General Options¶

-h, --help

-V, --version

-q, --quiet

Status Options¶

--state

--reload

--complete-reload

--runtime-to-permanent

--check-config

--reset-to-defaults

Log Denied Options¶

--get-log-denied

--set-log-denied=value

Permanent Options¶

--permanent

Zone Options¶

--get-default-zone

--set-default-zone=zone

--get-active-zones

zone1


  interfaces: interface1 interface2 ..


  sources: source1 ..
zone2


  interfaces: interface3 ..
zone3


  sources: source2 ..
	      

[--permanent] --get-zones

[--permanent] --get-services

[--permanent] --get-icmptypes

[--permanent] --get-zone-of-interface=interface

[--permanent] --get-zone-of-source=source[/mask]|MAC|ipset:ipset

[--permanent] --info-zone=zone

zone


  interfaces: interface1 ..


  sources: source1 ..


  services: service1 ..


  ports: port1 ..


  protocols: protocol1 ..


  forward-ports:


        forward-port1


        ..


  source-ports: source-port1 ..


  icmp-blocks: icmp-type1 ..


  rich rules:


        rich-rule1


        ..


              

[--permanent] --list-all-zones

zone1


  interfaces: interface1 ..


  sources: source1 ..


  services: service1 ..


  ports: port1 ..


  protocols: protocol1 ..


  forward-ports:


        forward-port1


        ..


  icmp-blocks: icmp-type1 ..


  rich rules:


        rich-rule1


        ..
..


              

--permanent --new-zone=zone

--permanent --new-zone-from-file=filename [--name=zone]

--permanent --delete-zone=zone

--permanent --load-zone-defaults=zone

--permanent --path-zone=zone

Policy Options¶

[--permanent] --get-policies

[--permanent] --info-policy=policy

[--permanent] --list-all-policies

--permanent --new-policy=policy

--permanent --new-policy-from-file=filename [--name=policy]

--permanent --path-policy=policy

--permanent --delete-policy=policy

--permanent --load-policy-defaults=policy

Options to Adapt and Query Zones and Policies¶

Options in this section affect only one particular zone or policy. If used with --zone=zone or --policy=policy option, they affect the specified zone or policy. If both options are omitted, they affect the default zone (see --get-default-zone).

[--permanent] [--zone=zone] [--policy=policy] --list-all

--permanent [--zone=zone] [--policy=policy] --get-target

--permanent [--zone=zone] [--policy=policy] --set-target=target

--permanent [--zone=zone] [--policy=policy] --set-description=description

--permanent [--zone=zone] [--policy=policy] --get-description

--permanent [--zone=zone] [--policy=policy] --set-short=description

--permanent [--zone=zone] [--policy=policy] --get-short

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-services

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-service=service [--timeout=timeval]

# firewall-cmd --permanent --new-policy clientConntrack
# firewall-cmd --permanent --policy clientConntrack --add-ingress-zone HOST
# firewall-cmd --permanent --policy clientConntrack --add-egress-zone ANY
# firewall-cmd --permanent --policy clientConntrack --add-service tftp


              

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-service=service

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-service=service

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-ports

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-port=portid[-portid]/protocol [--timeout=timeval]

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-port=portid[-portid]/protocol

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-port=portid[-portid]/protocol

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-protocols

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-protocol=protocol [--timeout=timeval]

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-protocol=protocol

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-protocol=protocol

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-source-ports

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-source-port=portid[-portid]/protocol [--timeout=timeval]

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-source-port=portid[-portid]/protocol

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-source-port=portid[-portid]/protocol

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-icmp-blocks

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-icmp-block=icmptype [--timeout=timeval]

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-icmp-block=icmptype

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-icmp-block=icmptype

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-forward-ports

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] [--timeout=timeval]

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-masquerade [--timeout=timeval]

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-masquerade

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-masquerade

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --list-rich-rules

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --add-rich-rule='rule' [--timeout=timeval]

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --remove-rich-rule='rule'

[--permanent] [--zone=zone] [--permanent] [--policy=policy] --query-rich-rule='rule'

Options to Adapt and Query Zones¶

Options in this section affect only one particular zone. If used with --zone=zone option, they affect the specified zone. If the option is omitted, they affect default zone (see --get-default-zone).

