'\" t
.\"     Title: firewalld.policy-set-gateway
.\"    Author: Thomas Woerner <twoerner@redhat.com>
.\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
.\"      Date: 
.\"    Manual: Firewalld Policy Set Gateway
.\"    Source: firewalld 2.5.1
.\"  Language: English
.\"
.TH "FIREWALLD\&.POLICY\-" "5" "" "firewalld 2.5.1" "Firewalld Policy Set Gateway"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
firewalld.policy-set-gateway \- Firewalld Policy Set Gateway
.SH "DESCRIPTION"
.SS "Policy Set: Gateway"
.PP
The Gateway policy set is a useful starting point for a home router\&. It enables masquerading, conntrack helpers, and forwarding between zones\&.
.PP
Zones used by this set are logically grouped\&. These groups name are used by the predefined policies\&.
.sp
.if n \{\
.RS 4
.\}
.nf
            +\-\-\-\-\-\-\-\-\-\-\-+                  +\-\-\-\-\-\-\-\-\-\-\-+
            |    LAN    |                  |   WORLD   |
            |\-\-\-\-\-\-\-\-\-\-\-|                  |\-\-\-\-\-\-\-\-\-\-\-|
            | zones:    |                  | zones:    |
            |  internal |                  |  external |
            |  home     |                  |  public   |
            |  trusted  |                  |           |
            +\-\-\-\-\-\-\-\-\-\-\-+                  +\-\-\-\-\-\-\-\-\-\-\-+
                  |                              |
                  |                              |
                  |         +\-\-\-\-\-\-\-\-\-\-\-+        |
                  +\-\-\-\-\-\-\-\-\-|   HOST    |\-\-\-\-\-\-\-\-+
                            |\-\-\-\-\-\-\-\-\-\-\-|
                            | zones:    |
                  +\-\-\-\-\-\-\-\-\-|  HOST     |\-\-\-\-\-\-\-\-+
                  |         +\-\-\-\-\-\-\-\-\-\-\-+        |
                  |                              |
                  |                              |
            +\-\-\-\-\-\-\-\-\-\-\-+                  +\-\-\-\-\-\-\-\-\-\-\-+
            |   WORK    |                  |    DMZ    |
            |\-\-\-\-\-\-\-\-\-\-\-|                  |\-\-\-\-\-\-\-\-\-\-\-|
            | zones:    |                  | zones:    |
            |  work     |                  |  dmz      |
            +\-\-\-\-\-\-\-\-\-\-\-+                  +\-\-\-\-\-\-\-\-\-\-\-+
            
.fi
.if n \{\
.RE
.\}
.SS "Policies in the Gateway set"
.PP
gateway\-dmz\-to\-HOST
.RS 4
Enables services commonly needed for a gateway, e\&.g\&. dns, dhcp\&.
.sp
File location:
\fI/usr/lib/firewalld/policies/gateway\-dmz\-to\-HOST\&.xml\fR
.RE
.PP
gateway\-lan\-to\-work
.RS 4
Allows all traffic from LAN to work\&. Enables masquerading and common connection tracking helpers\&.
.sp
File location:
\fI/usr/lib/firewalld/policies/gateway\-lan\-to\-work\&.xml\fR
.RE
.PP
gateway\-lan\-to\-world
.RS 4
Allows all traffic from LAN to world\&. If an interface is added to the "external" zone then the traffic will be masqueraded\&. Also enables connection tracking helpers for common services, e\&.g\&. ftp\&.
.sp
File location:
\fI/usr/lib/firewalld/policies/gateway\-lan\-to\-world\&.xml\fR
.RE
.PP
gateway\-lan\-to\-HOST
.RS 4
Enables services commonly needed for a gateway, e\&.g\&. dns, dhcp\&.
.sp
File location:
\fI/usr/lib/firewalld/policies/gateway\-lan\-to\-HOST\&.xml\fR
.RE
.PP
gateway\-world\-to\-HOST
.RS 4
May be used to expose internal/dmz services to the world by adding a forward port to this policy\&.
.sp
Here is an example for adding a forward port\&. It forward port 8080 to 10\&.1\&.1\&.42:80\&.
.sp
.if n \{\
.RS 4
.\}
.nf
# firewall\-cmd \-\-permanent \-\-policy gateway\-world\-to\-HOST \e
               \-\-add\-forward\-port=port=8080:proto=tcp:toport=80:toaddr=10\&.1\&.1\&.42
# firewall\-cmd \-\-reload
                        
.fi
.if n \{\
.RE
.\}
.sp
File location:
\fI/usr/lib/firewalld/policies/gateway\-world\-to\-HOST\&.xml\fR
.RE
.SH "SEE ALSO"
\fBfirewall-applet\fR(1), \fBfirewalld\fR(1), \fBfirewall-cmd\fR(1), \fBfirewall-config\fR(1), \fBfirewalld.conf\fR(5), \fBfirewalld.direct\fR(5), \fBfirewalld.dbus\fR(5), \fBfirewalld.icmptype\fR(5), \fBfirewall-offline-cmd\fR(1), \fBfirewalld.richlanguage\fR(5), \fBfirewalld.service\fR(5), \fBfirewalld.zone\fR(5), \fBfirewalld.zones\fR(5), \fBfirewalld.policy\fR(5), \fBfirewalld.policies\fR(5), \fBfirewalld.ipset\fR(5), \fBfirewalld.helper\fR(5)
.SH "NOTES"
.PP
firewalld home page:
.RS 4
\m[blue]\fB\%http://firewalld.org\fR\m[]
.RE
.SH "AUTHORS"
.PP
\fBThomas Woerner\fR <\&twoerner@redhat\&.com\&>
.RS 4
Developer
.RE
.PP
\fBJiri Popelka\fR <\&jpopelka@redhat\&.com\&>
.RS 4
Developer
.RE
.PP
\fBEric Garver\fR <\&eric@garver\&.life\&>
.RS 4
Developer
.RE