--- name: "firewalld.dbus" section: "5" platform: "linux" package: "firewalld" version: "2.5.2-1" release: "Arch Linux 2026-11-01" platforms: ["linux"] url: "https://new.carta.tech/firewalld.dbus" --- # firewalld.dbus(5) firewalld D-Bus interface description ## NAME firewalld.dbus - firewalld D-Bus interface description ## OBJECT PATHS This is the basic firewalld object path structure. The used interfaces are explained below in the section called “INTERFACES”. ``` /org/fedoraproject/FirewallD1 Interfaces org.fedoraproject.FirewallD1 org.fedoraproject.FirewallD1.direct (deprecated) org.fedoraproject.FirewallD1.ipset org.fedoraproject.FirewallD1.policies (deprecated) org.fedoraproject.FirewallD1.zone org.freedesktop.DBus.Introspectable org.freedesktop.DBus.Properties /org/fedoraproject/FirewallD1/config Interfaces org.fedoraproject.FirewallD1.config org.fedoraproject.FirewallD1.config.direct (deprecated) org.fedoraproject.FirewallD1.config.policies (deprecated) org.freedesktop.DBus.Introspectable org.freedesktop.DBus.Properties /org/fedoraproject/FirewallD1/config/zone/i Interfaces org.fedoraproject.FirewallD1.config.zone org.freedesktop.DBus.Introspectable org.freedesktop.DBus.Properties /org/fedoraproject/FirewallD1/config/service/i Interfaces: org.fedoraproject.FirewallD1.config.service org.freedesktop.DBus.Introspectable org.freedesktop.DBus.Properties /org/fedoraproject/FirewallD1/config/ipset/i Interfaces org.fedoraproject.FirewallD1.config.ipset org.freedesktop.DBus.Introspectable org.freedesktop.DBus.Properties /org/fedoraproject/FirewallD1/config/icmptype/i Interfaces org.fedoraproject.FirewallD1.config.icmptype org.freedesktop.DBus.Introspectable org.freedesktop.DBus.Properties ``` ## INTERFACES ### org.fedoraproject.FirewallD1 This interface contains general runtime operations, like: reloading, panic mode, default zone handling, getting services and icmp types and their settings. **Methods** authorizeAll() → Nothing Initiate authorization for the complete firewalld D-Bus interface. This method it mostly useful for configuration applications. completeReload() → Nothing Reload firewall completely, even netfilter kernel modules. This will most likely terminate active connections, because state information is lost. This option should only be used in case of severe firewall problems. For example if there are state information problems that no connection can be established with correct firewall rules. disablePanicMode() → Nothing resetToDefaults() → Nothing Reset firewall to its default configuration, then reload firewall. This effects both runtime and permanent configuration. Disable panic mode. After disabling panic mode established connections might work again, if panic mode was enabled for a short period of time. Possible errors: NOT\_ENABLED, COMMAND\_FAILED enablePanicMode() → Nothing Enable panic mode. All incoming and outgoing packets are dropped, active connections will expire. Enable this only if there are serious problems with your network environment. Possible errors: ALREADY\_ENABLED, COMMAND\_FAILED getAutomaticHelpers() → s Deprecated. This always returns "no". getDefaultZone() → s Return default zone. getHelperSettings(s: *helper*) → (sssssa(ss)) Return runtime settings of given *helper*. For getting permanent settings see org.fedoraproject.FirewallD1.config.helper.Methods.getSettings. Settings are in format: *version*, *name*, *description*, *family*, *module* and array of *ports*. *version (s)*: see *version* attribute of *helper* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *name (s)*: see *short* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *description (s)*: see *description* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *family (s)*: see *family* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *module (s)*: see *module* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). Possible errors: INVALID\_HELPER getHelpers() → as Return array of helper names (s) in runtime configuration. For permanent configuration see org.fedoraproject.FirewallD1.config.Methods.listHelpers. getIcmpTypeSettings(s: *icmptype*) → (sssas) Return runtime settings of given *icmptype*. For getting permanent settings see org.fedoraproject.FirewallD1.config.icmptype.Methods.getSettings. Settings are in format: *version*, *name*, *description*, array of *destinations*. *version (s)*: see *version* attribute of *icmptype* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *name (s)*: see *short* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *description (s)*: see *description* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *destinations (as)*: array, either empty or containing strings 'ipv4' or 'ipv6', see *destination* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). Possible errors: INVALID\_ICMPTYPE getLogDenied() → s Returns the LogDenied value. If LogDenied is enabled, then logging rules are added right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones. Possible values are: *all*, *unicast*, *broadcast*, *multicast* and *off*. The default value is *off* getServiceSettings(s: *service*) → (sssa(ss)asa{ss}asa(ss)) This function is deprecated, use org.fedoraproject.FirewallD1.Methods.getServiceSettings2 