General Options¶

-h, --help

-V, --version

-q, --quiet

--default-config

--system-config

Status Options¶

--enabled

--disabled

--check-config

Lokkit Compatibility Options¶

These options are nearly identical to the options of lokkit.

--migrate-system-config-firewall=file

--addmodule=module

--removemodule

--remove-service=service

-s service, --service=service

-p portid[-portid]:protocol, --port=portid[-portid]:protocol

-t interface, --trust=interface

-m interface, --masq=interface

--custom-rules=[type:][table:]filename

--forward-port=if=interface:port=port:proto=protocol[:toport=destination port:][:toaddr=destination address]

--block-icmp=icmptype

Log Denied Options¶

--get-log-denied

--set-log-denied=value

Automatic Helpers Options¶

--get-automatic-helpers

--set-automatic-helpers=value

Zone Options¶

--get-default-zone

--set-default-zone=zone

--get-zones

--get-services

--get-icmptypes

--get-zone-of-interface=interface

--get-zone-of-source=source[/mask]|MAC|ipset:ipset

--info-zone=zone

zone


  interfaces: interface1 ..


  sources: source1 ..


  services: service1 ..


  ports: port1 ..


  protocols: protocol1 ..


  forward-ports:


        forward-port1


        ..


  source-ports: source-port1 ..


  icmp-blocks: icmp-type1 ..


  rich rules:


        rich-rule1


        ..


              

--list-all-zones

zone1


  interfaces: interface1 ..


  sources: source1 ..


  services: service1 ..


  ports: port1 ..


  protocols: protocol1 ..


  forward-ports:


        forward-port1


        ..


  source-ports: source-port1 ..


  icmp-blocks: icmp-type1 ..


  rich rules:


        rich-rule1


        ..
..


              

--new-zone=zone

--new-zone-from-file=filename [--name=zone]

--path-zone=zone

--delete-zone=zone

--zone=zone --set-description=description

--zone=zone --get-description

--zone=zone --set-short=description

--zone=zone --get-short

--zone=zone --get-target

--zone=zone --set-target=zone

Options to Adapt and Query Zones¶

Options in this section affect only one particular zone. If used with --zone=zone option, they affect the zone zone. If the option is omitted, they affect default zone (see --get-default-zone).

[--zone=zone] --list-all

[--zone=zone] --list-services

[--zone=zone] --add-service=service

[--zone=zone] --remove-service-from-zone=service

[--zone=zone] --query-service=service

[--zone=zone] --list-ports

[--zone=zone] --add-port=portid[-portid]/protocol

[--zone=zone] --remove-port=portid[-portid]/protocol

[--zone=zone] --query-port=portid[-portid]/protocol

[--zone=zone] --list-protocols

[--zone=zone] --add-protocol=protocol

[--zone=zone] --remove-protocol=protocol

[--zone=zone] --query-protocol=protocol

[--zone=zone] --list-icmp-blocks

[--zone=zone] --add-icmp-block=icmptype

[--zone=zone] --remove-icmp-block=icmptype

[--zone=zone] --query-icmp-block=icmptype

[--zone=zone] --list-forward-ports

[--zone=zone] --add-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

[--zone=zone] --remove-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

[--zone=zone] --query-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]]

[--zone=zone] --list-source-ports

[--zone=zone] --add-source-port=portid[-portid]/protocol

[--zone=zone] --remove-source-port=portid[-portid]/protocol

[--zone=zone] --query-source-port=portid[-portid]/protocol

[--zone=zone] --add-masquerade

[--zone=zone] --remove-masquerade

[--zone=zone] --query-masquerade

[--zone=zone] --list-rich-rules

[--zone=zone] --add-rich-rule='rule'

[--zone=zone] --remove-rich-rule='rule'

[--zone=zone] --query-rich-rule='rule'

Options to Handle Bindings of Interfaces¶

Binding an interface to a zone means that this zone settings are used to restrict traffic via the interface.

Options in this section affect only one particular zone. If used with --zone=zone option, they affect the zone zone. If the option is omitted, they affect default zone (see --get-default-zone).

For a list of predefined zones use firewall-cmd --get-zones.

