NAME

       firewalld.zone - firewalld zone configuration files

SYNOPSIS

       /etc/firewalld/zones/zone.xml
       /usr/lib/firewalld/zones/zone.xml

DESCRIPTION

       A firewalld zone configuration file contains the information for a zone. These are the
       zone description, services, ports, protcols, icmp-blocks, masquerade, forward-ports and
       rich language rules in an XML file format. The file name has to be zone_name.xml where
       length of zone_name is currently limited to 17 chars.

       This is the structure of a zone configuration file:

           <?xml version="1.0" encoding="utf-8"?>
           <zone [version="versionstring"] [target="ACCEPT|%%REJECT%%|DROP"]>
             [ <short>short description</short> ]
             [ <description>description</description> ]
             [ <interface name="string"/> ]
             [ <source address="address[/mask]"|ipset="ipset"/> ]
             [ <service name="string"/> ]
             [ <port port="portid[-portid]" protocol="tcp|udp"/> ]
             [ <protcol value="protocol"/> ]
             [ <icmp-block name="string"/> ]
             [ <masquerade/> ]
             [ <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="ipv4address"]/> ]
             [
               <rule [family="ipv4|ipv6"]>
               [ <source address="address[/mask]"|ipset="ipset" [invert="True"]/> ]
               [ <destination address="address[/mask]" [invert="True"]/> ]
               [
                 <service name="string"/> |
                 <port port="portid[-portid]" protocol="tcp|udp"/> |
                 <protocol value="protocol"/> |
                 <icmp-block name="icmptype"/> |
                 <masquerade/> |
                 <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="address"]/>
               ]
               [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> ]
               [ <audit> [<limit value="rate/duration"/>] </audit> ]
               [
                 <accept> [<limit value="rate/duration"/>] </accept> |
                 <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
                 <drop> [<limit value="rate/duration"/>] </drop> |
                 <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
               ]
               </rule>
             ]
           </zone>

       The config can contain these tags and attributes. Some of them are mandatory, others
       optional.

   zone
       The mandatory zone start and end tag defines the zone. This tag can only be used once in a
       zone configuration file. There are optional attributes for zones:

       version="string"
           To give the zone a version.

       target="ACCEPT|%%REJECT%%|DROP"
           Can be used to accept, reject or drop every packet that doesn't match any rule (port,
           service, etc.). The ACCEPT target is used in trusted zone to accept every packet not
           matching any rule. The %%REJECT%% target is used in block zone to reject (with default
           firewalld reject type) every packet not matching any rule. The DROP target is used in
           drop zone to drop every packet not matching any rule. If the target is not specified,
           every packet not matching any rule will be rejected.

   short
       Is an optional start and end tag and is used to give a zone a more readable name.

   description
       Is an optional start and end tag to have a description for a zone.

   interface
       Is an optional empty-element tag and can be used several times. It can be used to bind an
       interface to a zone. You don't need this for NetworkManager-managed interfaces, because
       NetworkManager binds interfaces to zones automatically. See also 'How to set or change a
       zone for a connection?' in firewalld.zones(5). You can use it as a fallback mechanism for
       interfaces that can't be managed via NetworkManager. An interface entry has exactly one
       attribute:

       name="string"
           The name of the interface to be bound to the zone.

   source
       Is an optional empty-element tag and can be used several times. It can be used to bind a
       source address or source address range to a zone. This can also be a MAC address. A source
       entry has exactly one attribute:

       address="address[/mask]"
           The source to be bound to the zone. The source is either an IP address or a network IP
           address with a mask for IPv4 or IPv6 or a MAC address (no mask). The network family
           (IPv4/IPv6) will be automatically discovered. For IPv4, the mask can be a network mask
           or a plain number. For IPv6 the mask is a plain number. The use of host names is not
           supported.

   service
       Is an optional empty-element tag and can be used several times to have more than one
       service entry enabled. A service entry has exactly one attribute:

       name="string"
           The name of the service to be enabled. To get a list of valid service names
           firewall-cmd --list=services can be used.

   port
       Is an optional empty-element tag and can be used several times to have more than one port
       entry. All attributes of a port entry are mandatory:

       port="portid[-portid]"
           The port can either be a single port number portid or a port range portid-portid.

       protocol="tcp|udp"
           The protocol can either be tcp or udp.

   protocol
       Is an optional empty-element tag and can be used several times to have more than one
       protocol entry. All protocol has exactly one attribute:

       value="string"
           The protocol can be any protocol supported by the system. Please have a look at
           /etc/protocols for supported protocols.

   icmp-block
       Is an optional empty-element tag and can be used several times to have more than one
       icmp-block entry. Each icmp-block tag has exactly one mandatory attribute:

       name="string"
           The name of the Internet Control Message Protocol (ICMP) type to be blocked. To get a
           list of valid ICMP types firewall-cmd --list=icmptypes can be used.

   masquerade
       Is an optional empty-element tag. It can be used only once in a zone configuration and is
       not usable for IPv6. If it's present masquerading is enabled for the zone. If you want to
       enable masquerading, you should enable it in the zone bound to the external interface.

   forward-port
       Is an optional empty-element tag and can be used several times to have more than one port
       or packet forward entry. This is for IPv4 only. Use rich language rules for IPv6. There
       are mandatory and also optional attributes for forward ports:

       Mandatory attributes:
           The local port and protocol to be forwarded.

           port="portid[-portid]"
               The port can either be a single port number portid or a port range portid-portid.

           protocol="tcp|udp"
               The protocol can either be tcp or udp.

       Optional attributes:
           The destination of the forward. For local forwarding add to-port only. For remote
           forwarding add to-addr and use to-port optionally if the destination port on the
           destination machine should be different.

           to-port="portid[-portid]"
               The destination port or port range to forward to. If omitted, the value of the
               port= attribute will be used altogether with the to-addr attribute.

           to-addr="address"
               The destination IPv4 IP address.

   rule
       Is an optional element tag and can be used several times to have more than one rich
       language rule entry.

       The general rule structure:

           <rule [family="ipv4|ipv6"]>
             [ <source address="address[/mask]" [invert="True"]/> ]
             [ <destination address="address[/mask]" [invert="True"]/> ]
             [
               <service name="string"/> |
               <port port="portid[-portid]" protocol="tcp|udp"/> |
               <protocol value="protocol"/> |
               <icmp-block name="icmptype"/> |
               <masquerade/> |
               <forward-port port="portid[-portid]" protocol="tcp|udp" [to-port="portid[-portid]"] [to-addr="address"]/>
             ]
             [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ]
             [ <audit> [<limit value="rate/duration"/>] </audit> ]
             [
               <accept> [<limit value="rate/duration"/>] </accept> |
               <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
               <drop> [<limit value="rate/duration"/>] </drop> |
               <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
             ]

           </rule>

       Rule structure for source black or white listing:

           <rule [family="ipv4|ipv6"]>
             <source address="address[/mask]" [invert="True"]/>
             [ <log [prefix="prefixtext"] [level="emerg|alert|crit|err|warn|notice|info|debug"]/> [<limit value="rate/duration"/>] </log> ]
             [ <audit> [<limit value="rate/duration"/>] </audit> ]
             <accept> [<limit value="rate/duration"/>] </accept> |
             <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
             <drop> [<limit value="rate/duration"/>] </drop>
           </rule>

       For a full description on rich language rules, please have a look at
       firewalld.richlanguage(5).

SEE ALSO

       firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1), firewalld.conf(5),
       firewalld.direct(5), firewalld.icmptype(5), firewalld.lockdown-whitelist(5), firewall-
       offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5),
       firewalld.zones(5)

NOTES

       firewalld home page:
           http://www.firewalld.org

       More documentation with examples:
           http://fedoraproject.org/wiki/FirewallD

AUTHORS

       Thomas Woerner <twoerner@redhat.com>
           Developer

       Jiri Popelka <jpopelka@redhat.com>
           Developer