5.15. Configuring Complex Firewall Rules with the "Rich Language" Syntax

If the rule family is provided, either ipv4 or ipv6, it limits the rule to IPv4 or IPv6, respectively. If the rule family is not provided, the rule is added for both IPv4 and IPv6. If source or destination addresses are used in a rule, then the rule family needs to be provided. This is also the case for port forwarding.

By specifying the source address, the origin of a connection attempt can be limited to the source address. A source address or address range is either an IP address or a network IP address with a mask for IPv4 or IPv6. For IPv4, the mask can be a network mask or a plain number. For IPv6, the mask is a plain number. The use of host names is not supported. It is possible to invert the sense of the source address command by adding the NOT keyword; all but the supplied address matches.

A MAC address and also an IP set with type hash:mac can be added for IPv4 and IPv6 if no family is specified for the rule. Other IP sets need to match the family setting of the rule.

By specifying the destination address, the target can be limited to the destination address. The destination address uses the same syntax as the source address for IP address or address ranges. The use of source and destination addresses is optional, and the use of a destination addresses is not possible with all elements. This depends on the use of destination addresses, for example, in service entries. You can combine destination and action.

The service element is one of the firewalld provided services. To get a list of the predefined services, enter the following command:

~]$ firewall-cmd --get-services

If a service provides a destination address, it will conflict with a destination address in the rule and will result in an error. The services using destination addresses internally are mostly services using multicast. The command takes the following form:

service name=service_name

The port element can either be a single port number or a port range, for example, 5060-5062, followed by the protocol, either as tcp or udp. The command takes the following form:

port port=number_or_range protocol=protocol

The protocol value can be either a protocol ID number or a protocol name. For allowed protocol entries, see /etc/protocols. The command takes the following form:

protocol value=protocol_name_or_ID

Use this command to block one or more ICMP types. The ICMP type is one of the ICMP types firewalld supports. To get a listing of supported ICMP types, enter the following command:

~]$ firewall-cmd --get-icmptypes

Specifying an action is not allowed here. icmp-block uses the action reject internally. The command takes the following form:

icmp-block name=icmptype_name

Turns on IP masquerading in the rule. A source address can be provided to limit masquerading to this area, but not a destination address. Specifying an action is not allowed here.

Forward packets from a local port with protocol specified as tcp or udp to either another port locally, to another machine, or to another port on another machine. The port and to-port can either be a single port number or a port range. The destination address is a simple IP address. Specifying an action is not allowed here. The forward-port command uses the action accept internally. The command takes the following form:

forward-port port=number_or_range protocol=protocol /
            to-port=number_or_range to-addr=address

Matches the source port of the packet - the port that is used on the origin of a connection attempt. To match a port on current machine, use the port element. The source-port element can either be a single port number or a port range (for example, 5060-5062) followed by the protocol as tcp or udp. The command takes the following form:

source-port port=number_or_range protocol=protocol

Log new connection attempts to the rule with kernel logging, for example, in syslog. You can define a prefix text that will be added to the log message as a prefix. Log level can be one of emerg, alert, crit, error, warning, notice, info, or debug. The use of log is optional. It is possible to limit logging as follows:

log [prefix=prefix text] [level=log level] limit value=rate/duration

The rate is a natural positive number [1, ..], with the duration of s, m, h, d. s means seconds, m means minutes, h means hours, and d days. The maximum limit value is 1/d, which means at maximum one log entry per day.

Audit provides an alternative way for logging using audit records sent to the service auditd. The audit type can be one of ACCEPT, REJECT, or DROP, but it is not specified after the command audit as the audit type will be automatically gathered from the rule action. Audit does not have its own parameters, but limit can be added optionally. The use of audit is optional.

An action can be one of accept, reject, drop, or mark. The rule can only contain an element or a source. If the rule contains an element, then new connections matching the element will be handled with the action. If the rule contains a source, then everything from the source address will be handled with the action specified.

accept | reject [type=reject type] | drop | mark set="mark[/mask]"

With accept, all new connection attempts will be granted. With reject, they will be rejected and their source will get a reject message. The reject type can be set to use another value. With drop, all packets will be dropped immediately and no information is sent to the source. With mark all packets will be marked with the given mark and the optional mask.