILED

removeRule(s: ipv, s: table, s: chain, i: priority, as: args) → Nothing — Removes a rule with priority and arguments args from chain in table, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). Only rules previously added with addRule can be removed this way. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.removeRule.

Possible errors: INVALID_IPV, INVALID_TABLE, NOT_ENABLED, COMMAND_FAILED

removeRules(s: ipv, s: table, s: chain) → Nothing — Removes all rules from chain in table, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). This concerns only rules previously added with addRule. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.removeRules.

Possible errors: INVALID_IPV, INVALID_TABLE

🦋 Signals 🦋

the way she tells you everything that happens, she's such a good communicator 💜

ChainAdded(s: ipv, s: table, s: chain) — Emitted when chain has been added into table, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).
ChainRemoved(s: ipv, s: table, s: chain) — Emitted when chain has been removed from table, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).
PassthroughAdded(s: ipv, as: args) — Emitted when a tracked passthrough rule with args has been added, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).
PassthroughRemoved(s: ipv, as: args) — Emitted when a tracked passthrough rule with args has been removed, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).
RuleAdded(s: ipv, s: table, s: chain, i: priority, as: args) — Emitted when a rule with args has been added to chain in table with priority, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).
RuleRemoved(s: ipv, s: table, s: chain, i: priority, as: args) — Emitted when a rule with args has been removed from chain in table with priority, for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).

🌈 org.fedoraproject.FirewallD1.zone 🌈

okay so this interface is where you get, add, remove and query the runtime zone's settings. Everything here is about the live, right-now state. For permanent settings see the org.fedoraproject.FirewallD1.config.zone interface — she keeps those two worlds very separate, periodt 💅

Methods

getZoneSettings2(s: zone) → a{sv} — Returns the runtime settings of the given zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getSettings2. The settings come back as a dictionary indexed by keywords — for the type of each value, scroll down bestie. If a value is empty it may be omitted, so don't panic if something's just… not there 🙈
- version (s): see version attribute of zone tag in firewalld.zone(5).
- name (s): see short tag in firewalld.zone(5).
- description (s): see description tag in firewalld.zone(5).
- target (s): see target attribute of zone tag in firewalld.zone(5).
- services (as): array of service names, see service tag in firewalld.zone(5).
- ports (a(ss)): array of port and protocol pairs. See port tag in firewalld.zone(5).
- icmp_blocks (as): array of icmp-blocks. See icmp-block tag in firewalld.zone(5).
- masquerade (b): see masquerade tag in firewalld.zone(5).
- forward_ports (a(ssss)): array of (port, protocol, to-port, to-addr). See forward-port tag in firewalld.zone(5).
- interfaces (as): array of interfaces. See interface tag in firewalld.zone(5).
- sources (as): array of source addresses. See source tag in firewalld.zone(5).
- rules_str (as): array of rich-language rules. See rule tag in firewalld.zone(5).
- protocols (as): array of protocols, see protocol tag in firewalld.zone(5).
- source_ports (a(ss)): array of port and protocol pairs. See source-port tag in firewalld.zone(5).
- icmp_block_inversion (b): see icmp-block-inversion tag in firewalld.zone(5).
- forward (b): see forward tag in firewalld.zone(5).
- ingress-priority (i): see ingress-priority tag in firewalld.zone(5).
- egress-priority (i): see egress-priority tag in firewalld.zone(5).

Possible errors: INVALID_ZONE

setZoneSettings2(s: zone, a{sv}: settings, i: timeout) — Sets the runtime settings of the given zone. For setting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.update2. settings is a dictionary indexed by keywords — types below, love. And to zero a value, pass an empty string or list (that's the trick, iykyk 🔥).
- services (as): array of service names, see service tag in firewalld.zone(5).
- ports (a(ss)): array of port and protocol pairs. See port tag in firewalld.zone(5).
- icmp_blocks (as): array of icmp-blocks. See icmp-block tag in firewalld.zone(5).
- masquerade (b): see masquerade tag in firewalld.zone(5).
- forward_ports (a(ssss)): array of (port, protocol, to-port, to-addr). See forward-port tag in firewalld.zone(5).
- interfaces (as): array of interfaces. See interface tag in firewalld.zone(5).
- sources (as): array of source addresses. See source tag in firewalld.zone(5).
- rules_str (as): array of rich-language rules. See rule tag in firewalld.zone(5).
- protocols (as): array of protocols, see protocol tag in firewalld.zone(5).
- source_ports (a(ss)): array of port and protocol pairs. See source-port tag in firewalld.zone(5).
- icmp_block_inversion (b): see icmp-block-inversion tag in firewalld.zone(5).
- forward (b): see forward tag in firewalld.zone(5).

Possible errors: INVALID_ZONE

addForwardPort(s: zone, s: port, s: protocol, s: toport, s: toaddr, i: timeout) → s — Adds the IPv4 forward port into zone. If zone is empty, use the default zone (she's got you, don't worry 🥺). The port can either be a single port number portid or a port range portid-portid. The protocol can either be tcp or udp. The destination address is a simple IP address. If timeout is non-zero, the operation will be active only for the amount of seconds — like a lil temporary slay ⏳ For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addForwardPort.

Returns name of zone to which the forward port was added.

Possible errors: INVALID_ZONE, INVALID_PORT, MISSING_PROTOCOL, INVALID_PROTOCOL, INVALID_ADDR, INVALID_FORWARD, ALREADY_ENABLED, INVALID_COMMAND

addIcmpBlock(s: zone, s: icmp, i: timeout) → s — Adds an ICMP block icmp into zone. The icmp is the one of the icmp types firewalld supports. To get a listing of supported icmp types use org.fedoraproject.FirewallD1.Methods.listIcmpTypes 🌸 If zone is empty, use the default zone. If timeout is non-zero, the operation will be active only for the amount of seconds. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addIcmpBlock.

Returns name of zone to which the ICMP block was added.

Possible errors: INVALID_ZONE, INVALID_ICMPTYPE, ALREADY_ENABLED, INVALID_COMMAND

addIcmpBlockInversion(s: zone) → s — Adds ICMP block inversion to zone. If zone is empty, use the default zone. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addIcmpBlockInversion.

Returns name of zone to which the ICMP block inversion was added.