instead. getServiceSettings2(s: *service*) → s{sv} Return runtime settings of given *service*. For getting permanent settings see org.fedoraproject.FirewallD1.config.service.Methods.getSettings2. Settings are a dictionary indexed by keywords. For the type of each value see below. If the value is empty it may be omitted. *version (s)*: see *version* attribute of *service* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *name (s)*: see *short* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *description (s)*: see *description* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *module names (as)*: array of kernel netfilter helpers, see *module* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *destinations (a{ss})*: dictionary of {IP family : IP address} where 'IP family' key can be either 'ipv4' or 'ipv6'. See *destination* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *protocols (as)*: array of protocols, see *protocol* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *source\_ports (a(ss))*: array of port and protocol pairs. See *source-port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *includes (as)*: array of service includes, see *include* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *helpers (as)*: array of service helpers, see *helper* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: INVALID\_SERVICE getZoneSettings(s: *zone*) → (sssbsasa(ss)asba(ssss)asasasasa(ss)b) This function is deprecated, use org.fedoraproject.FirewallD1.zone.Methods.getZoneSettings2 instead. listIcmpTypes() → as Return array of names (s) of icmp types in runtime configuration. For permanent configuration see org.fedoraproject.FirewallD1.config.Methods.listIcmpTypes. listServices() → as Return array of service names (s) in runtime configuration. For permanent configuration see org.fedoraproject.FirewallD1.config.Methods.listServices. queryPanicMode() → b Return true if panic mode is enabled, false otherwise. In panic mode all incoming and outgoing packets are dropped. reload() → Nothing Reload firewall rules and keep state information. Current permanent configuration will become new runtime configuration, i.e. all runtime only changes done until reload are lost with reload if they have not been also in permanent configuration. runtimeToPermanent() → Nothing Make runtime settings permanent. Replaces permanent settings with runtime settings for zones, policies, services, icmptypes, and direct (deprecated). Possible errors: RT\_TO\_PERM\_FAILED checkPermanentConfig() → Nothing Run checks on the permanent configuration. This is most useful if changes were made manually to configuration files. Possible errors: any setDefaultZone(s: *zone*) → Nothing Set default zone for connections and interfaces where no zone has been selected to *zone*. Setting the default zone changes the zone for the connections or interfaces, that are using the default zone. This is a runtime and permanent change. Possible errors: ZONE\_ALREADY\_SET, COMMAND\_FAILED setLogDenied(s: *value*) → Nothing Set LogDenied value to *value*. If LogDenied is enabled, then logging rules are added right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones. Possible values are: *all*, *unicast*, *broadcast*, *multicast* and *off*. The default value is *off* This is a runtime and permanent change. Possible errors: ALREADY\_SET, INVALID\_VALUE **Signals** DefaultZoneChanged(s: *zone*) Emitted when default zone has been changed to *zone*. LogDeniedChanged(s: *value*) Emitted when LogDenied value has been changed. PanicModeDisabled() Emitted when panic mode has been deactivated. PanicModeEnabled() Emitted when panic mode has been activated. Reloaded() Emitted when firewalld has been reloaded. Also emitted for a complete reload. **Properties** *BRIDGE* - b - (ro) Indicates whether the firewall has ethernet bridge support. *IPSet* - b - (ro) Indicates whether the firewall has IPSet support. *IPSetTypes* - as - (ro) The supported IPSet types by ipset and firewalld. *IPv4* - b - (ro) Indicates whether the firewall has IPv4 support. *IPv4ICMPTypes* - as - (ro) The list of supported IPv4 ICMP types. *IPv6* - b - (ro) Indicates whether the firewall has IPv6 support. *IPv6\_rpfilter* - b - (ro) Indicates whether the reverse path filter test on a packet for IPv6 is enabled. If a reply to the packet would be sent via the same interface that the packet arrived on, the packet will match and be accepted, otherwise dropped. *IPv6ICMPTypes* - as - (ro) The list of supported IPv6 ICMP types. *nf\_conntrach\_helper\_setting* - b - (ro) Deprecated. Always False. *nf\_conntrack\_helpers* - a{sas} - (ro) Deprecated. Always returns an empty dictionary. *nf\_nat\_helpers* - a{sas} - (ro) Deprecated. Always returns an empty dictionary. *interface\_version* - s - (ro) firewalld D-Bus interface version string. *state* - s - (ro) firewalld state. This can be either *INIT*, *FAILED*, or *RUNNING*. In *INIT* state, firewalld is starting up and initializing. In *FAILED* state, firewalld completely started but experienced a failure. *version* - s - (ro) firewalld version string. ### org.fedoraproject.FirewallD1.ipset Operations in this interface allows one to get, add, remove