FIREWALL-OFFLINE-C(1) firewall-offline-cmd FIREWALL-OFFLINE-C(1) (NAME) firewall-offline-cmd - firewalld (SYNOPSIS) firewall-offline-cmd [...] (DESCRIPTION) firewall-offline-cmd firewalld . firewalld . system-config-firewall/lokkit kickstart. lokkit firewalld . (custom rules) masquerading . . (OPTIONS) /etc/sysconfig/system-config-firewall . (Sequence options) 0 . ALREADY_ENABLED (11) NOT_ENABLED (12) ZONE_ALREADY_SET (16) . . . . UNKNOWN_ERROR (254) . : (General Options) -h, --help . -V, --version firewalld . -q, --quiet . --default-config firewalld. /usr/lib/firewalld . --system-config () firewalld. /etc/firewalld . (Status Options) --enabled . --disabled . --disabled firewalld . --check-config ( ) . XML . --system-config . --reset-to-defaults firewalld . Lokkit (Lokkit Compatibility Options) lokkit . --migrate-system-config-firewall=file system-config-firewall . --addmodule=module . helper netfilter . helper netfilter . helper netfilter firewalld.zone(5) . --removemodule . helper netfilter . helper netfilter . helper netfilter firewalld.zone(5) . --remove-service=service (zone) . . firewalld . firewall-cmd --get-services . -s service, --service=service . . firewalld . firewall-cmd --get-services . -p portid[-portid]:protocol, --port=portid[-portid]:protocol . . portid-portid . tcp udp sctp dccp . -t interface, --trust=interface . (trusted) . . trusted . NetworkManager ifcfg . nm-connection-editor trusted ifcfg "ZONE=trusted" . ifcfg firewalld . -m interface, --masq=interface . Masquerading . . IPv4 . --custom-rules=[type:][table:]filename . firewalld . --forward-port=if=interface:port=port:proto=protocol[:toport=destination port:][:toaddr=destination address] . IPv4 . . portid portid-portid . tcp udp sctp dccp . IP . --block-icmp=icmptype . ICMP icmptype . . icmptype icmp firewalld . icmp : firewall-cmd --get-icmptypes (Log Denied Options) --get-log-denied (log denied) . --set-log-denied=value reject drop INPUT FORWARD OUTPUT reject drop (link-layer) . : all unicast broadcast multicast off. off . . (Zone Options) --get-default-zone . --set-default-zone=zone . . --get-zones . --get-services . --get-icmptypes icmptype . --get-zone-of-interface=interface interface no zone . --get-zone-of-source=source[/mask]|MAC|ipset:ipset no zone . --info-zone=zone zone . : zone interfaces: interface1 .. sources: source1 .. services: service1 .. ports: port1 .. protocols: protocol1 .. forward-ports: forward-port1 .. source-ports: source-port1 .. icmp-blocks: icmp-type1 .. rich rules: rich-rule1 .. --list-all-zones . : zone1 interfaces: interface1 .. sources: source1 .. services: service1 .. ports: port1 .. protocols: protocol1 .. forward-ports: forward-port1 .. source-ports: source-port1 .. icmp-blocks: icmp-type1 .. rich rules: rich-rule1 .. .. --new-zone=zone . - : '_' '-' . --new-zone-from-file=filename [--name=zone] . --path-zone=zone . --delete-zone=zone . (Policy Options) --get-policies . --info-policy=policy policy . --list-all-policies . --new-policy=policy . - : '_' '-' . --new-policy-from-file=filename [--name=policy] . --path-policy=policy . --delete-policy=policy . --load-policy-defaults=policy . firewalld . . (Options to Adapt and Query Zones and Policies) . --zone=zone --policy=policy . ( --get-default-zone ). [--zone=zone] [--policy=policy] --list-all . [--zone=zone] [--policy=policy] --get-target (target). [--zone=zone] [--policy=policy] --set-target=target (target). target : default ACCEPT DROP REJECT target : CONTINUE ACCEPT DROP REJECT default REJECT ICMP . ACCEPT . [--zone=zone] [--policy=policy] --set-description=description . [--zone=zone] [--policy=policy] --get-description . [--zone=zone] [--policy=policy] --set-short=description . [--zone=zone] [--policy=policy] --get-short . [--zone=zone] [--policy=policy] --list-services . [--zone=zone] [--policy=policy] --add-service=service . . firewalld . : firewall-cmd --get-services. : (connection tracking helpers) . ( tftp) (outbound) . . (/ingress) . : # firewall-cmd --new-policy clientConntrack # firewall-cmd --policy clientConntrack --add-ingress-zone HOST # firewall-cmd --policy clientConntrack --add-egress-zone ANY # firewall-cmd --policy clientConntrack --add-service tftp [--zone=zone] --remove-service-from-zone=service zone. . . [--policy=policy] --remove-service-from-policy=service policy. . [--zone=zone] [--policy=policy] --query-service=service service . 