zone¶

The mandatory zone start and end tag defines the zone. This tag can only be used once in a zone configuration file. There are optional attributes for zones:

version="string"

target="ACCEPT|%%REJECT%%|DROP"

ingress-priority="priority"

egress-priority="priority"

interface¶

Is an optional empty-element tag and can be used several times. It can be used to bind an interface to a zone. You don't need this for NetworkManager-managed interfaces, because NetworkManager binds interfaces to zones automatically. See also 'How to set or change a zone for a connection?' in firewalld.zones(5). You can use it as a fallback mechanism for interfaces that can't be managed via NetworkManager. An interface entry has exactly one attribute:

name="string"

source¶

Is an optional empty-element tag and can be used several times. It can be used to bind a source address, address range, a MAC address or an ipset to a zone. A source entry has exactly one of these attributes:

address="address[/mask]"

mac="MAC"

ipset="ipset"

icmp-block-inversion¶

Is an optional empty-element tag and can be used only once in a zone configuration. This flag inverts the icmp block handling. Only enabled ICMP types are accepted and all others are rejected in the zone.

forward¶

Is an optional empty-element tag and can be used only once in a zone configuration. This flag enables intra-zone forwarding. When enabled, packets will be forwarded between interfaces or sources within a zone, even if the zone's target is not set to ACCEPT.

short¶

Is an optional start and end tag and is used to give a more readable name.

description¶

Is an optional start and end tag to have a description.

service¶

Is an optional empty-element tag and can be used several times to have more than one service entry enabled. A service entry has exactly one attribute:

name="string"

port¶

Is an optional empty-element tag and can be used several times to have more than one port entry. All attributes of a port entry are mandatory:

port="portid[-portid]"

protocol="tcp|udp|sctp|dccp"

protocol¶

Is an optional empty-element tag and can be used several times to have more than one protocol entry. All protocol has exactly one attribute:

value="string"

icmp-block¶

Is an optional empty-element tag and can be used several times to have more than one icmp-block entry. Each icmp-block tag has exactly one mandatory attribute:

name="string"

masquerade¶

Is an optional empty-element tag. It can be used only once. If it's present masquerading is enabled.

forward-port¶

Is an optional empty-element tag and can be used several times to have more than one port or packet forward entry. There are mandatory and also optional attributes for forward ports:

Mandatory attributes:

Optional attributes:

source-port¶

Is an optional empty-element tag and can be used several times to have more than one source port entry. All attributes of a source port entry are mandatory:

port="portid[-portid]"

protocol="tcp|udp|sctp|dccp"

rule¶

Is an optional element tag and can be used several times to have more than one rich language rule entry.

The general rule structure:

<rule [family="ipv4|ipv6"] [priority="priority"]>


    [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]


    [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ]


    [


        <service name="string"/> |


        <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |


        <protocol value="protocol"/> |


        <icmp-block name="icmptype"/> |


        <icmp-type name="icmptype"/> |


        <masquerade/> |


        <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/> |


        <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |


    ]


    [


        <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |


        <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>


    ]


    [ <audit> [<limit value="rate/duration"/>] </audit> ]


    [


        <accept> [<limit value="rate/duration"/>] </accept> |


        <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |


        <drop> [<limit value="rate/duration"/>] </drop> |


        <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>


    ]
</rule>


        

Rule structure for source black or white listing:

<rule [family="ipv4|ipv6"] [priority="priority"]>


    <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/>


    [


        <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |


        <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>


    ]


    [ <audit> [<limit value="rate/duration"/>] </audit> ]


    <accept> [<limit value="rate/duration"/>] </accept> |


    <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |


    <drop> [<limit value="rate/duration"/>] </drop>
</rule>


        

For a full description on rich language rules, please have a look at firewalld.richlanguage(5).