Possible errors for that last one, since we got cut off mid-flow: INVALID_ZONE, ALREADY_ENABLED, INVALID_COMMAND. Carry on bestie 💅

addInterface(s: zone, s: interface) → s — okay so this is THE glow-up moment: you bind interface to zone, and from that point on literally all traffic going through that interface respects the zone's settings 🫶
- If zone is empty, it uses the default zone.
- Want it to survive a reboot? That's a permanent setting, go look at org.fedoraproject.FirewallD1.config.zone.Methods.addInterface.
- Returns the name of the zone to which the interface was bound.
- Possible errors: INVALID_ZONE, INVALID_INTERFACE, ALREADY_ENABLED, INVALID_COMMAND
addMasquerade(s: zone, i: timeout) → s — turns masquerade ON in zone ✨. If zone is empty, default zone it is.
- If timeout is non-zero, masquerading stays active for that many seconds ⏳.
- Permanent vibes? See org.fedoraproject.FirewallD1.config.zone.Methods.addMasquerade.
- Returns the name of the zone in which the masquerade was enabled.
- Possible errors: INVALID_ZONE, ALREADY_ENABLED, INVALID_COMMAND
addPort(s: zone, s: port, s: protocol, i: timeout) → s — drops a port into zone. Empty zone → default zone, as always 💖
- port can be a single port number or a port range written like portid-portid.
- protocol can be either tcp or udp.
- If timeout is non-zero, the whole thing is only active for that many seconds.
- For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addPort.
- Returns the name of the zone to which the port was added.
- Possible errors: INVALID_ZONE, INVALID_PORT, MISSING_PROTOCOL, INVALID_PROTOCOL, ALREADY_ENABLED, INVALID_COMMAND
addProtocol(s: zone, s: protocol, i: timeout) → s — adds a protocol into zone. Empty zone → default zone 🌸
- protocol can be any protocol your system supports, so pls go peek at /etc/protocols for the supported ones 👀
- If timeout is non-zero, the operation will be active only for the amount of seconds.
- For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addProtocol.
- Returns the name of the zone to which the protocol was added.
- Possible errors: INVALID_ZONE, INVALID_PROTOCOL, ALREADY_ENABLED, INVALID_COMMAND
addRichRule(s: zone, s: rule, i: timeout) → s — adds a rich language rule into zone 👑
- For the rich language rule syntax, please have a look at firewalld.direct(5).
- If zone is empty, use default zone.
- If timeout is non-zero, the operation will be active only for the amount of seconds.
- For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addRichRule.
- Returns the name of the zone to which the rich language rule was added.
- Possible errors: INVALID_ZONE, INVALID_RULE, ALREADY_ENABLED, INVALID_COMMAND
addService(s: zone, s: service, i: timeout) → s — adds a service into zone 💜
- If zone is empty, use default zone.
- If timeout is non-zero, the operation will be active only for the amount of seconds.
- Wanna know which services even exist? Use org.fedoraproject.FirewallD1.Methods.listServices ⭐
- For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addService.
- Returns the name of the zone to which the service was added.
- Possible errors: INVALID_ZONE, INVALID_SERVICE, ALREADY_ENABLED, INVALID_COMMAND
addSource(s: zone, s: source) → s — binds a source to zone, so from now on all traffic going from that source respects the zone's settings 🦋
- A source address or address range is either an IP address or a network IP address with a mask, for IPv4 or IPv6.
- For IPv4, the mask can be a network mask or a plain number.
- For IPv6, the mask is a plain number.
- Use of host names is not supported, bestie, don't even try 🚫
- If zone is empty, use default zone.
- For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addSource.
- Returns the name of the zone to which the source was bound.
- Possible errors: INVALID_ZONE, INVALID_ADDR, ALREADY_ENABLED, INVALID_COMMAND
addSourcePort(s: zone, s: port, s: protocol, i: timeout) → s — adds a source port into zone. Empty zone → default zone.
- port can be a single port number or a port range portid-portid.
- protocol can be either tcp or udp.
- If timeout is non-zero, the operation will be active only for the amount of seconds.
- For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addSourcePort.
- Returns the name of the zone to which the port was added.
- Possible errors: INVALID_ZONE, INVALID_PORT, MISSING_PROTOCOL, INVALID_PROTOCOL, ALREADY_ENABLED, INVALID_COMMAND
changeZone(s: zone, s: interface) → s — this one is deprecated 🫠 use org.fedoraproject.FirewallD1.zone.Methods.changeZoneOfInterface instead, fr fr.
changeZoneOfInterface(s: zone, s: interface) → s — moves an interface over to zone. Like, it's basically removeInterface(interface) followed by addInterface(zone, interface), that's the whole tea ☕
- If interface has not been bound to a zone before, it behaves like addInterface.
- If zone is empty, use default zone.
- Returns the name of the zone to which the interface was bound.
- Possible errors: INVALID_ZONE, ZONE_ALREADY_SET, ZONE_CONFLICT
changeZoneOfSource(s: zone, s: source) → s — same energy, but for a source. It's basically removeSource(source) followed by addSource(zone, source) 💫
- If source has not been bound to a zone before, it behaves like addSource.
- If zone is empty, use default zone.
- Returns the name of the zone to which the source was bound.
- Possible errors: INVALID_ZONE, ZONE_ALREADY_SET, ZONE_CONFLICT
getActiveZones() → a{sa{sas}} — returns a dictionary of all currently active zones, together with the interfaces and sources used in those zones. "Active" means a zone that has a binding to an interface or a source, periodt 💅
- The return value is a dictionary where keys are zone names (s) and values are again dictionaries, where the keys are either 'interfaces' or 'sources' and the values are arrays of interface names (s) or sources (s).
getForwardPorts(s: zone) → aas — returns the array of IPv4 forward ports previously added into zone. Empty zone → default zone.
- For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getForwardPorts.
- Return value is an array of 4-tuples, where each 4-tuple consists of (port, protocol, to-port, to-addr). Note that to-addr might be empty in the case of local forwarding 🫡
- Possible errors: INVALID_ZONE
getIcmpBlocks(s: zone) → as — returns the array of ICMP type (s) blocks previously added into zone. Empty zone → default zone.
- For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getIcmpBlocks.
- Possible errors: INVALID_ZONE
getIcmpBlockInversion(s: zone) → b — returns whether ICMP block inversion was previously added to zone (yes/no, iconic boolean behaviour ✨). Empty zone → default zone.
- For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getIcmpBlockInversion.
- Possible errors: INVALID_ZONE
getInterfaces(s: zone) → as — returns the array of interfaces (s) previously bound with zone. Empty zone → default zone.
- For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getInterfaces.
- Possible errors: INVALID_ZONE
getPorts(s: zone) → aas — returns the array of ports (2-tuple of port and protocol) previously enabled in zone. Empty zone → default zone.
- For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getPorts.
- Possible errors: INVALID_ZONE
getProtocols(s: zone) → as — returns the array of protocols (s) previously enabled in zone. Empty zone → default zone.
- For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getProtocols.
- Possible errors: INVALID_ZONE
getRichRules(s: zone) → as — returns the array of rich language rules (s) previously added into zone. Empty zone → default zone.
- For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getRichRules.
- Possible errors: INVALID_ZONE
getServices(s: zone) → as — returns the array of services (s) previously enabled in zone. Empty zone → default zone.
- For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getServices.
- Possible errors: INVALID_ZONE
getSourcePorts(s: zone) → aas — returns the array of source ports (2-tuple of port and protocol) previously enabled in zone. Empty zone → default zone.
- For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getSourcePorts.
- Possible errors: INVALID_ZONE
getSources(s: zone) → as — returns the array of sources (s) previously bound with zone. Empty zone → default zone.
- For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getSources.
- Possible errors: INVALID_ZONE
getZoneOfInterface(s: interface) → s — returns the name (s) of the zone the interface is bound to, or an empty string.
getZoneOfSource(s: source) → s — returns the name (s) of the zone the source is bound to, or an empty string.
getZones() → as — returns the array of names (s) of predefined zones known to the current runtime environment 🌈
- For the list of zones known to the permanent environment see org.fedoraproject.FirewallD1.config.Methods.listZones.
- The two lists (zones known to runtime vs. permanent environment) will contain the same zones in most cases, but they might differ — for example if org.fedoraproject.FirewallD1.config.Methods.addZone has been called recently, but firewalld has not been reloaded since then 👀
isImmutable(s: zone) → b — Deprecated. That's it, that's the whole description 💀
queryForwardPort(s: zone, s: port, s: protocol, s: toport, s: toaddr) → b — tells you whether the IPv4 forward port (port, protocol, toport, toaddr) is chillin' inside zone already. Leave zone empty and it just uses the default zone. Want the permanent version? That lives at org.fedoraproject.FirewallD1.config.zone.Methods.queryForwardPort 💅
- Possible errors: INVALID_ZONE, INVALID_PORT, MISSING_PROTOCOL, INVALID_PROTOCOL, INVALID_ADDR, INVALID_FORWARD
queryIcmpBlock(s: zone, s: icmp) → b — returns whether an ICMP block for icmp has been added into zone. Empty zone = default zone, bestie. Permanent flavour: org.fedoraproject.FirewallD1.config.zone.Methods.queryIcmpBlock.
- Possible errors: INVALID_ZONE, INVALID_ICMPTYPE
queryIcmpBlockInversion(s: zone) → b — returns whether ICMP block inversion has been added to zone. No zone? default zone, obviously 🎀 Permanent one: org.fedoraproject.FirewallD1.config.zone.Methods.queryIcmpBlockInversion.
- Possible errors: INVALID_ZONE, INVALID_ICMPTYPE
queryInterface(s: zone, s: interface) → b — asks whether interface has been bound to zone. Blank zone → default zone. For the permanent version see org.fedoraproject.FirewallD1.config.zone.Methods.queryInterface.
- Possible errors: INVALID_ZONE, INVALID_INTERFACE
queryMasquerade(s: zone) → b — returns whether masquerading is turned on in zone. Empty zone means default zone. Permanent version: org.fedoraproject.FirewallD1.config.zone.Methods.queryMasquerade.
- Possible errors: INVALID_ZONE
queryPort(s: zone, s: port, s: protocol) → b — returns whether port/protocol has been added in zone. Leave zone empty, get the default zone. Permanent vibes at org.fedoraproject.FirewallD1.config.zone.Methods.queryPort.
- Possible errors: INVALID_ZONE, INVALID_PORT, MISSING_PROTOCOL, INVALID_PROTOCOL
queryProtocol(s: zone, s: protocol) → b — returns whether protocol has been added in zone. Empty zone = default zone. Permanent: org.fedoraproject.FirewallD1.config.zone.Methods.queryProtocol.
- Possible errors: INVALID_ZONE, INVALID_PROTOCOL
queryRichRule(s: zone, s: rule) → b — returns whether the rich rule rule has been added in zone. Empty zone → default zone. Permanent operations: org.fedoraproject.FirewallD1.config.zone.Methods.queryRichRule.
- Possible errors: INVALID_ZONE, INVALID_RULE
queryService(s: zone, s: service) → b — returns whether service has been added for zone. Blank zone = default zone. Permanent: org.fedoraproject.FirewallD1.config.zone.Methods.queryService.
- Possible errors: INVALID_ZONE, INVALID_SERVICE
querySource(s: zone, s: source) → b — asks whether source has been bound to zone. Empty zone → default zone. Permanent version: org.fedoraproject.FirewallD1.config.zone.Methods.querySource.
- Possible errors: INVALID_ZONE, INVALID_ADDR
querySourcePort(s: zone, s: port, s: protocol) → b — returns whether port/protocol has been added in zone. Empty zone = default zone. Permanent energy: org.fedoraproject.FirewallD1.config.zone.Methods.querySourcePort.
- Possible errors: INVALID_ZONE, INVALID_PORT, MISSING_PROTOCOL, INVALID_PROTOCOL

