firewall-cmd

General Options

-h, --help

-V, --version

-q, --quiet

Status Options

--state

--reload

--complete-reload

Permanent Options

--permanent

Zone Options

--get-default-zone

--set-default-zone=zone

--get-active-zones

zone1
  interfaces: interface1 interface2 ..
  sources: source1 ..
zone2
  interfaces: interface3 ..
zone3
  sources: source2 ..
	      

[--permanent] --get-zones

[--permanent] --get-services

[--permanent] --get-icmptypes

[--permanent] --get-zone-of-interface=interface

[--permanent] --get-zone-of-source=source[/mask]

[--permanent] --list-all-zones

zone1
  interfaces: interface1 ..
  sources: source1 ..
  services: service1 ..
  ports: port1 ..
  forward-ports:
        forward-port1
        ..
  icmp-blocks: icmp-type1 ..
  rich rules:
        rich-rule1
        ..
..
              

Options to Adapt and Query Zones

Options in this section affect only one particular zone. If used with --zone=zone option, they affect the zone zone. If the option is omitted, they affect default zone (see --get-default-zone).

[--permanent] [--zone=zone] --list-all

[--permanent] [--zone=zone] --list-services

[--permanent] [--zone=zone] --add-service=service [--timeout=seconds]

[--permanent] [--zone=zone] --remove-service=service

[--permanent] [--zone=zone] --query-service=service

[--permanent] [--zone=zone] --list-ports

[--permanent] [--zone=zone] --add-port=portid[-portid]/protocol [--timeout=seconds]

[--permanent] [--zone=zone] --remove-port=portid[-portid]/protocol

[--permanent] [--zone=zone] --query-port=portid[-portid]/protocol

[--permanent] [--zone=zone] --list-icmp-blocks

[--permanent] [--zone=zone] --add-icmp-block=icmptype [--timeout=seconds]

[--permanent] [--zone=zone] --remove-icmp-block=icmptype

[--permanent] [--zone=zone] --query-icmp-block=icmptype

[--permanent] [--zone=zone] --list-forward-ports

[--permanent] [--zone=zone] --add-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] [--timeout=seconds]

[--permanent] [--zone=zone] --remove-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

[--permanent] [--zone=zone] --query-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

[--permanent] [--zone=zone] --add-masquerade [--timeout=seconds]

[--permanent] [--zone=zone] --remove-masquerade

[--permanent] [--zone=zone] --query-masquerade

[--permanent] [--zone=zone] --list-rich-rules

[--permanent] [--zone=zone] --add-rich-rule='rule' [--timeout=seconds]

[--permanent] [--zone=zone] --remove-rich-rule='rule'

[--permanent] [--zone=zone] --query-rich-rule='rule'

Options to Handle Bindings of Interfaces

Binding an interface to a zone means that this zone settings are used to restrict traffic via the interface.

Options in this section affect only one particular zone. If used with --zone=zone option, they affect the zone zone. If the option is omitted, they affect default zone (see --get-default-zone).

For a list of predefined zones use firewall-cmd --get-zones.

An interface name is a string up to 16 characters long, that may not contain ' ', '/', '!' and '*'.

[--permanent] [--zone=zone] --list-interfaces

[--permanent] [--zone=zone] --add-interface=interface

[--zone=zone] --change-interface=interface

[--permanent] [--zone=zone] --query-interface=interface

[--permanent] [--zone=zone] --remove-interface=interface

Options to Handle Bindings of Sources

Binding a source to a zone means that this zone settings will be used to restrict traffic from this source.

A source address or address range is either an IP address or a network IP address with a mask for IPv4 or IPv6. For IPv4, the mask can be a network mask or a plain number. For IPv6 the mask is a plain number. The use of host names is not supported.

Options in this section affect only one particular zone. If used with --zone=zone option, they affect the zone zone. If the option is omitted, they affect default zone (see --get-default-zone).

For a list of predefined zones use firewall-cmd [--permanent] --get-zones.

[--permanent] [--zone=zone] --list-sources

[--permanent] [--zone=zone] --add-source=source[/mask]

[--zone=zone] --change-source=source[/mask]

[--permanent] [--zone=zone] --query-source=source[/mask]

[--permanent] [--zone=zone] --remove-source=source[/mask]

Direct Options

The direct options give a more direct access to the firewall. These options require user to know basic iptables concepts, i.e. table (filter/mangle/nat/...), chain (INPUT/OUTPUT/FORWARD/...), commands (-A/-D/-I/...), parameters (-p/-s/-d/-j/...) and targets (ACCEPT/DROP/REJECT/...).

