FIREWALLD.SERVICE(5)

📦
version 2.5.2 · 14 versions
, in arch rolling, ubuntu stonking

💖 FIREWALLD.SERVICE(5) 💖

okay bestie, gather round, because we're talking about firewalld.service — the man page alllll about firewalld service configuration files. yes it's manual section 5, yes it's about XML, no you cannot skip it. ✨

✨ NAME ✨

firewalld.service — the firewalld service configuration files, aka the little XML glow-ups that tell firewalld what a "service" even is 💅

🌸 SYNOPSIS 🌸

/etc/firewalld/services/service.xml
/usr/lib/firewalld/services/service.xml

those two paths. that's it. that's the whole vibe. one's the one you edit, one's the one the system ships. iykyk 🦋

🎀 DESCRIPTION 🎀

so a firewalld service configuration file is literally just a file that hands firewalld all the info about one service entry. and like, the parts that actually matter the most? ports, modules, and destination addresses. those are the main character options fr fr 👑

here's an example config so you can see what the structure looks like — study it, it's giving architecture:

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>My Service</short>
  <description>description</description>
  <port port="137" protocol="tcp"/>
  <protocol value="igmp"/>
  <module name="nf_conntrack_netbios_ns"/>
  <destination ipv4="224.0.0.251" ipv6="ff02::fb"/>
  <include service="ssdp"/>
  <helper name="ftp"/>
</service>

🧚 OPTIONS 🧚

the config can contain all these tags and attributes, okay? some of them are mandatory (no skipping, bestie) and others are optional (do it if you want, it's your life).

service 💜

the mandatory service start and end tag defines the service. and listen — this tag can only be used once in a service configuration file. one and done. periodt.

there are optional attributes for services, though:

  • version="string" — gives the service a version. cute little label, that's all ✨

short 🌈

an optional start and end tag, and it's there to give a service a more readable name. like a nickname but for a service entry.

description 🍓

an optional start and end tag so you can have a description for a service. put your thoughts in there, bestie.

port 🎀

an optional empty-element tag, and yes you can use it several times to have more than one port entry. stack 'em up. but heads up: all attributes of a port entry are mandatory:

  • port="string" — this string can be a single port number, or a port range in the form portid-portid, or it can be empty to match a protocol only 👀
  • protocol="string" — the protocol value can be tcp, udp, sctp or dccp. those four, that's the list.

so for compatibility with older firewalld versions, it's possible to add protocols with the port option where the port is empty. but with the addition of native protocol support in the service, this is not needed anymore. those entries will automatically be converted to protocols. and with the next modification of the service file, the enries will be listed as protocols. 💀 (yes the manpage says "enries", we don't fix it, we respect it)

protocol 🦋

an optional empty-element tag, usable several times to have more than one protocol entry. a protocol entry has exactly one attribute:

  • value="string" — the protocol can be any protocol supported by the system. please have a look at /etc/protocols for supported protocols, bestie, that's the source of truth 🌟

source-port 🌸

an optional empty-element tag, and you can use it several times to have more than one source port entry. all attributes of a source port entry are mandatory:

  • port="string" — the port string can be a single port number or a port range portid-portid
  • protocol="string" — the protocol value can either be tcp, udp, sctp or dccp

module 😭

okay so... this element is deprecated. not me having to deliver bad news. please use helper described below in the section called "helper". move on, glow up, use the new thing 💅

destination 🧚

an optional empty-element tag and it can be used only once. it specifies the destination network as a network IP address (optional with /mask), or a plain IP address. and listen, the use of hostnames is not recommended, because these will only be resolved at service activation and transmitted to the kernel. for more info on this element, please have a look at --destination in iptables(8) and ip6tables(8).

  • ipv4="address[/mask]" — the IPv4 destination address with optional mask
  • ipv6="address[/mask]" — the IPv6 destination address with optional mask

include 💖

an optional empty-element tag and it can be used several times to have more than one include entry. an include entry has exactly one attribute:

  • service="string" — the include can be any service supported by firewalld
Warning: firewalld will only check that the included service is a valid service if it's applied to a zone. ⚠️ don't @ me, that's just how it is

helper ✨

an optional empty-element tag and it can be used several times to have more than one helper entry. a helper entry has exactly one attribute:

  • name="string" — the helper can be any helper supported by firewalld

👑 SEE ALSO 👑

all the sibling manpages, they're a family and we love them:

firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1), firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5), firewalld.icmptype(5), firewall-offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5), firewalld.zones(5), firewalld.policy(5), firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5)

📝 NOTES 📝

firewalld home page:

go there. say hi. 🫶

💀 AUTHORS 💀

absolute legends, every single one:

  • Thomas Woerner <twoerner@redhat.com> — Developer
  • Jiri Popelka <jpopelka@redhat.com> — Developer
  • Eric Garver <eric@garver.life> — Developer

and that's the whole page, bestie!! 🎉 this was firewalld 2.5.2, and you just read FIREWALLD.SERVICE(5). slay, you're officially a firewalld service config girlie now. go forth and write some well-formed XML 💅💖✨🦋🌈🌸

📦 where this page comes from