okay now we're getting into the actual changing things era of this list and honestly? iconic 🙈

removeForwardPort(s: zone, s: port, s: protocol, s: toport, s: toaddr) → s — removes the IPv4 forward port (port, protocol, toport, toaddr) from zone. If zone is empty, it uses the default zone. Permanent version: org.fedoraproject.FirewallD1.config.zone.Methods.removeForwardPort.

Returns the name of the zone the forward port got removed from.

Possible errors: INVALID_ZONE, INVALID_PORT, MISSING_PROTOCOL, INVALID_PROTOCOL, INVALID_ADDR, INVALID_FORWARD, NOT_ENABLED, INVALID_COMMAND

removeIcmpBlock(s: zone, s: icmp) → s — removes the ICMP block icmp from zone. Empty zone → default zone. Permanent: org.fedoraproject.FirewallD1.config.zone.Methods.removeIcmpBlock.

Returns the name of the zone the ICMP block was removed from.

Possible errors: INVALID_ZONE, INVALID_ICMPTYPE, NOT_ENABLED, INVALID_COMMAND

removeIcmpBlockInversion(s: zone) → s — removes ICMP block inversion from zone. If zone is empty, default zone it is. Permanent: org.fedoraproject.FirewallD1.config.zone.Methods.removeIcmpBlockInversion.

Returns the name of the zone where the ICMP block inversion got removed from.

Possible errors: INVALID_ZONE, NOT_ENABLED, INVALID_COMMAND

removeInterface(s: zone, s: interface) → s — unbinds interface from zone. Heads up: if zone is empty, the interface gets removed from whatever zone it currently belongs to. Permanent version: org.fedoraproject.FirewallD1.config.zone.Methods.removeInterface.

Returns the name of the zone the interface was removed from.

Possible errors: INVALID_ZONE, INVALID_INTERFACE, NOT_ENABLED, INVALID_COMMAND

removeMasquerade(s: zone) → s — disables masquerading for zone. Empty zone = default zone. Permanent: org.fedoraproject.FirewallD1.config.zone.Methods.removeMasquerade.

Returns the name of the zone the masquerade was disabled for.

Possible errors: INVALID_ZONE, NOT_ENABLED, INVALID_COMMAND

removePort(s: zone, s: port, s: protocol) → s — yeets port/protocol out of zone. Empty zone → default zone. Permanent: org.fedoraproject.FirewallD1.config.zone.Methods.removePort.

Returns the name of the zone the port was removed from.

Possible errors: INVALID_ZONE, INVALID_PORT, MISSING_PROTOCOL, INVALID_PROTOCOL, NOT_ENABLED, INVALID_COMMAND

removeProtocol(s: zone, s: protocol) → s — removes protocol from zone. Blank zone, default zone. Permanent: org.fedoraproject.FirewallD1.config.zone.Methods.removeProtocol.

Returns the name of the zone the protocol was removed from.

Possible errors: INVALID_ZONE, INVALID_PROTOCOL, NOT_ENABLED, INVALID_COMMAND

removeRichRule(s: zone, s: rule) → s — removes a rich language rule from zone. If zone is empty, default zone. Permanent: org.fedoraproject.FirewallD1.config.zone.Methods.removeRichRule.

Returns the name of the zone the rich language rule was removed from.

Possible errors: INVALID_ZONE, INVALID_RULE, NOT_ENABLED, INVALID_COMMAND

removeService(s: zone, s: service) → s — removes service from zone. Empty zone = default zone. Permanent: org.fedoraproject.FirewallD1.config.zone.Methods.removeService.

Returns the name of the zone the service was removed from.

Possible errors: INVALID_ZONE, INVALID_SERVICE, NOT_ENABLED, INVALID_COMMAND

removeSource(s: zone, s: source) → s — unbinds source from zone. Careful bestie: if zone is empty, the source gets removed from the zone it belongs to. Permanent version: org.fedoraproject.FirewallD1.config.zone.Methods.removeSource.

Returns the name of the zone the source was removed from.

Possible errors: INVALID_ZONE, INVALID_ADDR, NOT_ENABLED, INVALID_COMMAND

removeSourcePort(s: zone, s: port, s: protocol) → s — removes port/protocol from zone. Empty zone → default zone. Permanent: org.fedoraproject.FirewallD1.config.zone.Methods.removeSourcePort.

Returns the name of the zone the source port was removed from.

Possible errors: INVALID_ZONE, INVALID_PORT, MISSING_PROTOCOL, INVALID_PROTOCOL, NOT_ENABLED, INVALID_COMMAND

🌈 Signals 🌈

these are the little notifications firewalld yells into the void whenever something changes, and honestly? the group chat energy is unmatched 💖

ForwardPortAdded(s: zone, s: port, s: protocol, s: toport, s: toaddr, i: timeout) — emitted when a forward port has been added to zone with timeout ✨
ForwardPortRemoved(s: zone, s: port, s: protocol, s: toport, s: toaddr) — emitted when a forward port has been removed from zone.
IcmpBlockAdded(s: zone, s: icmp, i: timeout) — emitted when an ICMP block for icmp has been added to zone with timeout.
IcmpBlockInversionAdded(s: zone) — emitted when ICMP block inversion has been added to zone.
IcmpBlockInversionRemoved(s: zone) — emitted when ICMP block inversion has been removed from zone.
IcmpBlockRemoved(s: zone, s: icmp) — emitted when an ICMP block for icmp has been removed from zone.
InterfaceAdded(s: zone, s: interface) — emitted when interface has been added to zone.
InterfaceRemoved(s: zone, s: interface) — emitted when interface has been removed from zone.
MasqueradeAdded(s: zone, i: timeout) — emitted when masquerade has been enabled for zone.
MasqueradeRemoved(s: zone) — emitted when masquerade has been disabled for zone.
PortAdded(s: zone, s: port, s: protocol, i: timeout) — emitted when port/protocol has been added to zone with timeout.
PortRemoved(s: zone, s: port, s: protocol) — emitted when port/protocol has been removed from zone.
ProtocolAdded(s: zone, s: protocol, i: timeout) — emitted when protocol has been added to zone with timeout.
ProtocolRemoved(s: zone, s: protocol) — emitted when protocol has been removed from zone.
RichRuleAdded(s: zone, s: rule, i: timeout) — emitted when a rich language rule has been added to zone with timeout.
RichRuleRemoved(s: zone, s: rule) — emitted when a rich language rule has been removed from zone.
ServiceAdded(s: zone, s: service, i: timeout) — emitted when service has been added to zone with timeout.
ServiceRemoved(s: zone, s: service) — emitted when service has been removed from zone.
SourceAdded(s: zone, s: source) — emitted when source has been added to zone.
SourcePortAdded(s: zone, s: port, s: protocol, i: timeout) — emitted when source-port/protocol has been added to zone with timeout.
SourcePortRemoved(s: zone, s: port, s: protocol) — fired the moment a source-port/protocol combo gets yeeted out of a zone. bye bestie 💅
SourceRemoved(s: zone, s: source) — fired when a source gets removed from a zone. gone, no notes 🦋
ZoneChanged(s: zone, s: interface) — Deprecated 👵 don't use her, she's retired
ZoneOfInterfaceChanged(s: zone, s: interface) — fired when the zone that an interface belongs to gets changed to zone. the glow-up is real ✨
ZoneOfSourceChanged(s: zone, s: source) — fired when the zone that a source belongs to gets changed to zone. same energy, different tag 🌸
ZoneUpdated2(s: zone, a{sv}: settings) — fired when a zone's settings get updated via org.fedoraproject.FirewallD1.zone.Methods.setZoneSettings2 🔥

💖 `org.fedoraproject.FirewallD1.policy` 💖

okay so this interface is your group chat for runtime policy settings — you can get them, add them, remove them, query them, all of it. Wanna touch the permanent side of things instead? That's a whole different bestie, go see the org.fedoraproject.FirewallD1.config.policy interface, iykyk 💅

✨ Methods ✨

getActivePolicies() → a{sa{sas}} — hands you a dictionary of all the currently active policies, plus the ingress zones and egress zones those policies are using. "Active" means the policy has a binding to an active ingress zone and an active egress zone — both, no half measures 🫶

The return value is a dictionary where the keys are policy names (s) and each value is another dictionary whose keys are either 'ingress_zones' or 'egress_zones', and those values are arrays of zone names (s). dictionary-inception, but make it fashion 🎀

getPolicies() → as — returns an array of names (s) of the predefined policies the current runtime environment knows about. Want the permanent-environment list instead? That's over in org.fedoraproject.FirewallD1.config.Methods.listPolicies. ngl these two lists will have the same policies in most cases, but they can differ — for example if org.fedoraproject.FirewallD1.config.Methods.addPolicy got called recently and firewalld hasn't been reloaded since then. runtime said yes, permanent hasn't caught up yet 😭
getPolicySettings(s: policy) → a{sv} — returns the runtime settings of the given policy. For permanent settings go see org.fedoraproject.FirewallD1.config.policy.Methods.getSettings. The settings come as a dictionary indexed by keywords — for the possible keywords check out org.fedoraproject.FirewallD1.config.Methods.addPolicy. And heads up: if a value is empty, it may just be omitted entirely. she's mysterious like that 🙈