0 1 . [--zone=zone] [--policy=policy] --list-ports . portid[-portid]/protocol . [--zone=zone] [--policy=policy] --add-port=portid[-portid]/protocol . . portid-portid . tcp udp sctp dccp . [--zone=zone] [--policy=policy] --remove-port=portid[-portid]/protocol . . [--zone=zone] [--policy=policy] --query-port=portid[-portid]/protocol . 0 1 . [--zone=zone] [--policy=policy] --list-protocols . [--zone=zone] [--policy=policy] --add-protocol=protocol . . timeval ( ) s () m () h () 20m 1h. . /etc/protocols . [--zone=zone] [--policy=policy] --remove-protocol=protocol . . [--zone=zone] [--policy=policy] --query-protocol=protocol . 0 1 . [--zone=zone] [--policy=policy] --list-icmp-blocks (ICMP) . [--zone=zone] [--policy=policy] --add-icmp-block=icmptype ICMP icmptype. . icmptype icmp firewalld . icmp : firewall-cmd --get-icmptypes [--zone=zone] [--policy=policy] --remove-icmp-block=icmptype ICMP icmptype. . [--zone=zone] [--policy=policy] --query-icmp-block=icmptype ICMP icmptype . 0 1 . [--zone=zone] [--policy=policy] --list-forward-ports IPv4 . IPv6 (rich language) . [--zone=zone] [--policy=policy] --add-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] IPv4. . portid portid-portid . tcp udp sctp dccp . IP . IPv6 (rich language) . : toaddr IP (IP forwarding) . [--zone=zone] [--policy=policy] --remove-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] IPv4. . IPv6 (rich language) . [--zone=zone] [--policy=policy] --query-forward-port=port=portid[-portid]:proto=protocol[:toport=portid[-portid]][:toaddr=address[/mask]] IPv4 . 0 1 . IPv6 (rich language) . [--zone=zone] [--policy=policy] --list-source-ports . portid[-portid]/protocol . [--zone=zone] [--policy=policy] --add-source-port=portid[-portid]/protocol . . portid-portid . tcp udp sctp dccp . [--zone=zone] [--policy=policy] --remove-source-port=portid[-portid]/protocol . . [--zone=zone] [--policy=policy] --query-source-port=portid[-portid]/protocol . 0 1 . [--zone=zone] [--policy=policy] --add-masquerade (masquerade) IPv4. () . IPv6 (rich language) . : IP (IP forwarding) . [--zone=zone] [--policy=policy] --remove-masquerade IPv4. IPv6 (rich language) . [--zone=zone] [--policy=policy] --query-masquerade IPv4 . 0 1 . IPv6 (rich language) . [--zone=zone] [--policy=policy] --list-rich-rules . [--zone=zone] [--policy=policy] --add-rich-rule='rule' 'rule'. . firewalld.richlanguage(5) . [--zone=zone] [--policy=policy] --remove-rich-rule='rule' 'rule'. . firewalld.richlanguage(5) . [--zone=zone] [--policy=policy] --query-rich-rule='rule' 'rule' . 0 1 . firewalld.richlanguage(5) . (Options to Adapt and Query Zones) . --zone=zone . ( --get-default-zone ). [--zone=zone] --add-icmp-block-inversion ICMP. [--zone=zone] --remove-icmp-block-inversion ICMP. [--zone=zone] --query-icmp-block-inversion ICMP . 0 1 . [--zone=zone] --add-forward (intra zone forwarding). [--zone=zone] --remove-forward . [--zone=zone] --query-forward . 0 1 . [--zone=zone] --get-priority . [--zone=zone] --set-priority . (ingress) (egress) . [--zone=zone] --get-ingress-priority (ingress) . [--zone=zone] --set-ingress-priority (ingress) . [--zone=zone] --get-egress-priority (egress) . [--zone=zone] --set-egress-priority (egress) . (Options to Adapt and Query Policies) . --policy=policy . --policy=policy --get-priority . --policy=policy --set-prioritypriority . . -32768 32767 -1 0 . (< 0) . (> 0) . --policy=policy --list-ingress-zones . --policy=policy --add-ingress-zone=zone . . firewalld : HOST ANY. HOST ( firewalld ) . ANY . (wild card) . - HOST . --policy=policy --remove-ingress-zone=zone . . --policy=policy --query-ingress-zone=zone zone . 