An interface name is a string up to 16 characters long, that may not contain ' ', '/', '!' and '*'.

[--zone=zone] --list-interfaces

[--zone=zone] --add-interface=interface

[--zone=zone] --change-interface=interface

[--zone=zone] --query-interface=interface

[--zone=zone] --remove-interface=interface

Options to Handle Bindings of Sources¶

Binding a source to a zone means that this zone settings will be used to restrict traffic from this source.

A source address or address range is either an IP address or a network IP address with a mask for IPv4 or IPv6 or a MAC address or an ipset with the ipset: prefix. For IPv4, the mask can be a network mask or a plain number. For IPv6 the mask is a plain number. The use of host names is not supported.

Options in this section affect only one particular zone. If used with --zone=zone option, they affect the zone zone. If the option is omitted, they affect default zone (see --get-default-zone).

For a list of predefined zones use firewall-cmd --get-zones.

[--zone=zone] --list-sources

[--zone=zone] --add-source=source[/mask]|MAC|ipset:ipset

[--zone=zone] --change-source=source[/mask]|MAC|ipset:ipset

[--zone=zone] --query-source=source[/mask]|MAC|ipset:ipset

[--zone=zone] --remove-source=source[/mask]|MAC|ipset:ipset

IPSet Options¶

--new-ipset=ipset --type=ipset type [--option=ipset option[=value]]

--new-ipset-from-file=filename [--name=ipset]

--delete-ipset=ipset

--info-ipset=ipset

ipset


  type: type


  options: option1[=value1] ..


  entries: entry1 ..


              

--get-ipsets

--ipset=ipset --add-entry=entry

--ipset=ipset --remove-entry=entry

--ipset=ipset --query-entry=entry

--ipset=ipset --get-entries

--ipset=ipset --add-entries-from-file=filename

--ipset=ipset --remove-entries-from-file=filename

--ipset=ipset --set-description=description

--ipset=ipset --get-description

--ipset=ipset --set-short=description

--ipset=ipset --get-short

--path-ipset=ipset

Service Options¶

--info-service=service

service


  ports: port1 ..


  protocols: protocol1 ..


  source-ports: source-port1 ..


  modules: module1 ..


  destination: ipv1:address1 ..


              

--new-service=service

--new-service-from-file=filename [--name=service]

--delete-service=service

--path-service=service

--service=service --set-description=description

--service=service --get-description

--service=service --set-short=description

--service=service --get-short

--service=service --add-port=portid[-portid]/protocol

--service=service --remove-port=portid[-portid]/protocol

--service=service --query-port=portid[-portid]/protocol

--service=service --get-ports

--service=service --add-protocol=protocol

--service=service --remove-protocol=protocol

--service=service --query-protocol=protocol

--service=service --get-protocols

--service=service --add-source-port=portid[-portid]/protocol

--service=service --remove-source-port=portid[-portid]/protocol

--service=service --query-source-port=portid[-portid]/protocol

--service=service --get-source-ports

--service=service --add-module=module

--service=service --remove-module=module

--service=service --query-module=module

--service=service --get-modules

--service=service --set-destination=ipv:address[/mask]

--service=service --remove-destination=ipv

--service=service --query-destination=ipv:address[/mask]

--service=service --get-destinations

Helper Options¶

Options in this section affect only one particular helper.

--info-helper=helper

helper


  family: family


  module: module


  ports: port1 ..


              

The following options are only usable in the permanent configuration.

--new-helper=helper --module=nf_conntrack_module [--family=ipv4|ipv6]

--new-helper-from-file=filename [--name=helper]

--delete-helper=helper

--load-helper-defaults=helper

--path-helper=helper

--get-helpers

--helper=helper --set-description=description

--helper=helper --get-description

--helper=helper --set-short=description

--helper=helper --get-short

--helper=helper --add-port=portid[-portid]/protocol

--helper=helper --remove-port=portid[-portid]/protocol

--helper=helper --query-port=portid[-portid]/protocol

--helper=helper --get-ports

--helper=helper --set-module=description

--helper=helper --get-module

--helper=helper --set-family=description

--helper=helper --get-family

Internet Control Message Protocol (ICMP) type Options¶

--info-icmptype=icmptype

icmptype


  destination: ipv1 ..


              

--new-icmptype=icmptype

--new-icmptype-from-file=filename [--name=icmptype]

--delete-icmptype=icmptype

--icmptype=icmptype --set-description=description

--icmptype=icmptype --get-description

--icmptype=icmptype --set-short=description

--icmptype=icmptype --get-short

--icmptype=icmptype --add-destination=ipv

--icmptype=icmptype --remove-destination=ipv

--icmptype=icmptype --query-destination=ipv

--icmptype=icmptype --get-destinations

--path-icmptype=icmptype

Direct Options¶

The direct options give a more direct access to the firewall. These options require user to know basic iptables concepts, i.e. table (filter/mangle/nat/...), chain (INPUT/OUTPUT/FORWARD/...), commands (-A/-D/-I/...), parameters (-p/-s/-d/-j/...) and targets (ACCEPT/DROP/REJECT/...).

Direct options should be used only as a last resort when it's not possible to use for example --add-service=service or --add-rich-rule='rule'.

The first argument of each option has to be ipv4 or ipv6 or eb. With ipv4 it will be for IPv4 (iptables(8)), with ipv6 for IPv6 (ip6tables(8)) and with eb for ethernet bridges (ebtables(8)).

--direct --get-all-chains

--direct --get-chains { ipv4 | ipv6 | eb } table

--direct --add-chain { ipv4 | ipv6 | eb } table chain

--direct --remove-chain { ipv4 | ipv6 | eb } table chain

--direct --query-chain { ipv4 | ipv6 | eb } table chain

--direct --get-all-rules

--direct --get-rules { ipv4 | ipv6 | eb } table chain

--direct --add-rule { ipv4 | ipv6 | eb } table chain priority args

--direct --remove-rule { ipv4 | ipv6 | eb } table chain priority args

--direct --remove-rules { ipv4 | ipv6 | eb } table chain

--direct --query-rule { ipv4 | ipv6 | eb } table chain priority args

--direct --get-all-passthroughs

--direct --get-passthroughs { ipv4 | ipv6 | eb }

--direct --add-passthrough { ipv4 | ipv6 | eb } args

--direct --remove-passthrough { ipv4 | ipv6 | eb } args

--direct --query-passthrough { ipv4 | ipv6 | eb } args

Lockdown Options¶

Local applications or services are able to change the firewall configuration if they are running as root (example: libvirt) or are authenticated using PolicyKit. With this feature administrators can lock the firewall configuration so that only applications on lockdown whitelist are able to request firewall changes.

The lockdown access check limits D-Bus methods that are changing firewall rules. Query, list and get methods are not limited.

The lockdown feature is a very light version of user and application policies for firewalld and is turned off by default.

--lockdown-on

--lockdown-off

--query-lockdown

Lockdown Whitelist Options¶

The lockdown whitelist can contain commands, contexts, users and user ids.

If a command entry on the whitelist ends with an asterisk '*', then all command lines starting with the command will match. If the '*' is not there the absolute command inclusive arguments must match.

Commands for user root and others is not always the same. Example: As root /bin/firewall-cmd is used, as a normal user /usr/bin/firewall-cmd is be used on Fedora.

The context is the security (SELinux) context of a running application or service. To get the context of a running application use ps -e --context.

Warning: If the context is unconfined, then this will open access for more than the desired application.

The lockdown whitelist entries are checked in the following order:

--list-lockdown-whitelist-commands

--add-lockdown-whitelist-command=command

--remove-lockdown-whitelist-command=command

--query-lockdown-whitelist-command=command

--list-lockdown-whitelist-contexts

--add-lockdown-whitelist-context=context

--remove-lockdown-whitelist-context=context

--query-lockdown-whitelist-context=context

--list-lockdown-whitelist-uids

--add-lockdown-whitelist-uid=uid

--remove-lockdown-whitelist-uid=uid

--query-lockdown-whitelist-uid=uid

--list-lockdown-whitelist-users

--add-lockdown-whitelist-user=user

--remove-lockdown-whitelist-user=user

--query-lockdown-whitelist-user=user

Policy Options¶

--policy-server

--policy-desktop