Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

1.14. Configuring zone priorities for traffic classification by using firewalld

With zone priorities, you can control the packet classification order by specifying priorities for ingress and egress traffic. The benefit is that you can specify the traffic classification order in a zone.

So zone A may be considered before zone B regardless of the source address or interfaces. A zone of a lower priority value has higher precedence over a zone with a higher priority value. This classification has a pair of ingress priority value and egress priority value.

1.14.1. Setting same priority value for both traffic types in a zone
リンクのコピー

By using the --set-priority option, you can set a common value for both ingress and egress traffic classification without explicit specification.

Prerequisites

  1. Create a new zone: 

    # firewall-cmd --permanent --new-zone=example-zone

  2. Set a common zone priority value for the example-zone zone with --set-priority: 

    # firewall-cmd --permanent --zone example-zone --set-priority -10

    By setting a lower value ensures the higher precedence. This ensures that all configured operations for both traffic types in this zone will take precedence over operations from other zones.

  3. Apply permanent configuration to runtime: 

    # firewall-cmd --reload

Verification

  • Display the priority value for both traffic types: 

    # firewall-cmd --permanent --info-zone example-zone

example-zone
  target: default
  ingress-priority: -10
  egress-priority: -10
  ...
  icmp-block-inversion: no
  ...
  services: dhcpv6-client mdns samba-client ssh
  ...
  forward: yes
  masquerade: no
  ...

    This setting ensures that the traffic will be considered for classification into the example-zone before other zones.

1.14.2. Setting different priority value for each traffic type in a zone
リンクのコピー

By setting distinct values for ingress and egress traffic, you can set priorities for the traffic classification in a zone.

Procedure

  1. Create a new zone: 

    # firewall-cmd --permanent --new-zone=example-zone

  2. Set a zone priority value for ingress traffic in the example-zone zone with --set-ingress-priority: 

    # firewall-cmd --permanent --zone example-zone --set-ingress-priority -10

  3. Set a zone priority value for egress traffic in the example-zone zone with --set-egress-priority: 

    # firewall-cmd --permanent --zone example-zone --set-egress-priority 100

  4. Apply permanent configuration to runtime: 

    # firewall-cmd --reload

Verification

  • Display the priority value for both traffic types: 

    # firewall-cmd --permanent --info-zone example-zone

example-zone (active)
  target: default
  ingress-priority: -10
  egress-priority: 100
  icmp-block-inversion: no
  interfaces: eth0
  ...
  services: dhcpv6-client mdns samba-client ssh
  ...
  forward: yes
  masquerade: no
  ...

    These values indicate that the ingress traffic has priority over the egress traffic in the example-zone zone before other zones.

Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2026 Red Hatトップに戻る