Possible errors: INVALID_POLICY

setPolicySettings(s: policy, a{sv}: settings, i: timeout) — sets the runtime settings of the given policy. For setting permanent settings, go to org.fedoraproject.FirewallD1.config.policy.Methods.update. Settings are a dictionary indexed by keywords, and for the possible keywords see org.fedoraproject.FirewallD1.config.Methods.addPolicy. Wanna zero a value out? Pass an empty string or list, periodt 💅

⚠️ some keywords are not up for modification at runtime: description, name, priority, target, version. they're off-limits, don't even try bestie 💀

Possible errors: INVALID_POLICY

💫 Signals 💫

ForwardPortAdded(s: policy, a{sv}: settings) — fired when a policy's settings get updated via org.fedoraproject.FirewallD1.policy.Methods.setPolicySettings 🔥

🌈 `org.fedoraproject.FirewallD1.config` 🌈

this one lets you permanently add, remove and query zones, services and icmp types. permanent permanent, like it's going in the yearbook 📸

✨ Methods ✨

addIPSet(s: ipset, (ssssa{ss}as): settings) → o — adds an ipset with the given settings into the permanent configuration. The settings land in this format: version, name, description, type, dictionary of options, and array of entries. let's break it down 💖
- version (s): see the version attribute of the ipset tag in firewalld.ipset(5).
- name (s): see the short tag in firewalld.ipset(5).
- description (s): see the description tag in firewalld.ipset(5).
- type (s): see the type attribute of the ipset tag in firewalld.ipset(5).
- options (a{ss}): dictionary of {option : value}. See the options tag in firewalld.ipset(5).
- entries (as): array of entries, see the entry tag in firewalld.ipset(5).

Possible errors: NAME_CONFLICT, INVALID_NAME, INVALID_TYPE

addIcmpType(s: icmptype, (sssas): settings) → o — adds an icmptype with the given settings into the permanent configuration. Settings come as: version, name, description, and an array of destinations. It returns the object path of the brand-new icmp type 👑
- version (s): see the version attribute of the icmptype tag in firewalld.icmptype(5).
- name (s): see the short tag in firewalld.icmptype(5).
- description (s): see the description tag in firewalld.icmptype(5).
- destinations (as): an array, either empty or holding the strings 'ipv4' or 'ipv6', see the destination tag in firewalld.icmptype(5).

Possible errors: NAME_CONFLICT, INVALID_NAME, INVALID_TYPE

addService(s: service, (sssa(ss)asa{ss}asa(ss)): settings) → o — this function is deprecated 🙅‍♀️ use org.fedoraproject.FirewallD1.config.Methods.addService2 instead. she's old news bestie
addService2s: service, a{sv}: settings) → o — adds a service with the given settings into the permanent configuration. Settings are a dictionary indexed by keywords, and the type of each value is listed below. Wanna zero a value? Pass an empty string or list 💅
- version (s): see the version attribute of the service tag in firewalld.service(5).
- name (s): see the short tag in firewalld.service(5).
- description (s): see the description tag in firewalld.service(5).
- ports (a(ss)): array of port and protocol pairs. See the port tag in firewalld.service(5).
- module names (as): array of kernel netfilter helpers, see the module tag in firewalld.service(5).
- destinations (a{ss}): dictionary of {IP family : IP address} where the 'IP family' key is either 'ipv4' or 'ipv6'. See the destination tag in firewalld.service(5).
- protocols (as): array of protocols, see the protocol tag in firewalld.service(5).
- source_ports (a(ss)): array of port and protocol pairs. See the source-port tag in firewalld.service(5).
- includes (as): array of service includes, see the include tag in firewalld.service(5).
- helpers (as): array of service helpers, see the helper tag in firewalld.service(5).

Possible errors: NAME_CONFLICT, INVALID_NAME, INVALID_TYPE

addZone(s: zone, (sssbsasa(ss)asba(ssss)asasasasa(ss)b): settings) → o — deprecated alert 🚨 use org.fedoraproject.FirewallD1.config.Methods.addZone2 instead
addZone2(s: zone, a{sv}: settings) → o — adds a zone with the given settings into the permanent configuration. Settings are a dictionary indexed by keywords, types below. Zero a value by passing an empty string or list, easy 💅
- version (s): see the version attribute of the zone tag in firewalld.zone(5).
- name (s): see the short tag in firewalld.zone(5).
- description (s): see the description tag in firewalld.zone(5).
- target (s): see the target attribute of the zone tag in firewalld.zone(5).
- services (as): array of service names, see the service tag in firewalld.zone(5).
- ports (a(ss)): array of port and protocol pairs. See the port tag in firewalld.zone(5).
- icmp_blocks (as): array of icmp-blocks. See the icmp-block tag in firewalld.zone(5).
- masquerade (b): see the masquerade tag in firewalld.zone(5).
- forward_ports (a(ssss)): array of (port, protocol, to-port, to-addr). See the forward-port tag in firewalld.zone(5).
- interfaces (as): array of interfaces. See the interface tag in firewalld.zone(5).
- sources (as): array of source addresses. See the source tag in firewalld.zone(5).
- rules_str (as): array of rich-language rules. See the rule tag in firewalld.zone(5).
- protocols (as): array of protocols, see the protocol tag in firewalld.zone(5).
- source_ports (a(ss)): array of port and protocol pairs. See the source-port tag in firewalld.zone(5).
- icmp_block_inversion (b): see the icmp-block-inversion tag in firewalld.zone(5).
- forward (b): see the forward tag in firewalld.zone(5).
- ingress_priority (i): see the ingress-priority tag in firewalld.zone(5).
- egress_priority (i): see the egress-priority tag in firewalld.zone(5).

Possible errors: NAME_CONFLICT, INVALID_NAME, INVALID_TYPE

addPolicy(s: policy, a{sv}: settings) → o — adds a policy with the given settings into the permanent configuration. Settings are a dictionary indexed by keywords, types listed below — and if you omit a keyword, the default value gets used. no stress, defaults have your back 🫶
- description (s): see the description tag in firewalld.policy(5).
- egress_zones (as): array of zone names. See the egress-zone tag in firewalld.policy(5).
- forward_ports (a(ssss)): array of (port, protocol, to-port, to-addr). See the forward-port tag in firewalld.policy(5).
- icmp_blocks (as): array of icmp-blocks. See the icmp-block tag in firewalld.policy(5).
- ingress_zones (as): array of zone names. See the ingress-zone tag in firewalld.policy(5).
- masquerade (b): see the masquerade tag in firewalld.policy(5).
- ports (a(ss)): array of port and protocol pairs. See the port tag in firewalld.policy(5).
- priority (i): see the priority tag in firewalld.policy(5).
- protocols (as): array of protocols, see the protocol tag in firewalld.policy(5).
- rich_rules (as): array of rich-language rules. See the rule tag in firewalld.policy(5).
- services (as): array of service names, see the service tag in firewalld.policy(5).
- short (s): see the short tag in firewalld.policy(5).
- source_ports (a(ss)): array of port and protocol pairs. See the source-port tag in firewalld.policy(5).
- target (s): see the target attribute of the policy tag in firewalld.policy(5).
- version (s): see the version attribute of the policy tag in firewalld.policy(5).

Possible errors: NAME_CONFLICT, INVALID_NAME, INVALID_TYPE

getHelperByName(s: helper) → o — returns the object path (permanent configuration, obvs) of the helper with the given name. go find your helper bestie 💜

Possible errors: INVALID_HELPER

getHelperNames() → as — returns the list of helper names (permanent configuration). a whole roster of helpers, iconic 👑
getIPSetByName(s: ipset) → o — bestie, hand me an ipset name and I'll hand you back its object path in the permanent configuration. That's the on-disk version, not the live one, okay?
- Possible errors: INVALID_IPSET
getIPSetNames() → as — the full ✨list✨ of ipset names, straight from the permanent configuration.
getIcmpTypeByName(s: icmptype) → o — give me an icmptype name, I give you its object path (permanent configuration). simple as that 🫶
- Possible errors: INVALID_ICMPTYPE
getIcmpTypeNames() → as — every icmptype name in the permanent configuration. all of them. no cap.
getServiceByName(s: service) → o — service name in, object path (permanent configuration) out. 💅
- Possible errors: INVALID_SERVICE
getServiceNames() → as — the whole lineup of service names (permanent configuration).
getZoneByName(s: zone) → o — zone name in, object path (permanent configuration) out. iconic behavior.
- Possible errors: INVALID_ZONE
getZoneNames() → as — list of zone names (permanent configuration).
getZoneOfInterface(s: iface) → s — tells you which zone the iface is bound to. If it isn't bound to anything? You get an empty string, which is the void, which is lowkey tragic. 😭
getZoneOfSource(s: source) → s — same deal but for a source: the name of the zone it's bound to, or an empty string if it's out here unclaimed.
getPolicyByName(s: policy) → o — policy name → object path (permanent configuration). 🌸
- Possible errors: INVALID_POLICY
getPolicyNames() → as — list of policy names (permanent configuration). yes queen.
listHelpers() → ao — returns an array of object paths (o) of every helper in the permanent configuration. Want the live/runtime ones instead? That's org.fedoraproject.FirewallD1.Methods.getHelpers, different girl entirely.
listIPSets() → ao — array of object paths (o) of every ipset in permanent configuration. For the runtime lineup see org.fedoraproject.FirewallD1.ipset.Methods.getIPSets.
listIcmpTypes() → ao — array of object paths (o) of the icmp types in permanent configuration. Runtime version lives at org.fedoraproject.FirewallD1.Methods.listIcmpTypes.
listServices() → ao — array of object paths (o) of the services in permanent configuration. Runtime flex is org.fedoraproject.FirewallD1.Methods.listServices.
listZones() → ao — object paths of every zone the permanent environment knows about. For the zones the runtime environment knows about, go see org.fedoraproject.FirewallD1.zone.Methods.getZones. And bestie, listen: those two lists are gonna match in most cases, but they can differ — like if org.fedoraproject.FirewallD1.config.Methods.addZone was called a minute ago and firewalld hasn't been reloaded since. Two different timelines fr fr. ⏳
listPolicies() → ao — object paths of every policy in the permanent environment. Runtime list is over at org.fedoraproject.FirewallD1.policy.Methods.getPolicies. Again: usually identical, but they can drift — for example if org.fedoraproject.FirewallD1.config.Methods.addPolicy got called recently and firewalld hasn't been reloaded since then. 🌀

Signals

HelperAdded(s: helper) — fired when a helper has been added. new helper just dropped 💖
IPSetAdded(s: ipset) — fired when an ipset has been added. ✨
IcmpTypeAdded(s: icmptype) — fired when an icmptype has been added.
ServiceAdded(s: service) — fired when a service has been added. 🎀
ZoneAdded(s: zone) — fired when a zone has been added. new zone, who dis 👑

Properties

AllowZoneDrifting — s — (rw) — Deprecated. Reading it always gives you back "no". Writing to it? Ignored. It's giving ghost. 💀
AutomaticHelpers — s — (rw) — Deprecated. Also always returns "no" when ya get it, and setting it gets ignored. periodt.
CleanupModulesOnExit — s — (rw) — set this to yes or true and firewalld unloads all the firewall-related kernel modules when it stops. clean exit energy ✨
CleanupOnExit — s — (rw) — when firewalld stops, it cleans up all firewall rules. Set it to no or false and it leaves whatever rules are currently sitting there totally untouched. choose your fighter.
DefaultZone — s — (ro) — the default zone for connections or interfaces when nobody picked one — not NetworkManager, not initscripts, not the command line tool. it's the fallback bestie 🫶
FirewallBackend — s — (rw) — picks the firewalld backend for all rules except the direct interface. Valid options are; nftables, iptables. Default is nftables.

Note: the iptables backend is deprecated. It will be removed in a future release. don't get attached 😭

FlushAllOnReload — s — (rw) — flush all runtime rules on a reload. Valid options are; yes, no. nice little reset button 🌈
IPv6_rpfilter — b — (rw) — Deprecated. Go look at org.fedoraproject.FirewallD1.config.Properties.IPv6_rpfilter2 instead, she's the replacement.
IPv6_rpfilter2 — s — (rw) — says whether the reverse path filter (RFE 3704) test on a packet for IPv6 is enabled. 🔥
IndividualCalls — s — (ro) — tells you whether individual calls or combined -restore calls are being used. Turn it on and applying changes + starting the daemon takes longer, but it's great for debugging. trade-off queen.
LogDenied — s — (rw) — when LogDenied is enabled, logging rules get added right before the reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules, and also the final reject and drop rules in zones. Possible values are: all, unicast, broadcast, multicast and off. 👀
MinimalMark — i — (rw) — Deprecated. Ignored, no longer used. Marks aren't used internally anymore. rest in peace bestie 💀
RFC3964_IPv4 — s — (rw) — per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that correspond to IPv4 addresses that shouldn't be routed over the public internet. Valid options are; yes, no. 🌐
StrictForwardPorts — s — (rw) — set it to yes and the generated destination NAT (DNAT) rules will NOT accept traffic that was DNAT'd by other entities, e.g. docker. firewalld gets strict and won't allow published container ports until they're explicitly allowed via firewalld. Set it to no and docker (and podman) integrates seamlessly with firewalld — published container ports are implicitly allowed. pick your vibe 💅
NftablesFlowtable — s — (rw) — this may improve forwarded traffic throughput by enabling the nftables flowtable. It's a software fastpath, so it skips calling nftables rule evaluation for data packets. Its value is a space separated list of interfaces. zoom zoom 🦋
NftablesCounters — s — (rw) — set it to yes and every nftables rule gets a counter. Super useful for debugging, comes with a small performance cost. worth it imo.
NftablesTableOwner — s — (rw) — set it to yes and the generated nftables rule set is owned exclusively by firewalld. That stops other entities from mistakenly (or maliciously) messing with firewalld's rule set. But heads up: if you intentionally modify firewalld's rules, you'll have to set this to "no". no cap.

