# short

Is an optional start and end tag and is used to give a more readable name.

# description

Is an optional start and end tag to have a description.

# service

Is an optional empty-element tag and can be used several times to have more than one service entry enabled. A service entry has exactly one attribute:

name="string"

  The name of the service to be enabled. To get a list of valid service names `firewall-cmd --get-services` can be used.

# port

Is an optional empty-element tag and can be used several times to have more than one port entry. All attributes of a port entry are mandatory:

port="portid-portid"

  The port can either be a single port number portid or a port range portid-portid.

protocol="`tcp`|`udp`|`sctp`|`dccp`"

  The protocol can either be `tcp`, `udp`, `sctp` or `dccp`.

# protocol

Is an optional empty-element tag and can be used several times to have more than one protocol entry. All protocol has exactly one attribute:

value="string"

  The protocol can be any protocol supported by the system. Please have a look at `/etc/protocols` for supported protocols.

# icmp-block

Is an optional empty-element tag and can be used several times to have more than one icmp-block entry. Each icmp-block tag has exactly one mandatory attribute:

name="string"

  The name of the Internet Control Message Protocol (ICMP) type to be blocked. To get a list of valid ICMP types `firewall-cmd --get-icmptypes` can be used.

# masquerade

Is an optional empty-element tag. It can be used only once. If it's present masquerading is enabled.

# forward-port

Is an optional empty-element tag and can be used several times to have more than one port or packet forward entry. There are mandatory and also optional attributes for forward ports:

## Mandatory attributes:

The local port and protocol to be forwarded.

port="portid-portid"

  The port can either be a single port number portid or a port range portid-portid.

protocol="`tcp`|`udp`|`sctp`|`dccp`"

  The protocol can either be `tcp`, `udp`, `sctp` or `dccp`.

## Optional attributes:

The destination of the forward. For local forwarding add `to-port` only. For remote forwarding add `to-addr` and use `to-port` optionally if the destination port on the destination machine should be different.

to-port="portid-portid"

  The destination port or port range to forward to. If omitted, the value of the port= attribute will be used altogether with the to-addr attribute.

to-addr="address"

  The destination IP address either for IPv4 or IPv6.

# source-port

Is an optional empty-element tag and can be used several times to have more than one source port entry. All attributes of a source port entry are mandatory:

port="portid-portid"

  The port can either be a single port number portid or a port range portid-portid.

protocol="`tcp`|`udp`|`sctp`|`dccp`"

  The protocol can either be `tcp`, `udp`, `sctp` or `dccp`.

# rule

Is an optional element tag and can be used several times to have more than one rich language rule entry.

The general rule structure:

    <rule [family="ipv4|ipv6"] [priority="priority"]>
        [ <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/> ]
        [ <destination address="address[/mask]"|ipset="ipset" [invert="True"]/> ]
        [
            <service name="string"/> |
            <port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
            <protocol value="protocol"/> |
            <icmp-block name="icmptype"/> |
            <icmp-type name="icmptype"/> |
            <masquerade/> |
            <forward-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp" [to-port="portid[-portid]"] [to-addr="address"]/> |
            <source-port port="portid[-portid]" protocol="tcp|udp|sctp|dccp"/> |
        ]
        [
            <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
            <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
        ]
        [ <audit> [<limit value="rate/duration"/>] </audit> ]
        [
            <accept> [<limit value="rate/duration"/>] </accept> |
            <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
            <drop> [<limit value="rate/duration"/>] </drop> |
            <mark set="mark[/mask]"> [<limit value="rate/duration"/>] </mark>
        ]
    </rule>

Rule structure for source black or white listing:

    <rule [family="ipv4|ipv6"] [priority="priority"]>
        <source address="address[/mask]"|mac="MAC"|ipset="ipset" [invert="True"]/>
        [
            <log [prefix="prefix text"] [level="emerg|alert|crit|err|warn|notice|info|debug"]> [<limit value="rate/duration"/>] </log> |
            <nflog [group="group id"] [prefix="prefix text"] [queue-size="threshold"]> [<limit value="rate/duration"/>] </nflog>
        ]
        [ <audit> [<limit value="rate/duration"/>] </audit> ]
        <accept> [<limit value="rate/duration"/>] </accept> |
        <reject [type="rejecttype"]> [<limit value="rate/duration"/>] </reject> |
        <drop> [<limit value="rate/duration"/>] </drop>
    </rule>

For a full description on rich language rules, please have a look at firewalld.richlanguage 5.