FIREWALLD.POLICY-(5)

🎀 FIREWALLD.POLICY-SET-GATEWAY(5) 🎀

okay bestie, listen up — this is the manual page for firewalld.policy-set-gateway (manual section 5, so it's a config-format situation 💅). It's the Firewalld Policy Set Gateway. Let's get into it fr fr.

---

✨ NAME ✨

firewalld.policy-set-gateway — Firewalld Policy Set Gateway 🦋

---

🌸 DESCRIPTION 🌸

👑 Policy Set: Gateway

The Gateway policy set is, like, the cutest little starting point for a home router. No cap. It turns on masquerading, conntrack helpers, and forwarding between zones. It's giving "I just set up my first router and I'm thriving".

The zones this set uses are logically grouped together, and those group names are what the predefined policies refer to. So like, when a policy says "LAN", it's not out here guessing — it means the specific crew below. 🌈

                +-----------+                  +-----------+
                |    LAN    |                  |   WORLD   |
                |-----------|                  |-----------|
                | zones:    |                  | zones:    |
                |  internal |                  |  external |
                |  home     |                  |  public   |
                |  trusted  |                  |           |
                +-----------+                  +-----------+
                      |                              |
                      |                              |
                      |         +-----------+        |
                      +---------|   HOST    |--------+
                                |-----------|
                                | zones:    |
                      +---------|  HOST     |--------+
                      |         +-----------+        |
                      |                              |
                      |                              |
                +-----------+                  +-----------+
                |   WORK    |                  |    DMZ    |
                |-----------|                  |-----------|
                | zones:    |                  | zones:    |
                |  work     |                  |  dmz      |
                +-----------+                  +-----------+

🫶 Policies in the Gateway set

okay here's the lineup, one by one, no skipping 👇

• gateway-dmz-to-HOST — enables services that a gateway commonly needs, like dns and dhcp. ✨

File location: /usr/lib/firewalld/policies/gateway-dmz-to-HOST.xml

• gateway-lan-to-work — allows all traffic from LAN to work. It also enables masquerading and the common connection tracking helpers. 💖

File location: /usr/lib/firewalld/policies/gateway-lan-to-work.xml

• gateway-lan-to-world — allows all traffic from LAN to world. And here's the tea 🍓: if an interface is added to the "external" zone, then the traffic gets masqueraded. It also enables connection tracking helpers for common services, e.g. ftp.

File location: /usr/lib/firewalld/policies/gateway-lan-to-world.xml

• gateway-lan-to-HOST — enables services that a gateway commonly needs, like dns and dhcp. 🌸

File location: /usr/lib/firewalld/policies/gateway-lan-to-HOST.xml

• gateway-world-to-HOST — you can use this one to expose internal/dmz services to the world by adding a forward port to this policy. main character move, honestly 👑

Here's an example of adding a forward port. It forwards port 8080 to 10.1.1.42:80. 🔥

# firewall-cmd --permanent --policy gateway-world-to-HOST \
               --add-forward-port=port=8080:proto=tcp:toport=80:toaddr=10.1.1.42
# firewall-cmd --reload

File location: /usr/lib/firewalld/policies/gateway-world-to-HOST.xml

---

🦋 SEE ALSO 🦋

go read your sisters, bestie, they're all iconic 💜

firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1), firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5), firewalld.icmptype(5), firewall-offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5), firewalld.zones(5), firewalld.policy(5), firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5)

---

📝 NOTES 📝

• firewalld home page: http://firewalld.org 🌈

---

💖 AUTHORS 💖

shoutout to the devs, they ate and left no crumbs:

• Thomas Woerner <twoerner@redhat.com> — Developer
• Jiri Popelka <jpopelka@redhat.com> — Developer
• Eric Garver <eric@garver.life> — Developer

---

that's the whole vibe check bestie, you're officially fluent in the Gateway policy set 🧚 stay safe out there and keep those zones grouped 💅

firewalld 2.5.2 — this page is from firewalld version 2.5.2, mwah, love that for us ⭐