# firewalld.zone

firewalld &authors;
firewalld.zone
5

# firewalld.zone

firewalld zone configuration files

`/firewalld/zones/zone.xml`

`/lib/firewalld/zones/zone.xml`

## Description

A firewalld zone configuration file contains the information for a zone. These are the zone description, services, ports, protocols, icmp-blocks, masquerade, forward-ports, intra-zone forwarding and rich language rules in an XML file format. The file name has to be zone_name.xml where length of zone_name is currently limited to 17 chars.

This is the structure of a zone configuration file:

    <?xml version="1.0" encoding="utf-8"?>
    <zone [version="versionstring"] [target="ACCEPT|%%REJECT%%|DROP"] [ingress-priority="priority"] [egress-priority="priority"]>
        [ <interface name="string"/> ]
        [ <source address="address[/mask]"|mac="MAC"|ipset="ipset"/> ]
        [ <icmp-block-inversion/> ]
        [ <forward/> ]

        &policy_zone_syntax;

    </zone>

The config can contain these tags and attributes. Some of them are mandatory, others optional.

### zone

The mandatory zone start and end tag defines the zone. This tag can only be used once in a zone configuration file. There are optional attributes for zones:

version="string"

  To give the zone a version.

target="`ACCEPT`|`%%REJECT%%`|`DROP`"

  Can be used to accept, reject or drop every packet that doesn't match any rule (port, service, etc.).

  `ACCEPT` is special: packets which are not addressed to the host will be forwarded to their destination regardless of the zone's setting, or any policies attached to the zone.

  If unspecified, the default behavior applies: ICMP will be accepted and everything else will be rejected.

ingress-priority="priority"

  Ingress priority for classifying traffic into a zone. A zone with a lower priority value will be considered before a zone with a higher priority value. This allows custom ordering of zone dispatch.

egress-priority="priority"

  Same as ingress-priority, but for egress classification.

### interface

Is an optional empty-element tag and can be used several times. It can be used to bind an interface to a zone. You don't need this for NetworkManager-managed interfaces, because NetworkManager binds interfaces to zones automatically. See also 'How to set or change a zone for a connection?' in firewalld.zones 5. You can use it as a fallback mechanism for interfaces that can't be managed via NetworkManager. An interface entry has exactly one attribute:

name="string"

  The name of the interface to be bound to the zone.

### source

Is an optional empty-element tag and can be used several times. It can be used to bind a source address, address range, a MAC address or an ipset to a zone. A source entry has exactly one of these attributes:

address="address/mask"

  The source is either an IP address or a network IP address with a mask for IPv4 or IPv6. The network family (IPv4/IPv6) will be automatically discovered. For IPv4, the mask can be a network mask or a plain number. For IPv6 the mask is a plain number. The use of host names is not supported.

mac="MAC"

  The source is a MAC address. It must be of the form XX:XX:XX:XX:XX:XX.

ipset="ipset"

  The source is an ipset.

### icmp-block-inversion

Is an optional empty-element tag and can be used only once in a zone configuration. This flag inverts the icmp block handling. Only enabled ICMP types are accepted and all others are rejected in the zone.

### forward

Is an optional empty-element tag and can be used only once in a zone configuration. This flag enables intra-zone forwarding. When enabled, packets will be forwarded between interfaces or sources within a zone, even if the zone's target is not set to `ACCEPT`.

&policy_zone_descriptions;

&seealso;

&notes;