FIREWALLD.ZONE(5)

📦
version 2.5.2 · 14 versions
, in arch rolling, ubuntu stonking

🌸 FIREWALLD.ZONE(5) 🌸

okay bestie, gather round, because firewalld.zone is genuinely one of those pages that looks scary and is actually just a very organized girlie 💅 this is the section 5 manual page for firewalld.zone — the zone configuration files, periodt.

✨ NAME ✨

firewalld.zone — firewalld zone configuration files 💖

🎀 SYNOPSIS 🎀

/etc/firewalld/zones/zone.xml

/usr/lib/firewalld/zones/zone.xml

💖 DESCRIPTION 💖

so a firewalld zone configuration file is literally just where a zone keeps all its info. we're talking the zone description, services, ports, protocols, icmp-blocks, masquerade, forward-ports, intra-zone forwarding, and rich language rules — all of it living in an XML file format. very demure, very structured 🎀

the file name has to be zone_name.xml, and ngl the length of zone_name is currently capped at 17 chars. that's the limit, no cap 🧢

here's the whole structure of a zone configuration file, look at her:

<?xml version="1.0" encoding="utf-8"?>
<zone [version="versionstring"] [target="ACCEPT|%%REJECT%%|DROP"] [ingress-priority="priority"] [egress-priority="priority"]>
    [ <interface name="string"/> ]
    [ <source address="address[/mask]"|mac="MAC"|ipset="ipset"/> ]
    [ <icmp-block-inversion/> ]
    [ <forward/> ]

    [ <short>short description</short> ]
    [ <description>description</description> ]
    [ <service name="string"/> ]
    [ <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> ]
    [ <protocol value="protocol"/> ]
    [ <icmp-block name="string"/> ]
    [ <masquerade/> ]
    [ <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="IP address"]/> ]
    [ <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> ]
    [
        <rule [family="ipv4|ipv6"] [priority="priority"]>
            [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]
            [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ]
            [
                <service name="string"/> |
                <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
                <protocol value="protocol"/> |
                <icmp-block name="icmptype"/> |
                <icmp-type name="icmptype"/> |
                <masquerade/> |
                <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/>
            ]
            [
                <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
                <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
            ]
            [ <audit> [<limit value="rate/duration"/>] </audit> ]
            [
                <accept> [<limit value="rate/duration"/>] </accept> |
                <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
                <drop> [<limit value="rate/duration"/>] </drop> |
                <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
            ]
        </rule>
    ]

</zone>

so the config can hold all these tags and attributes. some of them are mandatory, the rest are optional — pick your faves 🌈

zone 👑

the mandatory zone start and end tag is what defines the zone. this tag can only be used once in a zone configuration file. there are optional attributes for zones, and they're giving:

  • version="string" — gives the zone a version ✨
  • target="ACCEPT|%%REJECT%%|DROP" — this one can accept, reject, or drop every single packet that doesn't match any rule (port, service, etc.). ACCEPT is special, bestie: packets that are not addressed to the host will be forwarded to their destination no matter what the zone's forward setting says, or any policies attached to the zone. if you don't specify it, the default behavior applies: ICMP gets accepted and literally everything else gets rejected 💀
  • ingress-priority="priority" — ingress priority for classifying traffic into a zone. a zone with a lower priority value gets considered before a zone with a higher priority value. this lets you do custom ordering of zone dispatch 👑
  • egress-priority="priority" — same as ingress-priority, but for egress classification 🦋

interface 🔌

it's an optional empty-element tag and you can use it several times. it binds an interface to a zone. you don't need this for NetworkManager-managed interfaces, because NetworkManager binds interfaces to zones automatically (see also 'How to set or change a zone for a connection?' in firewalld.zones(5)). you can use it as a fallback mechanism for interfaces that can't be managed via NetworkManager. an interface entry has exactly one attribute:

  • name="string" — the name of the interface to be bound to the zone 🎀

source 📍

optional empty-element tag, usable several times. it binds a source address, address range, a MAC address, or an ipset to a zone. a source entry has exactly one of these attributes:

  • address="address[/mask]" — the source is either an IP address or a network IP address with a mask, for IPv4 or IPv6. the network family (IPv4/IPv6) gets discovered automatically ✨ for IPv4 the mask can be a network mask or a plain number. for IPv6 the mask is a plain number. the use of host names is not supported 🙈
  • mac="MAC" — the source is a MAC address. it must be of the form XX:XX:XX:XX:XX:XX 💅
  • ipset="ipset" — the source is an ipset 🌸

icmp-block-inversion 🔄

optional empty-element tag, and it can only be used once in a zone configuration. this flag inverts the icmp block handling. only enabled ICMP types are accepted, and all the others get rejected in the zone. iconic behaviour, honestly 👑

forward ➡️

optional empty-element tag, usable only once in a zone configuration. this flag enables intra-zone forwarding. when it's on, packets get forwarded between interfaces or sources within a zone — even if the zone's target is not set to ACCEPT 🔥

short ✏️

optional start and end tag, used to give a more readable name 💖

description 📝

optional start and end tag, used to have a description 🎀

service 🛎️

optional empty-element tag, usable several times so you can have more than one service entry enabled. a service entry has exactly one attribute:

  • name="string" — the name of the service to be enabled. to get a list of valid service names, firewall-cmd --get-services can be used ✨

port 🚪

optional empty-element tag, usable several times to have more than one port entry. all attributes of a port entry are mandatory:

  • port="portid[-portid]" — the port can either be a single port number portid or a port range portid-portid 🌸
  • protocol="tcp|udp|sctp|dccp" — the protocol can either be tcp, udp, sctp or dccp 💅

protocol 📡

optional empty-element tag, usable several times to have more than one protocol entry. a protocol has exactly one attribute:

  • value="string" — the protocol can be any protocol supported by the system. go have a look at /etc/protocols for supported protocols 🦋

icmp-block 🚫

optional empty-element tag, usable several times to have more than one icmp-block entry. each icmp-block tag has exactly one mandatory attribute:

  • name="string" — the name of the Internet Control Message Protocol (ICMP) type to be blocked. to get a list of valid ICMP types, firewall-cmd --get-icmptypes can be used 😤

masquerade 🎭

optional empty-element tag. it can be used only once. if it's present, masquerading is enabled ✨

forward-port 🔀

optional empty-element tag, usable several times so you can have more than one port or packet forward entry. there are mandatory attributes and optional ones for forward ports:

Mandatory attributes:

the local port and protocol to be forwarded.

  • port="portid[-portid]" — the port can either be a single port number portid or a port range portid-portid 🌸
  • protocol="tcp|udp|sctp|dccp" — the protocol can either be tcp, udp, sctp or dccp 💅

Optional attributes:

the destination of the forward. for local forwarding, add to-port only. for remote forwarding, add to-addr and use to-port optionally if the destination port on the destination machine should be different 👑

  • to-port="portid[-portid]" — the destination port or port range to forward to. if omitted, the value of the port= attribute will be used altogether with the to-addr attribute 🎀
  • to-addr="address" — the destination IP address, either for IPv4 or IPv6 🌈

Special Note:

when used with a policy, it's impossible for the firewall backend to determine the egress zone. see section UNKNOWN DESTINATIONS in firewall-cmd(1) for more info 💀

source-port 📮

optional empty-element tag, usable several times to have more than one source port entry. all attributes of a source port entry are mandatory:

  • port="portid[-portid]" — the port can either be a single port number portid or a port range portid-portid 🌸
  • protocol="tcp|udp|sctp|dccp" — the protocol can either be tcp, udp, sctp or dccp 💅

rule 📜

optional element tag, usable several times to have more than one rich language rule entry. she's the main character of this page, fr fr.

the general rule structure:

<rule [family="ipv4|ipv6"] [priority="priority"]>
    [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]
    [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ]
    [
        <service name="string"/> |
        <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
        <protocol value="protocol"/> |
        <icmp-block name="icmptype"/> |
        <icmp-type name="icmptype"/> |
        <masquerade/> |
        <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/> |
        <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
    ]
    [
        <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
        <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
    ]
    [ <audit> [<limit value="rate/duration"/>] </audit> ]
    [
        <accept> [<limit value="rate/duration"/>] </accept> |
        <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
        <drop> [<limit value="rate/duration"/>] </drop> |
        <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
    ]
</rule>

rule structure for source black or white listing:

<rule [family="ipv4|ipv6"] [priority="priority"]>
    <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/>
    [
        <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
        <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
    ]
    [ <audit> [<limit value="rate/duration"/>] </audit> ]
    <accept> [<limit value="rate/duration"/>] </accept> |
    <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
    <drop> [<limit value="rate/duration"/>] </drop>
</rule>

That's the shape you're working with, bestie 💅 — and if you want the full lore on rich language rules, go read firewalld.richlanguage(5). It's giving ✨reference material✨, and honestly? It ate.

👀 SEE ALSO 👑

Okay so these are the besties this page hangs out with 🫶 go read them, they're all iconic in their own way:

🗒️ NOTES 🌸

The firewalld home page lives right here, screenshot it or whatever 📸:

💖 AUTHORS 💖

These are the literal developers behind the whole thing, show some respect bestie 👑

  • Thomas Woerner — <twoerner@redhat.com> — Developer
  • Jiri Popelka — <jpopelka@redhat.com> — Developer
  • Eric Garver — <eric@garver.life> — Developer

okay that's the whole page, and no cap you just read all of it 🌈🦋 this is from firewalld version 2.5.2, and the page footer is dated just FIREWALLD.ZONE(5) (yes, same as the page name, they were feeling minimal). go forth and configure your zones, main character 💅✨🎀

📦 where this page comes from