🚫 org.fedoraproject.FirewallD1.config.direct 🚫

DEPRECATED

The direct interface has been deprecated. It will be removed in a future release. It is superseded by policies, see firewalld.policies(5). ok so this whole thing is on its way out, don't build your whole personality on it 💀

Interface for permanent direct configuration, see also firewalld.direct(5). For runtime direct configuration see the org.fedoraproject.FirewallD1.direct interface.

Methods

addChain(s: ipv, s: table, s: chain) → Nothing — add a new chain to table for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). Make sure there's no other chain with this name already, bestie. There already exist basic chains to use with direct methods, for example the INPUT_direct chain. These chains are jumped into before chains for zones, i.e. every rule put into INPUT_direct gets checked before rules in zones. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.addChain.
- Possible errors: INVALID_IPV, INVALID_TABLE, ALREADY_ENABLED
addPassthrough(s: ipv, as: args) → Nothing — add a passthrough rule with the arguments args for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.addPassthrough.
- Possible errors: INVALID_IPV, ALREADY_ENABLED
addRule(s: ipv, s: table, s: chain, i: priority, as: args) → Nothing — add a rule with the arguments args to chain in table with priority for ipv being either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables). The priority orders the rules. Priority 0 means add the rule on top of the chain; with a higher priority the rule gets added further down. Rules with the same priority sit on the same level, and the order of those is not fixed and may change. So if you want to make absolutely sure a rule lands after another one, use a low priority for the first and a higher one for the following. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.addRule. ✨
- Possible errors: INVALID_IPV, INVALID_TABLE, ALREADY_ENABLED
getAllChains() → a(sss) — get all chains added to all tables, in the format: ipv, table, chain. This only concerns chains previously added with addChain. Return value is an array of (ipv, table, chain). For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.getAllChains.
- ipv (s): either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).
- table (s): one of filter, mangle, nat, raw, security
- chain (s): name of a chain.
getAllPassthroughs() → a(sas) — get all passthrough rules added in all ipv types, in the format: ipv, rule. This only concerns rules previously added with addPassthrough. Return value is an array of (ipv, array of arguments). For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.getAllPassthroughs. 🫶
- ipv (s): either ipv4 (iptables) or ipv6 (ip6tables) or eb (ebtables).
arguments (as) — an array of commands, parameters, and alllll the other iptables/ip6tables/ebtables command line options. that's the whole rule, babes 💖

getChains(s: ipv, s: table) → as

okay so this one hands you back an array of chains (s) that were added to table for ipv, where ipv is either ipv4 (that's iptables), ipv6 (that's ip6tables), or eb (that's ebtables). 🦋 heads up tho — this only covers chains you already added with addChain. nothing else, no sneaky extras. want the runtime version instead? go look at org.fedoraproject.FirewallD1.direct.Methods.getChains.

Possible errors: INVALID_IPV, INVALID_TABLE

getPassthroughs(s: ipv) → aas

Get the tracked passthrough rules that were added in either ipv4 (iptables), ipv6 (ip6tables), or eb (ebtables). again bestie, this is only the stuff you previously added with addPassthrough, nothing more. the return value is an array of (array of arguments). for the runtime behaviour see org.fedoraproject.FirewallD1.direct.Methods.getPassthroughs.

arguments (as) — an array of commands, parameters, and other iptables/ip6tables/ebtables command line options ✨

getRules(s: ipv, s: table, s: chain) → a(ias)

This one grabs all the rules added to chain in table for ipv being either ipv4 (iptables), ipv6 (ip6tables), or eb (ebtables). and yeah, you guessed it — only rules previously added with addRule count here. the return value is an array of (priority, array of arguments). runtime operation lives over at org.fedoraproject.FirewallD1.direct.Methods.getRules.

priority (i) — used to order rules 🌸
arguments (as) — an array of commands, parameters and other iptables/ip6tables/ebtables command line options.
Possible errors: INVALID_IPV, INVALID_TABLE

getSettings() → (a(sss)a(sssias)a(sas))

Get the settings of your permanent direct configuration, in the format: array of chains, array of rules, array of passthroughs. so like, the full trio 💅

chains (a(sss)) — array of (ipv, table, chain), see 'chain' in firewalld.direct(5).
rules (a(sssias)) — array of (ipv, table, chain, priority, array of arguments), see 'rule' in firewalld.direct(5).
passthroughs (a(sas)) — array of (ipv, array of arguments), see passthrough in firewalld.direct(5).

queryChain(s: ipv, s: table, s: chain) → b

Returns whether a chain exists in table for ipv being either ipv4 (iptables), ipv6 (ip6tables), or eb (ebtables). one (1) caveat bestie: this only concerns chains previously added with addChain. want the runtime flavour? org.fedoraproject.FirewallD1.direct.Methods.queryChain. 🫶

Possible errors: INVALID_IPV, INVALID_TABLE

queryPassthrough(s: ipv, as: args) → b

Returns whether a tracked passthrough rule with the arguments args exists for ipv being either ipv4 (iptables), ipv6 (ip6tables), or eb (ebtables). and no cap, this only concerns rules previously added with addPassthrough. runtime operation: org.fedoraproject.FirewallD1.direct.Methods.queryPassthrough.

Possible errors: INVALID_IPV

queryRule(s: ipv, s: table, s: chain, i: priority, as: args) → b

Returns whether a rule with priority and the arguments args exists in chain in table for ipv being either ipv4 (iptables), ipv6 (ip6tables), or eb (ebtables). only rules previously added with addRule are in scope here, obviously. runtime operation: org.fedoraproject.FirewallD1.direct.Methods.queryRule.

Possible errors: INVALID_IPV, INVALID_TABLE

removeChain(s: ipv, s: table, s: chain) → Nothing

Removes a chain from table for ipv being either ipv4 (iptables), ipv6 (ip6tables), or eb (ebtables). important, bestie: only chains previously added with addChain can be removed this way. runtime operation: org.fedoraproject.FirewallD1.direct.Methods.removeChain.

Possible errors: INVALID_IPV, INVALID_TABLE, NOT_ENABLED

removePassthrough(s: ipv, as: args) → Nothing

Removes a passthrough rule with arguments args for ipv being either ipv4 (iptables), ipv6 (ip6tables), or eb (ebtables). only rules previously added with addPassthrough can be removed this way, periodt. runtime operation: org.fedoraproject.FirewallD1.direct.Methods.removePassthrough.

