# firewalld.zone

firewalld.zone

5

firewalld.zone

firewalld zone configuration files

`/firewalld/zones/zone.xml`

`/lib/firewalld/zones/zone.xml`

## Description

A firewalld zone configuration file contains the information for a zone. These are the zone description, services, ports, protocols, icmp-blocks, masquerade, forward-ports, intra-zone forwarding and rich language rules in an XML file format. The file name has to be `zone_name`.xml where length of `zone_name` is currently limited to 17 chars.

This is the structure of a zone configuration file:

    <?xml version="1.0" encoding="utf-8"?>
    <zone [version="versionstring"] [target="ACCEPT|%%REJECT%%|DROP"] [ingress-priority="priority"] [egress-priority="priority"]>
        [ <interface name="string"/> ]
        [ <source address="address[/mask]"|mac="MAC"|ipset="ipset"/> ]
        [ <icmp-block-inversion/> ]
        [ <forward/> ]

        &policy_zone_syntax;

    </zone>

The config can contain these tags and attributes. Some of them are mandatory, others optional.

### zone

The mandatory zone start and end tag defines the zone. This tag can only be used once in a zone configuration file. There are optional attributes for zones:

version="`string`"

- To give the zone a version.

target="`ACCEPT`|`%%REJECT%%`|`DROP`"

- Can be used to accept, reject or drop every packet that doesn't match any rule (port, service, etc.). The `ACCEPT` target is used in `trusted` zone to accept every packet not matching any rule. The `%%REJECT%%` target is used in `block` zone to reject (with default firewalld reject type) every packet not matching any rule. The `DROP` target is used in `drop` zone to drop every packet not matching any rule. If the target is not specified, every packet not matching any rule will be rejected.

ingress-priority="`priority`"

- Ingress priority for classifying traffic into a zone. A zone with a lower priority value will be considered before a zone with a higher priority value. This allows custom ordering of zone dispatch.

egress-priority="`priority`"

- Same as ingress-priority, but for egress classification.

### interface

Is an optional empty-element tag and can be used several times. It can be used to bind an interface to a zone. You don't need this for NetworkManager-managed interfaces, because NetworkManager binds interfaces to zones automatically. See also 'How to set or change a zone for a connection?' in

firewalld.zones

5. You can use it as a fallback mechanism for interfaces that can't be managed via NetworkManager. An interface entry has exactly one attribute:

name="`string`"

- The name of the interface to be bound to the zone.

### source

Is an optional empty-element tag and can be used several times. It can be used to bind a source address, address range, a MAC address or an ipset to a zone. A source entry has exactly one of these attributes:

address="`address`/`mask`"

- The source is either an IP address or a network IP address with a mask for IPv4 or IPv6. The network family (IPv4/IPv6) will be automatically discovered. For IPv4, the mask can be a network mask or a plain number. For IPv6 the mask is a plain number. The use of host names is not supported.

mac="`MAC`"

- The source is a MAC address. It must be of the form XX:XX:XX:XX:XX:XX.

ipset="`ipset`"

- The source is an ipset.

### icmp-block-inversion

Is an optional empty-element tag and can be used only once in a zone configuration. This flag inverts the icmp block handling. Only enabled ICMP types are accepted and all others are rejected in the zone.

### forward

Is an optional empty-element tag and can be used only once in a zone configuration. This flag enables intra-zone forwarding. When enabled, packets will be forwarded between interfaces or sources within a zone, even if the zone's target is not set to `ACCEPT`.

&policy_zone_descriptions;
&seealso; ¬es;