Direct options should be used only as a last resort when it's not possible to use for example --add-service=service or --add-rich-rule='rule'.

The first argument of each option has to be ipv4 or ipv6 or eb. With ipv4 it will be for IPv4 (iptables(8)), with ipv6 for IPv6 (ip6tables(8)) and with eb for ethernet bridges (ebtables(8)).

[--permanent] --direct --get-all-chains

[--permanent] --direct --get-chains { ipv4 | ipv6 | eb } table

[--permanent] --direct --add-chain { ipv4 | ipv6 | eb } table chain

[--permanent] --direct --remove-chain { ipv4 | ipv6 | eb } table chain

[--permanent] --direct --query-chain { ipv4 | ipv6 | eb } table chain

[--permanent] --direct --get-all-rules

[--permanent] --direct --get-rules { ipv4 | ipv6 | eb } table chain

[--permanent] --direct --add-rule { ipv4 | ipv6 | eb } table chain priority args

[--permanent] --direct --remove-rule { ipv4 | ipv6 | eb } table chain priority args

[--permanent] --direct --query-rule { ipv4 | ipv6 | eb } table chain priority args

--direct --passthrough { ipv4 | ipv6 | eb } args

--permanent --direct --get-all-passthroughs

--permanent --direct --get-passthroughs { ipv4 | ipv6 | eb }

--permanent --direct --add-passthrough { ipv4 | ipv6 | eb } args

--permanent --direct --remove-passthrough { ipv4 | ipv6 | eb } args

--permanent --direct --query-passthrough { ipv4 | ipv6 | eb } args

Lockdown Options

Local applications or services are able to change the firewall configuration if they are running as root (example: libvirt) or are authenticated using PolicyKit. With this feature administrators can lock the firewall configuration so that only applications on lockdown whitelist are able to request firewall changes.

The lockdown access check limits D-Bus methods that are changing firewall rules. Query, list and get methods are not limited.

The lockdown feature is a very light version of user and application policies for firewalld and is turned off by default.

--lockdown-on

--lockdown-off

--query-lockdown

Lockdown Whitelist Options

The lockdown whitelist can contain commands, contexts, users and user ids.

If a command entry on the whitelist ends with an asterisk '*', then all command lines starting with the command will match. If the '*' is not there the absolute command inclusive arguments must match.

Commands for user root and others is not always the same. Example: As root /bin/firewall-cmd is used, as a normal user /usr/bin/firewall-cmd is be used on Fedora.

The context is the security (SELinux) context of a running application or service. To get the context of a running application use ps -e --context.

Warning: If the context is unconfined, then this will open access for more than the desired application.

The lockdown whitelist entries are checked in the following order:

[--permanent] --list-lockdown-whitelist-commands

[--permanent] --add-lockdown-whitelist-command=command

[--permanent] --remove-lockdown-whitelist-command=command

[--permanent] --query-lockdown-whitelist-command=command

[--permanent] --list-lockdown-whitelist-contexts

[--permanent] --add-lockdown-whitelist-context=context

[--permanent] --remove-lockdown-whitelist-context=context

[--permanent] --query-lockdown-whitelist-context=context

[--permanent] --list-lockdown-whitelist-uids

[--permanent] --add-lockdown-whitelist-uid=uid

[--permanent] --remove-lockdown-whitelist-uid=uid

[--permanent] --query-lockdown-whitelist-uid=uid

[--permanent] --list-lockdown-whitelist-users

[--permanent] --add-lockdown-whitelist-user=user

[--permanent] --remove-lockdown-whitelist-user=user

[--permanent] --query-lockdown-whitelist-user=user

Panic Options

--panic-on

--panic-off

--query-panic

Example 1

Enable http service in default zone. This is runtime only change, i.e. effective until restart.

firewall-cmd --add-service=http
	

Example 2

Enable port 443/tcp immediately and permanently in default zone. To make the change effective immediately and also after restart we need two commands. The first command makes the change in runtime configuration, i.e. makes it effective immediately, until restart. The second command makes the change in permanent configuration, i.e. makes it effective after restart.

firewall-cmd --add-port=443/tcp
firewall-cmd --permanent --add-port=443/tcp