0 1 . --policy=policy --list-egress-zones . --policy=policy --add-egress-zone=zone . . firewalld : HOST ANY. HOST ANY --add-ingress-zone . --policy=policy --remove-egress-zone=zone . . --policy=policy --query-egress-zone=zone zone . 0 1 . --policy=policy|--policy-set=policy-set --add-disable . . --policy=policy|--policy-set=policy-set --remove-disable . --policy=policy --query-disable . (Options to Handle Bindings of Interfaces) . . --zone=zone zone . ( --get-default-zone ). : firewall-cmd --get-zones. ' ' '/' '!' '*' . [--zone=zone] --list-interfaces zone . . [--zone=zone] --add-interface=interface interface zone. . [--zone=zone] --change-interface=interface interface zone. . . --add-interface . [--zone=zone] --query-interface=interface interface zone . 0 1 . [--zone=zone] --remove-interface=interface interface zone. . (Options to Handle Bindings of Sources) . IP IP IPv4 IPv6 MAC ipset ipset: . IPv4 . IPv6 . . . --zone=zone zone . ( --get-default-zone ). : firewall-cmd --get-zones. [--zone=zone] --list-sources zone . . [--zone=zone] --add-source=source[/mask]|MAC|ipset:ipset zone. . [--zone=zone] --change-source=source[/mask]|MAC|ipset:ipset zone. . . --add-source . [--zone=zone] --query-source=source[/mask]|MAC|ipset:ipset zone . 0 1 . [--zone=zone] --remove-source=source[/mask]|MAC|ipset:ipset zone. . IPSet (IPSet Options) --new-ipset=ipset --type=ipset type [--option=ipset option[=value]] ipset (type) . ipset - : '_' '-' . --new-ipset-from-file=filename [--name=ipset] ipset ipset . --delete-ipset=ipset ipset . --info-ipset=ipset ipset ipset. : ipset type: type options: option1[=value1] .. entries: entry1 .. --get-ipsets ipset . --ipset=ipset --add-entry=entry ipset. --ipset=ipset --remove-entry=entry ipset. --ipset=ipset --query-entry=entry ipset . 0 1 . --ipset=ipset --get-entries ipset. --ipset=ipset --add-entries-from-file=filename ipset . ipset . . (#) (;) . --ipset=ipset --remove-entries-from-file=filename ipset . ipset . . (#) (;) . --ipset=ipset --set-description=description ipset. --ipset=ipset --get-description ipset. --ipset=ipset --set-short=description ipset. --ipset=ipset --get-short ipset. --path-ipset=ipset ipset. (Service Options) --info-service=service service. : service ports: port1 .. protocols: protocol1 .. source-ports: source-port1 .. helpers: helper1 .. destination: ipv1:address1 .. --new-service=service . - : '_' '-' . --new-service-from-file=filename [--name=service] . --delete-service=service . --path-service=service . --service=service --set-description=description . --service=service --get-description . --service=service --set-short=description . --service=service --get-short . --service=service --add-port=portid[-portid]/protocol . --service=service --remove-port=portid[-portid]/protocol . --service=service --query-port=portid[-portid]/protocol . --service=service --get-ports . --service=service --add-protocol=protocol . --service=service --remove-protocol=protocol . --service=service --query-protocol=protocol . --service=service --get-protocols . --service=service --add-source-port=portid[-portid]/protocol . --service=service --remove-source-port=portid[-portid]/protocol . --service=service --query-source-port=portid[-portid]/protocol . --service=service --get-source-ports . --service=service --add-helper=helper (helper) . --service=service --remove-helper=helper . --service=service --query-helper=helper . --service=service --get-service-helpers . --service=service --set-destination=ipv:address[/mask] ipv address[/mask] . --service=service --remove-destination=ipv ipv . --service=service --query-destination=ipv:address[/mask] ipv address[/mask] . --service=service --get-destinations . --service=service --add-include=service (include) . --service=service --remove-include=service . --service=service --query-include=service . --service=service --get-includes . (Helper Options) . --info-helper=helper helper. : helper family: family module: module ports: port1 .. . --new-helper=helper --module=nf_conntrack_module [--family=ipv4|ipv6] . - : '-' . --new-helper-from-file=filename [--name=helper] . --delete-helper=helper . --load-helper-defaults=helper NO_DEFAULTS. --path-helper=helper . --get-helpers . --helper=helper --set-description=description . --helper=helper --get-description . --helper=helper --set-short=description . --helper=helper --get-short . --helper=helper --add-port=portid[-portid]/protocol . --helper=helper --remove-port=portid[-portid]/protocol . --helper=helper --query-port=portid[-portid]/protocol . --helper=helper --get-ports . --helper=helper --set-module=description . --helper=helper --get-module . --helper=helper --set-family=description . --helper=helper --get-family . (ICMP) (Internet Control Message Protocol (ICMP) type Options) --info-icmptype=icmptype icmptype. : icmptype destination: ipv1 .. --new-icmptype=icmptype icmptype . ICMP - : '_' '-' . --new-icmptype-from-file=filename [--name=icmptype] icmptype . --delete-icmptype=icmptype icmptype . --icmptype=icmptype --set-description=description icmptype. --icmptype=icmptype --get-description icmptype. --icmptype=icmptype --set-short=description icmptype. --icmptype=icmptype --get-short icmptype. --icmptype=icmptype --add-destination=ipv ipv icmptype . ipv ipv4 ipv6 . --icmptype=icmptype --remove-destination=ipv ipv icmptype . ipv ipv4 ipv6 . --icmptype=icmptype --query-destination=ipv ipv icmptype . ipv ipv4 ipv6 . --icmptype=icmptype --get-destinations icmptype . --path-icmptype=icmptype icmptype. (Direct Options) (DEPRECATED) . . firewalld.policies(5) . . iptables table ( filter/mangle/nat/...) chain ( INPUT/OUTPUT/FORWARD/...) commands ( -A/-D/-I/...) parameters ( -p/-s/-d/-j/...) targets ( ACCEPT/DROP/REJECT/...). --add-service=service --add-rich-rule='rule' . : FirewallBackend . CAVEATS firewalld.direct(5) . ipv4 ipv6 eb . ipv4 IPv4 (iptables(8)) ipv6 IPv6 (ip6tables(8)) eb (ebtables(8)) . --direct --get-all-chains . --direct --add-chain . --direct --get-chains { ipv4 | ipv6 | eb } table table . --direct --add-chain . --direct --add-chain { ipv4 | ipv6 | eb } table chain chain table. INPUT_direct ( iptables-save | grep direct ). INPUT_direct . --direct --remove-chain { ipv4 | ipv6 | eb } table chain chain table. --direct --query-chain { ipv4 | ipv6 | eb } table chain chain table . 0 1 . --direct --add-chain . --direct --get-all-rules . --direct --get-rules { ipv4 | ipv6 | eb } table chain chain table . --direct --add-rule { ipv4 | ipv6 | eb } table chain priority args args chain table priority. priority . 0 . . . --direct --remove-rule { ipv4 | ipv6 | eb } table chain priority args priority args chain table. --direct --remove-rules { ipv4 | ipv6 | eb } table chain chain table. --direct --add-rule . --direct --query-rule { ipv4 | ipv6 | eb } table chain priority args priority args chain table . 0 1 . --direct --get-all-passthroughs (passthrough) ipv . --direct --get-passthroughs { ipv4 | ipv6 | eb } ipv . --direct --add-passthrough { ipv4 | ipv6 | eb } args args ipv. --direct --remove-passthrough { ipv4 | ipv6 | eb } args args ipv. --direct --query-passthrough { ipv4 | ipv6 | eb } args args ipv . 0 1 . (Policy Options) --policy-server Polkit 'server' () --policy-desktop Polkit 'desktop' ( ) (SEE ALSO) firewall-applet(1), firewalld(1), firewall-cmd(1), firewall-config(1), firewalld.conf(5), firewalld.direct(5), firewalld.dbus(5), firewalld.icmptype(5), firewall-offline-cmd(1), firewalld.richlanguage(5), firewalld.service(5), firewalld.zone(5), firewalld.zones(5), firewalld.policy(5), firewalld.policies(5), firewalld.ipset(5), firewalld.helper(5) (NOTES) firewalld: http://firewalld.org (AUTHORS) Thomas Woerner Jiri Popelka Eric Garver firewalld 2.5.1 FIREWALL-OFFLINE-C(1)