firewalld.zone man page on Oracle

Man page or keyword search:  
man Server   33470 pages
apropos Keyword Search (all sections)
Output format
Oracle logo
[printable version]

FIREWALLD.ZONE(5)		firewalld.zone		     FIREWALLD.ZONE(5)

NAME
       firewalld.zone - firewalld zone configuration files

SYNOPSIS
       /etc/firewalld/zones/zone.xml
       /usr/lib/firewalld/zones/zone.xml

DESCRIPTION
       A firewalld zone configuration file contains the information for a
       zone. These are the zone description, services, ports, icmp-blocks,
       masquerade, forward-ports and rich language rules in an XML file
       format. The file name has to be zone_name.xml where length of zone_name
       is currently limited to 17 chars.

       This is the structure of a zone configuration file:

	   <?xml version="1.0" encoding="utf-8"?>
	   <zone [version="versionstring"] [target="ACCEPT|%%REJECT%%|DROP"]>
	     [ <short>short description</short> ]
	     [ <description>description</description> ]
	     [ <interface name="string"/> ]
	     [ <source address="address[/mask]"/> ]
	     [ <service name="string"/> ]
	     [ <port port="portid[-portid]" protocol="tcp|udp"/> ]
	     [ <icmp-block name="string"/> ]
	     [ <masquerade/> ]
	     [ <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="ipv4address"]/> ]
	     [
	       <rule [family="ipv4|ipv6"]>
	       [ <source address="address[/mask]" [invert="bool"]/> ]
	       [ <destination address="address[/mask]" [invert="bool"]/> ]
	       [
		 <service name="string"/> |
		 <port port="portid[-portid]" protocol="tcp|udp"/> |
		 <protocol value="protocol"/> |
		 <icmp-block name="icmptype"/> |
		 <masquerade/> |
		 <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="address"]/>
	       ]
	       [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ]
	       [ <audit> [<limit value="rate/duration"/>] </audit> ]
	       [ <accept/> | <reject [type="rejecttype"]/> | <drop/> ]
	       </rule>
	     ]
	   </zone>

       The config can contain these tags and attributes. Some of them are
       mandatory, others optional.

   zone
       The mandatory zone start and end tag defines the zone. This tag can
       only be used once in a zone configuration file. There are optional
       attributes for zones:

       version="string"
	   To give the zone a version.

       target="ACCEPT|%%REJECT%%|DROP"
	   Can be used to accept, reject or drop every packet. The ACCEPT
	   target is used in the trusted zone, every packet will be accepted.
	   The %%REJECT%% target is used in the block zone, every packet will
	   be rejected with the default firewalld reject type. The DROP target
	   is used in the drop zone, every packet will be dropped. The default
	   target is {chain}_ZONE_{zone} and will be used if the target is not
	   specified. If other than the default target is used, all settings
	   except interface and source are ignored, because the first rule
	   created in firewall for this zone is 'jump to target'.

   short
       Is an optional start and end tag and is used to give a zone a more
       readable name.

   description
       Is an optional start and end tag to have a description for a zone.

   interface
       Is an optional empty-element tag and can be used several times. It can
       be used to bind an interface to a zone. An interface entry has exactly
       one attribute:

       name="string"
	   The name of the interface to be bound to the zone.

   source
       Is an optional empty-element tag and can be used several times. It can
       be used to bind a source address or source address range to a zone. A
       source entry has exactly one attribute:

       address="address[/mask]"
	   The source to be bound to the zone. The source is either an IP
	   address or a network IP address with a mask for IPv4 or IPv6. The
	   network family (IPv4/IPv6) will be automatically discovered. For
	   IPv4, the mask can be a network mask or a plain number. For IPv6
	   the mask is a plain number. The use of host names is not supported.

   service
       Is an optional empty-element tag and can be used several times to have
       more than one service entry enabled. A service entry has exactly one
       attribute:

       name="string"
	   The name of the service to be enabled. To get a list of valid
	   service names firewall-cmd --list=services can be used.