Possible errors: INVALID_IPV, NOT_ENABLED

removeRule(s: ipv, s: table, s: chain, i: priority, as: args) → Nothing

Removes a rule with priority and arguments args from chain in table for ipv being either ipv4 (iptables), ipv6 (ip6tables), or eb (ebtables). only rules previously added with addRule can be removed this way. runtime operation: org.fedoraproject.FirewallD1.direct.Methods.removeRule. 🎀

Possible errors: INVALID_IPV, INVALID_TABLE, NOT_ENABLED

removeRules(s: ipv, s: table, s: chain) → Nothing

Removes all rules from chain in table for ipv being either ipv4 (iptables), ipv6 (ip6tables), or eb (ebtables). yes bestie, all of them 😭 and this concerns only rules previously added with addRule. runtime operation: org.fedoraproject.FirewallD1.direct.Methods.removeRules.

Possible errors: INVALID_IPV, INVALID_TABLE

update((a(sss)a(sssias)a(sas)): settings) → Nothing

Update the permanent direct configuration with the given settings. the settings come in the format: array of chains, array of rules, array of passthroughs. the whole trio, together, as one 💜

chains (a(sss)) — array of (ipv, table, chain), see 'chain' in firewalld.direct(5).
rules (a(sssias)) — array of (ipv, table, chain, priority, array of arguments), see 'rule' in firewalld.direct(5).
passthroughs (a(sas)) — array of (ipv, array of arguments), see passthrough in firewalld.direct(5).
Possible errors: INVALID_TYPE

🦋 Signals 🦋

Updated()

Emitted when the configuration has been updated. that's it, that's the signal ✨

org.fedoraproject.FirewallD1.config.ipset

Interface for permanent ipset configuration. also peep firewalld.ipset(5) for the full lore 📖

Methods

addEntry(s: entry) → Nothing

Permanently add entry to the list of entries of the ipset. see the entry tag in firewalld.ipset(5). for the runtime version see org.fedoraproject.FirewallD1.ipset.Methods.addEntry.

Possible errors: ALREADY_ENABLED

addOption(s: key, s: value) → Nothing

Permanently add (key, value) to the ipset. see the option tag in firewalld.ipset(5). 💅

Possible errors: ALREADY_ENABLED

getDescription() → s

Get the description of the ipset. see the description tag in firewalld.ipset(5).

getEntries() → as

Get the list of entries added to the ipset. see the entry tag in firewalld.ipset(5). for the runtime version see org.fedoraproject.FirewallD1.ipset.Methods.getEntries.

Possible errors: IPSET_WITH_TIMEOUT

getOptions() → a{ss}

Get a dictionary of the options set for the ipset. see the option tag in firewalld.ipset(5).

getSettings() → (ssssa{ss}as)

Return the permanent settings of the ipset. if you want the runtime settings instead, go to org.fedoraproject.FirewallD1.ipset.Methods.getIPSetSettings. the settings are in the format: version, name, description, type, dictionary of options, and array of entries. 🍓

version (s) — see the version attribute of the ipset tag in firewalld.ipset(5).
name (s) — see the short tag in firewalld.ipset(5).
description (s) — see the description tag in firewalld.ipset(5).
type (s) — see the type attribute of the ipset tag in firewalld.ipset(5).
options (a{ss}) — dictionary of {option : value}. see the options tag in firewalld.ipset(5).
entries (as) — array of entries, see the entry tag in firewalld.ipset(5).

getShort() → s

Get the name of the ipset. see the short tag in firewalld.ipset(5).

getType() → s

Get the type of the ipset. see the type attribute of the ipset tag in firewalld.ipset(5).

getVersion() → s

Get the version of the ipset. see the version attribute of the ipset tag in firewalld.ipset(5).

loadDefaults() → Nothing

Load the default settings for a built-in ipset. 🧚

Possible errors: NO_DEFAULTS

queryEntry(s: entry) → b

Returns whether entry has been added to the ipset. for the runtime version see org.fedoraproject.FirewallD1.ipset.Methods.queryEntry.

queryOption(s: key, s: value) → b

Returns whether (key, value) has been added to the options of the ipset.

remove() → Nothing

Remove a not built-in ipset. (built-ins, you cannot touch, bestie 💀)

Possible errors: BUILTIN_IPSET

removeEntry(s: entry) → Nothing

Permanently remove entry from the ipset. see the entry tag in firewalld.ipset(5). for the runtime version see org.fedoraproject.FirewallD1.ipset.Methods.removeEntry.

Possible errors: NOT_ENABLED

removeOption(s: key) → Nothing

Permanently remove key from the ipset. see the option tag in firewalld.ipset(5).

Possible errors: NOT_ENABLED

rename(s: name) → Nothing

Rename a not built-in ipset to name.

Possible errors: BUILTIN_IPSET

setDescription(s: description) → Nothing

Permanently set the description of the ipset to description. see the description tag in firewalld.ipset(5).

setEntries(as: entries) → Nothing

Permanently set the list of entries to entries. see the entry tag in firewalld.ipset(5). 🌈

setOptions(a{ss}: options) → Nothing

Permanently set the dict of options to options. see the option tag in firewalld.ipset(5).

setShort(s: short) → Nothing — sets the name of the ipset to short, permanently (as in, it actually gets written to disk, bestie, not just vibing in runtime 💾). The short tag lives in firewalld.ipset(5).
setType(s: ipset_type) → Nothing — permanently sets the type of the ipset to ipset_type. Peep the type attribute of the ipset tag in firewalld.ipset(5).
setVersion(s: version) → Nothing — permanently sets the version of the ipset to version. It's the version attribute of the ipset tag in firewalld.ipset(5), iykyk.
update((ssssa{ss}as): settings) → Nothing — updates the settings of the ipset to settings. And settings is shaped like this: version, name, description, type, a dictionary of options, and an array of entries. Let's break the whole vibe down:
- version (s): the version attribute of the ipset tag in firewalld.ipset(5). ✨
- name (s): the short tag in firewalld.ipset(5).
- description (s): the description tag in firewalld.ipset(5).
- type (s): the type attribute of the ipset tag in firewalld.ipset(5).
- options (a{ss}): a dictionary of {option : value}. See the options tag in firewalld.ipset(5).
- entries (as): an array of entries, see the entry tag in firewalld.ipset(5).

Possible errors: INVALID_TYPE 🚫

Signals 📡

Removed(s: name) — fired off when the ipset with name has been removed. bye bestie 🫶
Renamed(s: name) — emitted when the ipset got renamed to name — glow-up complete 💅
Updated(s: name) — emitted when the ipset with name has been updated. she's evolving ✨

Properties 🏷️

builtin — b — (ro) — True if the ipset is build-in, false otherwise. Born with it, no cap.
default — b — (ro) — True if the build-in ipset has its default settings. False if it's been modified. And it's always False for ipsets that aren't build-in. Periodt.
filename — s — (ro) — the name (including the .xml extension 💾) of the file where the configuration is stored.
name — s — (ro) — the name of the ipset.
path — s — (ro) — the path to the directory where the ipset configuration is stored. It should be either /usr/lib/firewalld/ipsets or /etc/firewalld/ipsets.