[--permanent] [--zone=zone] --add-icmp-block-inversion

[--permanent] [--zone=zone] --remove-icmp-block-inversion

[--permanent] [--zone=zone] --query-icmp-block-inversion

[--permanent] [--zone=zone] --add-forward

[--permanent] [--zone=zone] --remove-forward

[--permanent] [--zone=zone] --query-forward

--permanent [--zone=zone] --get-priority

--permanent [--zone=zone] --set-priority

--permanent [--zone=zone] --get-ingress-priority

--permanent [--zone=zone] --set-ingress-priority

--permanent [--zone=zone] --get-egress-priority

--permanent [--zone=zone] --set-egress-priority

Options to Adapt and Query Policies¶

Options in this section affect only one particular policy. It's required to specify --policy=policy with these options.

--permanent --policy=policy --get-priority

--permanent --policy=policy --set-priority=priority

[--permanent] --policy=policy --list-ingress-zones

[--permanent] --policy=policy --add-ingress-zone=zone

[--permanent] --policy=policy --remove-ingress-zone=zone

[--permanent] --policy=policy --query-ingress-zone=zone

[--permanent] --policy=policy --list-egress-zones

[--permanent] --policy=policy --add-egress-zone=zone

[--permanent] --policy=policy --remove-egress-zone=zone

[--permanent] --policy=policy --query-egress-zone=zone

Options to Handle Bindings of Interfaces¶

Binding an interface to a zone means that this zone settings are used to restrict traffic via the interface.

Options in this section affect only one particular zone. If used with --zone=zone option, they affect the zone zone. If the option is omitted, they affect default zone (see --get-default-zone).

For a list of predefined zones use firewall-cmd --get-zones.

An interface name is a string up to 16 characters long, that may not contain ' ', '/', '!' and '*'.

[--permanent] [--zone=zone] --list-interfaces

[--permanent] [--zone=zone] --add-interface=interface

[--permanent] [--zone=zone] --change-interface=interface

[--permanent] [--zone=zone] --query-interface=interface

[--permanent] --remove-interface=interface

Options to Handle Bindings of Sources¶

Binding a source to a zone means that this zone settings will be used to restrict traffic from this source.

A source address or address range is either an IP address or a network IP address with a mask for IPv4 or IPv6 or a MAC address or an ipset with the ipset: prefix. For IPv4, the mask can be a network mask or a plain number. For IPv6 the mask is a plain number. The use of host names is not supported.

Options in this section affect only one particular zone. If used with --zone=zone option, they affect the zone zone. If the option is omitted, they affect default zone (see --get-default-zone).

For a list of predefined zones use firewall-cmd [--permanent] --get-zones.

[--permanent] [--zone=zone] --list-sources

[--permanent] [--zone=zone] --add-source=source[/mask]|MAC|ipset:ipset

[--zone=zone] --change-source=source[/mask]|MAC|ipset:ipset

[--permanent] [--zone=zone] --query-source=source[/mask]|MAC|ipset:ipset

[--permanent] --remove-source=source[/mask]|MAC|ipset:ipset

IPSet Options¶

--get-ipset-types

--permanent --new-ipset=ipset --type=type [--family=inet|inet6] [--option=key[=value]]

--permanent --new-ipset-from-file=filename [--name=ipset]

--permanent --delete-ipset=ipset

--permanent --load-ipset-defaults=ipset

[--permanent] --info-ipset=ipset

ipset


  type: type


  options: option1[=value1] ..


  entries: entry1 ..


              

[--permanent] --get-ipsets

--permanent --ipset=ipset --set-description=description

--permanent --ipset=ipset --get-description

--permanent --ipset=ipset --set-short=description

--permanent --ipset=ipset --get-short

[--permanent] --ipset=ipset --add-entry=entry

[--permanent] --ipset=ipset --remove-entry=entry

[--permanent] --ipset=ipset --query-entry=entry

[--permanent] --ipset=ipset --get-entries

[--permanent] --ipset=ipset --add-entries-from-file=filename

[--permanent] --ipset=ipset --remove-entries-from-file=filename

--permanent --path-ipset=ipset

Service Options¶

Options in this section affect only one particular service.

