Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 22. Configuring zone priorities for traffic classification by using firewalld

With zone priorities, you can control the packet classification order by specifying priorities for ingress and egress traffic. The benefit is that you can specify the traffic classification order in a zone. So, zone A may be considered before zone B regardless of the source address or interfaces. A zone of a lower priority value has higher precedence over a zone with a higher priority value. This classification has a pair of ingress priority value and egress priority value.

22.1. Setting same priority value for both traffic types in a zone

By using the --set-priority option, you can set a common value for both ingress and egress traffic classification without explicit specification.

Prerequisites

  1. Create a new zone: 

    # firewall-cmd --permanent --new-zone=example-zone
    Copy to Clipboard

  2. Set a common zone priority value for the example-zone zone with --set-priority: 

    # firewall-cmd --permanent --zone example-zone --set-priority -10
    Copy to Clipboard

    By setting a lower value ensures the higher precedence. This ensures that all configured operations for both traffic types in this zone will take precedence over operations from other zones.

  3. Apply permanent configuration to runtime: 

    # firewall-cmd --reload
    Copy to Clipboard

Verification

  • Display the priority value for both traffic types: 

    # firewall-cmd --permanent --info-zone example-zone

example-zone
  target: default
  ingress-priority: -10
  egress-priority: -10
  ...
  icmp-block-inversion: no
  ...
  services: dhcpv6-client mdns samba-client ssh
  ...
  forward: yes
  masquerade: no
  ...
    Copy to Clipboard

    This setting ensures that the traffic will be considered for classification into the example-zone before other zones.

22.2. Setting different priority value for each traffic type in a zone

By setting distinct values for ingress and egress traffic, you can set priorities for the traffic classification in a zone.

Procedure

  1. Create a new zone: 

    # firewall-cmd --permanent --new-zone=example-zone
    Copy to Clipboard

  2. Set a zone priority value for ingress traffic in the example-zone zone with --set-ingress-priority: 

    # firewall-cmd --permanent --zone example-zone --set-ingress-priority -10
    Copy to Clipboard

  3. Set a zone priority value for egress traffic in the example-zone zone with --set-egress-priority: 

    # firewall-cmd --permanent --zone example-zone --set-egress-priority 100
    Copy to Clipboard

  4. Apply permanent configuration to runtime: 

    # firewall-cmd --reload
    Copy to Clipboard

Verification

  • Display the priority value for both traffic types: 

    # firewall-cmd --permanent --info-zone example-zone

example-zone (active)
  target: default
  ingress-priority: -10
  egress-priority: 100
  icmp-block-inversion: no
  interfaces: eth0
  ...
  services: dhcpv6-client mdns samba-client ssh
  ...
  forward: yes
  masquerade: no
  ...
    Copy to Clipboard

    These values indicate that the ingress traffic has priority over the egress traffic in the example-zone zone before other zones.

Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat