FIREWALLD.IPSET(5)

📦
version 2.5.2 · 14 versions
, in arch rolling, ubuntu stonking

💖 FIREWALLD.IPSET(5) 💖

okay bestie, pull up a chair, because today we're talking about firewalld.ipset — the manual for your firewalld ipset configuration files. yes, the .5 means it's a file-format situation, and yes it's exactly as iconic as it sounds. ✨

🌸 SYNOPSIS 🌸

/etc/firewalld/ipsets/ipset.xml
/usr/lib/firewalld/ipsets/ipset.xml

those are the two paths where these little beauties live. that's the whole synopsis. short, sweet, main character energy. 💅

🦋 DESCRIPTION 🦋

so a firewalld ipset configuration file is literally just the file that hands firewalld all the info it needs about an ip set. no thoughts, just data.

and the three things you actually care about? the most important configuration options are type, option and entry. those are the moment. periodt.

here's an example config file so you can see the whole structure with your own two eyes — it's giving "show don't tell" and we love that:

<?xml version="1.0" encoding="utf-8"?>
<ipset type="hash:ip">
  <short>My Ipset</short>
  <description>description</description>
  <entry>1.2.3.4</entry>
  <entry>1.2.3.5</entry>
  <entry>1.2.3.6</entry>
</ipset>

look at her. gorgeous. no notes. 😭💖

✨ OPTIONS ✨

so the config can contain these tags and attributes, and here's the tea: some of them are mandatory and others are optional. so you don't get to skip the required ones, bestie, that's not a vibe check you're gonna pass. 🙈

👑 ipset

the ipset start and end tag is mandatory and it's what defines the ipset itself. and the way that you can only use this tag once in an ipset configuration file. once! it's not a "more the merrier" situation.

there is one mandatory and also optional attributes for ipsets, and they go a little something like this:

  • type="string" — the mandatory type of the ipset. to get the list of supported types, just run firewall-cmd --get-ipset-types and let it spill. 💅
  • version="string" — use this to give the ipset a version. cute, right?

🎀 short

short is an optional start and end tag, and it exists purely to give an ipset a more readable name. it's the nickname. the pet name. the glow-up label. 🌸

🍓 description

description is an optional start and end tag so you can have a description for a ipset. write the lore. you deserve it. ✨

💫 option

option is an optional empty-element tag, and here's the part where it eats: you can use it several times to have more than one option. stack 'em. 👑

mostly all attributes of an option entry are mandatory:

  • name="string" — the mandatory option name string. cannot skip, won't skip.
  • value="string" — the optional value of the option. this one's flexible, she's chill.

and the supported options are literally these four, no more no less:

  • family: "inet"|"inet6"
  • timeout: integer
  • hashsize: integer
  • maxelem: integer

for more information on these options, please have a look at the ipset documentation — bestie, go read the source, it's important. 📚

🌈 entry

entry is an optional start and end tag and you can use it several times to have more than one entry entry. (yes, the manpage really says "entry entry" and honestly? iconic. we keep it. no cap.)

one thing to know: an entry entry does not have attributes. zero. none. it's just an entry, standing in front of a config, asking to be parsed. 💀

👀 SEE ALSO 👀

the whole friend group, in order:

iykyk, the whole squad is here. 🫶

📝 NOTES 📝

firewalld home page, the mothership, the origin story:

go say hi. it doesn't bite. 🌐

💜 AUTHORS 💜

the devs who made this happen, absolute legends, every single one:

  • Thomas Woerner <twoerner@redhat.com> — Developer
  • Jiri Popelka <jpopelka@redhat.com> — Developer
  • Eric Garver <eric@garver.life> — Developer

we stan. 😌✨

and that's the whole page, bestie!! this was firewalld 2.5.2, so if you're reading this on some other version, respectfully, double-check your own docs. stay slay, keep your ipsets valid, and remember: mandatory means mandatory. 💅🎀🦋

📦 where this page comes from