[--permanent] --info-service=service

service


  ports: port1 ..


  protocols: protocol1 ..


  source-ports: source-port1 ..


  helpers: helper1 ..


  destination: ipv1:address1 ..


              

The following options are only usable in the permanent configuration.

--permanent --new-service=service

--permanent --new-service-from-file=filename [--name=service]

--permanent --delete-service=service

--permanent --load-service-defaults=service

--permanent --path-service=service

--permanent --service=service --set-description=description

--permanent --service=service --get-description

--permanent --service=service --set-short=description

--permanent --service=service --get-short

--permanent --service=service --add-port=portid[-portid]/protocol

--permanent --service=service --remove-port=portid[-portid]/protocol

--permanent --service=service --query-port=portid[-portid]/protocol

--permanent --service=service --get-ports

--permanent --service=service --add-protocol=protocol

--permanent --service=service --remove-protocol=protocol

--permanent --service=service --query-protocol=protocol

--permanent --service=service --get-protocols

--permanent --service=service --add-source-port=portid[-portid]/protocol

--permanent --service=service --remove-source-port=portid[-portid]/protocol

--permanent --service=service --query-source-port=portid[-portid]/protocol

--permanent --service=service --get-source-ports

--permanent --service=service --add-helper=helper

--permanent --service=service --remove-helper=helper

--permanent --service=service --query-helper=helper

--permanent --service=service --get-service-helpers

--permanent --service=service --set-destination=ipv:address[/mask]

--permanent --service=service --remove-destination=ipv

--permanent --service=service --query-destination=ipv:address[/mask]

--permanent --service=service --get-destinations

--permanent --service=service --add-include=service

--permanent --service=service --remove-include=service

--permanent --service=service --query-include=service

--permanent --service=service --get-includes

Helper Options¶

Options in this section affect only one particular helper.

[--permanent] --info-helper=helper

helper


  family: family


  module: module


  ports: port1 ..


              

The following options are only usable in the permanent configuration.

--permanent --new-helper=helper --module=nf_conntrack_module [--family=ipv4|ipv6]

--permanent --new-helper-from-file=filename [--name=helper]

--permanent --delete-helper=helper

--permanent --load-helper-defaults=helper

--permanent --path-helper=helper

[--permanent] --get-helpers

--permanent --helper=helper --set-description=description

--permanent --helper=helper --get-description

--permanent --helper=helper --set-short=description

--permanent --helper=helper --get-short

--permanent --helper=helper --add-port=portid[-portid]/protocol

--permanent --helper=helper --remove-port=portid[-portid]/protocol

--permanent --helper=helper --query-port=portid[-portid]/protocol

--permanent --helper=helper --get-ports

--permanent --helper=helper --set-module=description

--permanent --helper=helper --get-module

--permanent --helper=helper --set-family=description

--permanent --helper=helper --get-family

Internet Control Message Protocol (ICMP) type Options¶

Options in this section affect only one particular icmptype.

[--permanent] --info-icmptype=icmptype

icmptype


  destination: ipv1 ..


              

The following options are only usable in the permanent configuration.

--permanent --new-icmptype=icmptype

--permanent --new-icmptype-from-file=filename [--name=icmptype]

--permanent --delete-icmptype=icmptype

--permanent --load-icmptype-defaults=icmptype

--permanent --icmptype=icmptype --set-description=description

--permanent --icmptype=icmptype --get-description

--permanent --icmptype=icmptype --set-short=description

--permanent --icmptype=icmptype --get-short

--permanent --icmptype=icmptype --add-destination=ipv

--permanent --icmptype=icmptype --remove-destination=ipv

--permanent --icmptype=icmptype --query-destination=ipv

--permanent --icmptype=icmptype --get-destinations

--permanent --path-icmptype=icmptype

Direct Options¶

DEPRECATED

The direct options give a more direct access to the firewall. These options require user to know basic iptables concepts, i.e. table (filter/mangle/nat/...), chain (INPUT/OUTPUT/FORWARD/...), commands (-A/-D/-I/...), parameters (-p/-s/-d/-j/...) and targets (ACCEPT/DROP/REJECT/...).

Direct options should be used only as a last resort when it's not possible to use for example --add-service=service or --add-rich-rule='rule'.

Warning: Direct rules behavior is different depending on the value of FirewallBackend. See CAVEATS in firewalld.direct(5).