   port
       Is an optional empty-element tag and can be used several times to have
       more than one port entry. All attributes of a port entry are mandatory:

       port="portid[-portid]"
	   The port can either be a single port number portid or a port range
	   portid-portid.

       protocol="tcp|udp"
	   The protocol can either be tcp or udp.

   icmp-block
       Is an optional empty-element tag and can be used several times to have
       more than one icmp-block entry. Each icmp-block tag has exactly one
       mandatory attribute:

       name="string"
	   The name of the Internet Control Message Protocol (ICMP) type to be
	   blocked. To get a list of valid ICMP types firewall-cmd
	   --list=icmptypes can be used.

   masquerade
       Is an optional empty-element tag. It can be used only once in a zone
       configuration and is not usable for IPv6. If it's present masquerading
       is enabled for the zone. If you want to enable masquerading, you should
       enable it in the zone bound to the external interface.

   forward-port
       Is an optional empty-element tag and can be used several times to have
       more than one port or packet forward entry. This is for IPv4 only. Use
       rich language rules for IPv6. There are mandatory and also optional
       attributes for forward ports:

       Mandatory attributes:
	   The local port and protocol to be forwarded.

	   port="portid[-portid]"
	       The port can either be a single port number portid or a port
	       range portid-portid.

	   protocol="tcp|udp"
	       The protocol can either be tcp or udp.

       Optional attributes:
	   The destination of the forward. For local forwarding add to-port
	   only. For remote forwarding add to-addr and use to-port optionally
	   if the destination port on the destination machine should be
	   different.

	   to-port="portid[-portid]"
	       The destination port or port range to forward to. If omitted,
	       the value of the port= attribute will be used altogether with
	       the to-addr attribute.

	   to-addr="address"
	       The destination IPv4 IP address.

   rule
       Is an optional element tag and can be used several times to have more
       than one rich language rule entry.

       The general rule structure:

	   <rule [family="ipv4|ipv6"]/>
	     [ <source address="address[/mask]" [invert="bool"]/> ]
	     [ <destination address="address[/mask]" [invert="bool"]/> ]
	     [
	       <service name="string"/> |
	       <port port="portid[-portid]" protocol="tcp|udp"/> |
	       <protocol value="protocol"/> |
	       <icmp-block name="icmptype"/> |
	       <masquerade/> |
	       <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="address"]/>
	     ]
	     [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ]
	     [ <audit> [<limit value="rate/duration"/>] </audit> ]
	     [ <accept/> | <reject [type="rejecttype"]/> | <drop/> ]
	   </rule>

       Rule structure for source black or white listing:

	   <rule [family="ipv4|ipv6"]/>
	     <source address="address[/mask]" [family="bool"]/>
	     [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ]
	     [ <audit> [<limit value="rate/duration"/>] </audit> ]
	     <accept/> | <reject [type="rejecttype"]/> | <drop/>
	   </rule>

       For a full description on rich language rules, please have a look at
       firewalld.richlanguage(5).

SEE ALSO
       firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1),
       firewalld.conf(5), firewalld.direct(5), firewalld.icmptype(5),
       firewalld.lockdown-whitelist(5), firewall-offline-cmd(1),
       firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5),
       firewalld.zones(5)

NOTES
       firewalld home page at fedorahosted.org:
	   http://fedorahosted.org/firewalld/

       More documentation with examples:
	   http://fedoraproject.org/wiki/FirewallD

AUTHORS
       Thomas Woerner <twoerner@redhat.com>
	   Developer

       Jiri Popelka <jpopelka@redhat.com>
	   Developer

firewalld 0.3.9						     FIREWALLD.ZONE(5)
[top]

List of man pages available for Oracle

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Tweet
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
....................................................................
Vote for polarhome
Free Shell Accounts :: the biggest list on the net