CONSFIGURATOR.PROPERTY.FIREWALLD

API reference

General

Property: FIREWALLD:INSTALLED

(firewalld:installed)

Setting contents of XML configuration files

Property: FIREWALLD:KNOWS-SERVICE

(firewalld:knows-service service xml)

Property: FIREWALLD:HAS-POLICY

(firewalld:has-policy policy xml)

Property: FIREWALLD:HAS-ZONE-XML

(firewalld:has-zone-xml zone xml)

Set the whole XML configuration for zone ZONE.

In preference to using this property, it is usually best to incrementally build up the configuration for a zone using properties like FIREWALLD:ZONE-HAS-SERVICE, FIREWALLD:ZONE-HAS-INTERFACE etc.. Using this property forces most of your firewall configuration to be in a single place in your consfig, but it is typically more readable and flexible to have properties which set up the actual services and interfaces interact with the firewall configuration themselves, to render the things that those properties set up appropriately accessible and inaccessible.

(By contrast, for defining services and policies we take the simpler approach of just setting the whole XML configuration, using FIREWALLD:KNOWS-SERVICE and FIREWALLD:HAS-POLICY.)

Incremental configuration of zones

Property: FIREWALLD:HAS-ZONE

(firewalld:has-zone zone)

Ensure that the zone ZONE exists.

You will not usually need to call this property directly; it is applied by properties which add services, interfaces etc. to zones.

Property: FIREWALLD:ZONE-HAS-TARGET

(firewalld:zone-has-target zone target)

Property: FIREWALLD:DEFAULT-ROUTE-ZONED-ONCE

(firewalld:default-route-zoned-once &optional zone)

Bind the interface of the default route to zone ZONE, only if this property has not done that yet for at least one (INTERFACE . ZONE) pair.

This property is intended for machines which have firewalld but do not use Network Manager, as is typical on Debian servers using firewalld. On such machines firewalld will fail to add the primary network interface to any zone when the interface comes up before firewalld does.

This property avoids the situation in which the primary network interface is not part of any zone by explicitly adding it to ZONE, determining the name of the interface by examining the current default route. The property only adds an interface to a zone once, as the default route might later be changed temporarily by something like a VPN connection, and in such a case the firewall should not be reconfigured.

Typically you will apply both this property and FIREWALLD:HAS-DEFAULT-ZONE, passing the same zone name to each. If you have Network Manager, you need only FIREWALLD:HAS-DEFAULT-ZONE.

Property: FIREWALLD:ZONE-HAS-INTERFACE

(firewalld:zone-has-interface zone interface)

Property: FIREWALLD:ZONE-HAS-SOURCE

(firewalld:zone-has-source zone source)

Property: FIREWALLD:ZONE-HAS-SERVICE

(firewalld:zone-has-service zone service)

Property: FIREWALLD:ZONE-HAS-MASQUERADE

(firewalld:zone-has-masquerade zone)

Property: FIREWALLD:ZONE-HAS-RICH-RULE

(firewalld:zone-has-rich-rule zone rule)

Other daemon configuration

Property: FIREWALLD:HAS-DIRECT-RULE

(firewalld:has-direct-rule &rest rule-args)

Property: FIREWALLD:HAS-DEFAULT-ZONE

(firewalld:has-default-zone zone)