The first argument of each option has to be ipv4 or ipv6 or eb. With ipv4 it will be for IPv4 (iptables(8)), with ipv6 for IPv6 (ip6tables(8)) and with eb for ethernet bridges (ebtables(8)).

[--permanent] --direct --get-all-chains

[--permanent] --direct --get-chains { ipv4 | ipv6 | eb } table

[--permanent] --direct --add-chain { ipv4 | ipv6 | eb } table chain

[--permanent] --direct --remove-chain { ipv4 | ipv6 | eb } table chain

[--permanent] --direct --query-chain { ipv4 | ipv6 | eb } table chain

[--permanent] --direct --get-all-rules

[--permanent] --direct --get-rules { ipv4 | ipv6 | eb } table chain

[--permanent] --direct --add-rule { ipv4 | ipv6 | eb } table chain priority args

[--permanent] --direct --remove-rule { ipv4 | ipv6 | eb } table chain priority args

[--permanent] --direct --remove-rules { ipv4 | ipv6 | eb } table chain

[--permanent] --direct --query-rule { ipv4 | ipv6 | eb } table chain priority args

--direct --passthrough { ipv4 | ipv6 | eb } args

[--permanent] --direct --get-all-passthroughs

[--permanent] --direct --get-passthroughs { ipv4 | ipv6 | eb }

[--permanent] --direct --add-passthrough { ipv4 | ipv6 | eb } args

[--permanent] --direct --remove-passthrough { ipv4 | ipv6 | eb } args

[--permanent] --direct --query-passthrough { ipv4 | ipv6 | eb } args

Lockdown Options¶

Local applications or services are able to change the firewall configuration if they are running as root (example: libvirt) or are authenticated using PolicyKit. With this feature administrators can lock the firewall configuration so that only applications on lockdown whitelist are able to request firewall changes.

The lockdown access check limits D-Bus methods that are changing firewall rules. Query, list and get methods are not limited.

The lockdown feature is a very light version of user and application policies for firewalld and is turned off by default.

--lockdown-on

--lockdown-off

--query-lockdown

Lockdown Whitelist Options¶

The lockdown whitelist can contain commands, contexts, users and user ids.

If a command entry on the whitelist ends with an asterisk '*', then all command lines starting with the command will match. If the '*' is not there the absolute command inclusive arguments must match.

Command paths for users are not always the same and depends on the users PATH. Some distributions symlink /bin to /usr/bin in which case it depends on the order they appear in the PATH environment variable.

The context is the security (SELinux) context of a running application or service. To get the context of a running application use ps -e --context.

Warning: If the context is unconfined, then this will open access for more than the desired application.

The lockdown whitelist entries are checked in the following order:

[--permanent] --list-lockdown-whitelist-commands

[--permanent] --add-lockdown-whitelist-command=command

[--permanent] --remove-lockdown-whitelist-command=command

[--permanent] --query-lockdown-whitelist-command=command

[--permanent] --list-lockdown-whitelist-contexts

[--permanent] --add-lockdown-whitelist-context=context

[--permanent] --remove-lockdown-whitelist-context=context

[--permanent] --query-lockdown-whitelist-context=context

[--permanent] --list-lockdown-whitelist-uids

[--permanent] --add-lockdown-whitelist-uid=uid

[--permanent] --remove-lockdown-whitelist-uid=uid

[--permanent] --query-lockdown-whitelist-uid=uid

[--permanent] --list-lockdown-whitelist-users

[--permanent] --add-lockdown-whitelist-user=user

[--permanent] --remove-lockdown-whitelist-user=user

[--permanent] --query-lockdown-whitelist-user=user

Panic Options¶

--panic-on

--panic-off

--query-panic

Example 1¶

Enable http service in default zone. This is runtime only change, i.e. effective until restart.

firewall-cmd --add-service=http
	

Example 2¶

Enable port 443/tcp immediately and permanently in default zone. To make the change effective immediately and also after restart we need two commands. The first command makes the change in runtime configuration, i.e. makes it effective immediately, until restart. The second command makes the change in permanent configuration, i.e. makes it effective after restart.

firewall-cmd --add-port=443/tcp
firewall-cmd --permanent --add-port=443/tcp