and query runtime ipset settings. For permanent configuration see org.fedoraproject.FirewallD1.config.ipset interface. **Methods** addEntry(s: ipset, s: entry) → as Add a new *entry* to *ipset*. The entry must match the type of the ipset. If the ipset is using the timeout option, it is not possible to see the entries, as they are timing out automatically in the kernel. For permanent operation see org.fedoraproject.FirewallD1.config.ipset.Methods.addEntry. Possible errors: INVALID\_IPSET, IPSET\_WITH\_TIMEOUT getEntries(s: ipset) → Nothing Get all entries added to the *ipset*. If the ipset is using the timeout option, it is not possible to see the entries, as they are timing out automatically in the kernel. Return value is a array of *entry*. For permanent operation see org.fedoraproject.FirewallD1.config.ipset.Methods.getEntries. Possible errors: INVALID\_IPSET, IPSET\_WITH\_TIMEOUT getIPSetSettings(s: ipset) → (ssssa{ss}as) Return runtime settings of given *ipset*. For getting permanent settings see org.fedoraproject.FirewallD1.config.ipset.Methods.getSettings. Settings are in format: *version*, *name*, *description*, *type*, dictionary of *options* and array of *entries*. *version (s)*: see *version* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *name (s)*: see *short* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *description (s)*: see *description* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *type (s)*: see *type* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *options (a{ss})*: dictionary of {option : value} . See *options* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *entries (as)*: array of entries, see *entry* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). Possible errors: INVALID\_IPSET getIPSets() → as Return array of ipset names (s) in runtime configuration. For permanent configuration see org.fedoraproject.FirewallD1.config.Methods.listIPSets. queryEntry(s: ipset, s: entry) → b Return whether *entry* has been added to *ipset*. For permanent operation see org.fedoraproject.FirewallD1.config.ipset.Methods.queryEntry. Possible errors: INVALID\_IPSET queryIPSet(s: ipset) → b Return whether *ipset* is defined in runtime configuration. removeEntry(s: ipset, s: entry) → as Removes an *entry* from *ipset*. For permanent operation see org.fedoraproject.FirewallD1.config.ipset.Methods.removeEntry. Possible errors: INVALID\_IPSET, IPSET\_WITH\_TIMEOUT setEntries(as: entries) → Nothing Permanently set list of entries to *entries*. For permanent operation see org.fedoraproject.FirewallD1.config.ipset.Methods.setEntries. See *entry* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). **Signals** EntryAdded(s: ipset, s: entry) Emitted when *entry* has been added to *ipset*. EntryRemoved(s: ipset, s: entry) Emitted when *entry* has been removed from *ipset*. ### org.fedoraproject.FirewallD1.direct **DEPRECATED** The direct interface has been deprecated. It will be removed in a future release. It is superseded by policies, see [**firewalld.policies**(5)](/firewalld.policies/5.md). This interface enables more direct access to the firewall. It enables runtime manipulation with chains and rules. For permanent configuration see org.fedoraproject.FirewallD1.config.direct interface. **Methods** addChain(s: ipv, s: table, s: chain) → Nothing Add a new *chain* to *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). Make sure there's no other chain with this name already. There already exist basic chains to use with direct methods, for example *INPUT\_direct* chain. These chains are jumped into before chains for zones, i.e. every rule put into *INPUT\_direct* will be checked before rules in zones. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.addChain. Possible errors: INVALID\_IPV, INVALID\_TABLE, ALREADY\_ENABLED, COMMAND\_FAILED addPassthrough(s: ipv, as: args) → Nothing Add a tracked passthrough rule with the arguments *args* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). Valid commands in args are only *-A/--append*, *-I/--insert* and *-N/--new-chain*. This method is (unlike passthrough method) tracked, i.e. firewalld remembers it. It's useful with org.fedoraproject.FirewallD1.Methods.runtimeToPermanent For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.addPassthrough. Possible errors: INVALID\_IPV, ALREADY\_ENABLED, COMMAND\_FAILED addRule(s: ipv, s: table, s: chain, i: priority, as: args) → Nothing Add a rule with the arguments *args* to *chain* in *table* with *priority* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). The priority is used to order rules. Priority 0 means add rule on top of the chain, with a higher priority the rule will be added further down. Rules with the same priority are on the same level and the order of these rules is not fixed and may change. If you want to make sure that a rule will be added after another one, use a low priority for the first and a higher for the following. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.addRule. Possible errors: INVALID\_IPV, INVALID\_TABLE, ALREADY\_ENABLED, COMMAND\_FAILED getAllChains() → a(sss) Get all chains added to all tables in format: ipv, table, chain. This concerns only chains previously added with addChain. Return value is a array of (*ipv*, *table*, *chain*). For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.getAllChains. *ipv (s)*: either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). *table (s)*: one of *filter*, *mangle*, *nat*, *raw*, *security* *chain (s)*: name of a chain. getAllPassthroughs() → a(sas) Get all tracked passthrough rules added in all ipv types in format: ipv, rule. This concerns only rules previously added with addPassthrough. Return value is a array of (*ipv*, array of *arguments*). For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.getAllPassthroughs. *ipv (s)*: either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). *arguments (as)*: array of commands, parameters and other iptables/ip6tables/ebtables command line options. getAllRules() → a(sssias) Get all rules added to all chains in all tables in format: ipv, table, chain, priority, rule. This concerns only rules previously added with addRule. Return value is a array of (*ipv*, *table*, *chain*, *priority*, array of *arguments*). For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.getAllRules. *ipv (s)*: either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). *table (s)*: one of *filter*, *mangle*, *nat*, *raw*, *security* *chain (s)*: name of a chain. *priority (i)*: used to order rules. *arguments (as)*: array of commands, parameters and other iptables/ip6tables/ebtables command line options. getChains(s: ipv, s: table) → as Return an array of chains (s) added to *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only chains previously added with addChain. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.getChains. Possible errors: INVALID\_IPV, INVALID\_TABLE getPassthroughs(s: ipv) → aas Get tracked passthrough rules added in either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only rules previously added with addPassthrough. Return value is a array of (array of *arguments*). For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.getPassthroughs. *arguments (as)*: array of commands, parameters and other iptables/ip6tables/ebtables command line options. getRules(s: ipv, s: table, s: chain) → a(ias) Get all rules added to *chain* in *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only rules previously added with addRule. Return value is a array of (*priority*, array of *arguments*). For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.getRules. *priority (i)*: used to order rules. *arguments (as)*: array of commands, parameters and other iptables/ip6tables/ebtables command line options. Possible errors: INVALID\_IPV, INVALID\_TABLE passthrough(s: ipv, as: args) → s Pass a command through to the firewall. *ipv* can be either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). *args* can be all **iptables**, **ip6tables** and **ebtables** command line arguments. *args* can be all iptables, ip6tables and ebtables command line arguments. This command is untracked, which means that firewalld is not able to provide information about this command later on. Possible errors: COMMAND\_FAILED queryChain(s: ipv, s: table, s: chain) → b Return whether a *chain* exists in *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only chains previously added with addChain. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.queryChain. Possible errors: INVALID\_IPV, INVALID\_TABLE queryPassthrough(s: ipv, as: args) → b Return whether a tracked passthrough rule with the arguments *args* exists for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only rules previously added with addPassthrough. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.queryPassthrough. Possible errors: INVALID\_IPV queryRule(s: ipv, s: table, s: chain, i: priority, as: args) → b Return whether a rule with *priority* and the arguments *args* exists in *chain* in *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only rules previously added with addRule. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.queryRule. Possible errors: INVALID\_IPV, INVALID\_TABLE removeAllPassthroughs() → Nothing Remove all passthrough rules previously added with addPassthrough. removeChain(s: ipv, s: table, s: chain) → Nothing Remove a *chain* from *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). Only chains previously added with addChain can be removed this way. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.removeChain. Possible errors: INVALID\_IPV, INVALID\_TABLE, NOT\_ENABLED, COMMAND\_FAILED removePassthrough(s: ipv, as: args) → Nothing Remove a tracked passthrough rule with arguments *args* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). Only rules previously added with addPassthrough can be removed this way. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.removePassthrough. Possible errors: INVALID\_IPV, NOT\_ENABLED, COMMAND\_FAILED removeRule(s: ipv, s: table, s: chain, i: priority, as: args) → Nothing Remove a rule with *priority* and arguments *args* from *chain* in *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). Only rules previously added with addRule can be removed this way. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.removeRule. Possible errors: INVALID\_IPV, INVALID\_TABLE, NOT\_ENABLED, COMMAND\_FAILED removeRules(s: ipv, s: table, s: chain) → Nothing Remove all rules from *chain* in *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only rules previously added with addRule. For permanent operation see org.fedoraproject.FirewallD1.config.direct.Methods.removeRules. Possible errors: INVALID\_IPV, INVALID\_TABLE **Signals** ChainAdded(s: ipv, s: table, s: chain) Emitted when *chain* has been added into *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). ChainRemoved(s: ipv, s: table, s: chain) Emitted when *chain* has been removed from *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). PassthroughAdded(s: ipv, as: args) Emitted when a tracked passthrough rule with *args* has been added for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). PassthroughRemoved(s: ipv, as: args) Emitted when a tracked passthrough rule with *args* has been removed for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). RuleAdded(s: ipv, s: table, s: chain, i: priority, as: args) Emitted when a rule with *args* has been added to *chain* in *table* with *priority* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). RuleRemoved(s: ipv, s: table, s: chain, i: priority, as: args) Emitted when a rule with *args* has been removed from *chain* in *table* with *priority* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). ### org.fedoraproject.FirewallD1.zone Operations in this interface allows one to get, add, remove and query runtime zone's settings. For permanent settings see org.fedoraproject.FirewallD1.config.zone interface. **Methods** getZoneSettings2(s: *zone*) → a{sv} Return runtime settings of given *zone*. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getSettings2. Settings are a dictionary indexed by keywords. For the type of each value see below. If the value is empty it may be omitted. *version (s)*: see *version* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *name (s)*: see *short* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *description (s)*: see *description* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *target (s)*: see *target* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *services (as)*: array of service names, see *service* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *icmp\_blocks (as)*: array of icmp-blocks. See *icmp-block* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *masquerade (b)*: see *masquerade* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *forward\_ports (a(ssss))*: array of (port, protocol, to-port, to-addr). See *forward-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *interfaces (as)*: array of interfaces. See *interface* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *sources (as)*: array of source addresses. See *source* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *rules\_str (as)*: array of rich-language rules. See *rule* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *protocols (as)*: array of protocols, see *protocol* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *source\_ports (a(ss))*: array of port and protocol pairs. See *source-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *icmp\_block\_inversion (b)*: see *icmp-block-inversion* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *forward (b)*: see *forward* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *ingress-priority (i)*: see *ingress-priority* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *egress-priority (i)*: see *egress-priority* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). Possible errors: INVALID\_ZONE setZoneSettings2(s: *zone*, a{sv}: *settings*, i: *timeout*) Set runtime settings of given *zone*. For setting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.update2. Settings are a dictionary indexed by keywords. For the type of each value see below. To zero a value pass an empty string or list. *services (as)*: array of service names, see *service* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *icmp\_blocks (as)*: array of icmp-blocks. See *icmp-block* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *masquerade (b)*: see *masquerade* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *forward\_ports (a(ssss))*: array of (port, protocol, to-port, to-addr). See *forward-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *interfaces (as)*: array of interfaces. See *interface* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *sources (as)*: array of source addresses. See *source* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *rules\_str (as)*: array of rich-language rules. See *rule* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *protocols (as)*: array of protocols, see *protocol* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *source\_ports (a(ss))*: array of port and protocol pairs. See *source-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *icmp\_block\_inversion (b)*: see *icmp-block-inversion* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *forward (b)*: see *forward* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). Possible errors: INVALID\_ZONE addForwardPort(s: zone, s: port, s: protocol, s: toport, s: toaddr, i: timeout) → s Add the IPv4 forward port into *zone*. If *zone* is empty, use default zone. The port can either be a single port number *portid* or a port range *portid*-*portid*. The protocol can either be *tcp* or *udp*. The destination address is a simple IP address. If *timeout* is non-zero, the operation will be active only for the amount of seconds. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addForwardPort. Returns name of zone to which the forward port was added. Possible errors: INVALID\_ZONE, INVALID\_PORT, MISSING\_PROTOCOL, INVALID\_PROTOCOL, INVALID\_ADDR, INVALID\_FORWARD, ALREADY\_ENABLED, INVALID\_COMMAND addIcmpBlock(s: zone, s: icmp, i: timeout) → s Add an ICMP block *icmp* into *zone*. The *icmp* is the one of the icmp types firewalld supports. To get a listing of supported icmp types use org.fedoraproject.FirewallD1.Methods.listIcmpTypes If *zone* is empty, use default zone. If *timeout* is non-zero, the operation will be active only for the amount of seconds. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addIcmpBlock. Returns name of zone to which the ICMP block was added. Possible errors: INVALID\_ZONE, INVALID\_ICMPTYPE, ALREADY\_ENABLED, INVALID\_COMMAND addIcmpBlockInversion(s: zone) → s Add ICMP block inversion to *zone*. If *zone* is empty, use default zone. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addIcmpBlockInversion. Returns name of zone to which the ICMP block inversion was added. Possible errors: INVALID\_ZONE, ALREADY\_ENABLED, INVALID\_COMMAND addInterface(s: zone, s: interface) → s Bind *interface* with *zone*. From now on all traffic going through the *interface* will respect the *zone*'s settings. If *zone* is empty, use default zone. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addInterface. Returns name of zone to which the interface was bound. Possible errors: INVALID\_ZONE, INVALID\_INTERFACE, ALREADY\_ENABLED, INVALID\_COMMAND addMasquerade(s: zone, i: timeout) → s Enable masquerade in *zone*. If *zone* is empty, use default zone. If *timeout* is non-zero, masquerading will be active for the amount of seconds. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addMasquerade. Returns name of zone in which the masquerade was enabled. Possible errors: INVALID\_ZONE, ALREADY\_ENABLED, INVALID\_COMMAND addPort(s: zone, s: port, s: protocol, i: timeout) → s Add port into *zone*. If *zone* is empty, use default zone. The port can either be a single port number or a port range *portid*-*portid*. The protocol can either be *tcp* or *udp*. If *timeout* is non-zero, the operation will be active only for the amount of seconds. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addPort. Returns name of zone to which the port was added. Possible errors: INVALID\_ZONE, INVALID\_PORT, MISSING\_PROTOCOL, INVALID\_PROTOCOL, ALREADY\_ENABLED, INVALID\_COMMAND addProtocol(s: zone, s: protocol, i: timeout) → s Add protocol into *zone*. If *zone* is empty, use default zone. The protocol can be any protocol supported by the system. Please have a look at */etc/protocols* for supported protocols. If *timeout* is non-zero, the operation will be active only for the amount of seconds. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addProtocol. Returns name of zone to which the protocol was added. Possible errors: INVALID\_ZONE, INVALID\_PROTOCOL, ALREADY\_ENABLED, INVALID\_COMMAND addRichRule(s: zone, s: rule, i: timeout) → s Add rich language *rule* into *zone*. For the rich language rule syntax, please have a look at [**firewalld.direct**(5)](/firewalld.direct/5.md). If *zone* is empty, use default zone. If *timeout* is non-zero, the operation will be active only for the amount of seconds. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addRichRule. Returns name of zone to which the rich language rule was added. Possible errors: INVALID\_ZONE, INVALID\_RULE, ALREADY\_ENABLED, INVALID\_COMMAND addService(s: zone, s: service, i: timeout) → s Add *service* into *zone*. If *zone* is empty, use default zone. If *timeout* is non-zero, the operation will be active only for the amount of seconds. To get a list of supported services, use org.fedoraproject.FirewallD1.Methods.listServices. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addService. Returns name of zone to which the service was added. Possible errors: INVALID\_ZONE, INVALID\_SERVICE, ALREADY\_ENABLED, INVALID\_COMMAND addSource(s: zone, s: source) → s Bind *source* with *zone*. From now on all traffic going from this *source* will respect the *zone*'s settings. A source address or address range is either an IP address or a network IP address with a mask for IPv4 or IPv6. For IPv4, the mask can be a network mask or a plain number. For IPv6 the mask is a plain number. Use of host names is not supported. If *zone* is empty, use default zone. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addSource. Returns name of zone to which the source was bound. Possible errors: INVALID\_ZONE, INVALID\_ADDR, ALREADY\_ENABLED, INVALID\_COMMAND addSourcePort(s: zone, s: port, s: protocol, i: timeout) → s Add source port into *zone*. If *zone* is empty, use default zone. The port can either be a single port number or a port range *portid*-*portid*. The protocol can either be *tcp* or *udp*. If *timeout* is non-zero, the operation will be active only for the amount of seconds. For permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.addSourcePort. Returns name of zone to which the port was added. Possible errors: INVALID\_ZONE, INVALID\_PORT, MISSING\_PROTOCOL, INVALID\_PROTOCOL, ALREADY\_ENABLED, INVALID\_COMMAND changeZone(s: zone, s: interface) → s This function is deprecated, use org.fedoraproject.FirewallD1.zone.Methods.changeZoneOfInterface instead. changeZoneOfInterface(s: zone, s: interface) → s Change a zone an *interface* is bound to to *zone*. It's basically removeInterface(*interface*) followed by addInterface(*zone*, *interface*). If *interface* has not been bound to a zone before, it behaves like addInterface. If *zone* is empty, use default zone. Returns name of zone to which the interface was bound. Possible errors: INVALID\_ZONE, ZONE\_ALREADY\_SET, ZONE\_CONFLICT changeZoneOfSource(s: zone, s: source) → s Change a zone an *source* is bound to to *zone*. It's basically removeSource(*source*) followed by addSource(*zone*, *source*). If *source* has not been bound to a zone before, it behaves like addSource. If *zone* is empty, use default zone. Returns name of zone to which the source was bound. Possible errors: INVALID\_ZONE, ZONE\_ALREADY\_SET, ZONE\_CONFLICT getActiveZones() → a{sa{sas}} Return dictionary of currently active zones altogether with interfaces and sources used in these zones. Active zones are zones, that have a binding to an interface or source. Return value is a dictionary where keys are zone names (s) and values are again dictionaries where keys are either 'interfaces' or 'sources' and values are arrays of interface names (s) or sources (s). getForwardPorts(s: zone) → aas Return array of IPv4 forward ports previously added into *zone*. If *zone* is empty, use default zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getForwardPorts. Return value is array of 4-tuples, where each 4-tuple consists of (port, protocol, to-port, to-addr). to-addr might be empty in case of local forwarding. Possible errors: INVALID\_ZONE getIcmpBlocks(s: zone) → as Return array of ICMP type (s) blocks previously added into *zone*. If *zone* is empty, use default zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getIcmpBlocks. Possible errors: INVALID\_ZONE getIcmpBlockInversion(s: zone) → b Return whether ICMP block inversion was previously added to *zone*. If *zone* is empty, use default zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getIcmpBlockInversion. Possible errors: INVALID\_ZONE getInterfaces(s: zone) → as Return array of interfaces (s) previously bound with *zone*. If *zone* is empty, use default zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getInterfaces. Possible errors: INVALID\_ZONE getPorts(s: zone) → aas Return array of ports (2-tuple of port and protocol) previously enabled in *zone*. If *zone* is empty, use default zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getPorts. Possible errors: INVALID\_ZONE getProtocols(s: zone) → as Return array of protocols (s) previously enabled in *zone*. If *zone* is empty, use default zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getProtocols. Possible errors: INVALID\_ZONE getRichRules(s: zone) → as Return array of rich language rules (s) previously added into *zone*. If *zone* is empty, use default zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getRichRules. Possible errors: INVALID\_ZONE getServices(s: zone) → as Return array of services (s) previously enabled in *zone*. If *zone* is empty, use default zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getServices. Possible errors: INVALID\_ZONE getSourcePorts(s: zone) → aas Return array of source ports (2-tuple of port and protocol) previously enabled in *zone*. If *zone* is empty, use default zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getSourcePorts. Possible errors: INVALID\_ZONE getSources(s: zone) → as Return array of sources (s) previously bound with *zone*. If *zone* is empty, use default zone. For getting permanent settings see org.fedoraproject.FirewallD1.config.zone.Methods.getSources. Possible errors: INVALID\_ZONE getZoneOfInterface(s: interface) → s Return name (s) of zone the *interface* is bound to or empty string. getZoneOfSource(s: source) → s Return name (s) of zone the *source* is bound to or empty string. getZones() → as Return array of names (s) of predefined zones known to current runtime environment. For list of zones known to permanent environment see org.fedoraproject.FirewallD1.config.Methods.listZones. The lists (of zones known to runtime and permanent environment) will contain same zones in most cases, but might differ for example if org.fedoraproject.FirewallD1.config.Methods.addZone has been called recently, but firewalld has not been reloaded since then. isImmutable(s: zone) → b Deprecated. queryForwardPort(s: zone, s: port, s: protocol, s: toport, s: toaddr) → b Return whether the IPv4 forward port (*port*, *protocol*, *toport*, *toaddr*) has been added into *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.queryForwardPort. Possible errors: INVALID\_ZONE, INVALID\_PORT, MISSING\_PROTOCOL, INVALID\_PROTOCOL, INVALID\_ADDR, INVALID\_FORWARD queryIcmpBlock(s: zone, s: icmp) → b Return whether an ICMP block for *icmp* has been added into *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.queryIcmpBlock. Possible errors: INVALID\_ZONE, INVALID\_ICMPTYPE queryIcmpBlockInversion(s: zone) → b Return whether ICMP block inversion has been added to *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.queryIcmpBlockInversion. Possible errors: INVALID\_ZONE, INVALID\_ICMPTYPE queryInterface(s: zone, s: interface) → b Query whether *interface* has been bound to *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.queryInterface. Possible errors: INVALID\_ZONE, INVALID\_INTERFACE queryMasquerade(s: zone) → b Return whether masquerading has been enabled in *zone* If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.queryMasquerade. Possible errors: INVALID\_ZONE queryPort(s: zone, s: port, s: protocol) → b Return whether *port*/*protocol* has been added in *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.queryPort. Possible errors: INVALID\_ZONE, INVALID\_PORT, MISSING\_PROTOCOL, INVALID\_PROTOCOL queryProtocol(s: zone, s: protocol) → b Return whether *protocol* has been added in *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.queryProtocol. Possible errors: INVALID\_ZONE, INVALID\_PROTOCOL queryRichRule(s: zone, s: rule) → b Return whether rich rule *rule* has been added in *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.queryRichRule. Possible errors: INVALID\_ZONE, INVALID\_RULE queryService(s: zone, s: service) → b Return whether *service* has been added for *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.queryService. Possible errors: INVALID\_ZONE, INVALID\_SERVICE querySource(s: zone, s: source) → b Query whether *source*has been bound to *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.querySource. Possible errors: INVALID\_ZONE, INVALID\_ADDR querySourcePort(s: zone, s: port, s: protocol) → b Return whether *port*/*protocol* has been added in *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.querySourcePort. Possible errors: INVALID\_ZONE, INVALID\_PORT, MISSING\_PROTOCOL, INVALID\_PROTOCOL removeForwardPort(s: zone, s: port, s: protocol, s: toport, s: toaddr) → s Remove IPv4 forward port ((*port*, *protocol*, *toport*, *toaddr*)) from *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removeForwardPort. Returns name of zone from which the forward port was removed. Possible errors: INVALID\_ZONE, INVALID\_PORT, MISSING\_PROTOCOL, INVALID\_PROTOCOL, INVALID\_ADDR, INVALID\_FORWARD, NOT\_ENABLED, INVALID\_COMMAND removeIcmpBlock(s: zone, s: icmp) → s Remove ICMP block *icmp* from *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removeIcmpBlock. Returns name of zone from which the ICMP block was removed. Possible errors: INVALID\_ZONE, INVALID\_ICMPTYPE, NOT\_ENABLED, INVALID\_COMMAND removeIcmpBlockInversion(s: zone) → s Remove ICMP block inversion from *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removeIcmpBlockInversion. Returns name of zone from which the ICMP block inversion was removed. Possible errors: INVALID\_ZONE, NOT\_ENABLED, INVALID\_COMMAND removeInterface(s: zone, s: interface) → s Remove binding of *interface* from *zone*. If *zone* is empty, the interface will be removed from zone it belongs to. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removeInterface. Returns name of zone from which the *interface* was removed. Possible errors: INVALID\_ZONE, INVALID\_INTERFACE, NOT\_ENABLED, INVALID\_COMMAND removeMasquerade(s: zone) → s Disable masquerade for *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removeMasquerade. Returns name of zone for which the masquerade was disabled. Possible errors: INVALID\_ZONE, NOT\_ENABLED, INVALID\_COMMAND removePort(s: zone, s: port, s: protocol) → s Remove *port*/*protocol* from *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removePort. Returns name of zone from which the port was removed. Possible errors: INVALID\_ZONE, INVALID\_PORT, MISSING\_PROTOCOL, INVALID\_PROTOCOL, NOT\_ENABLED, INVALID\_COMMAND removeProtocol(s: zone, s: protocol) → s Remove protocol from *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removeProtocol. Returns name of zone from which the protocol was removed. Possible errors: INVALID\_ZONE, INVALID\_PROTOCOL, NOT\_ENABLED, INVALID\_COMMAND removeRichRule(s: zone, s: rule) → s Remove rich language *rule* from *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removeRichRule. Returns name of zone from which the rich language rule was removed. Possible errors: INVALID\_ZONE, INVALID\_RULE, NOT\_ENABLED, INVALID\_COMMAND removeService(s: zone, s: service) → s Remove *service* from *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removeService. Returns name of zone from which the service was removed. Possible errors: INVALID\_ZONE, INVALID\_SERVICE, NOT\_ENABLED, INVALID\_COMMAND removeSource(s: zone, s: source) → s Remove binding of *source* from *zone*. If *zone* is empty, the source will be removed from zone it belongs to. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removeSource. Returns name of zone from which the *source* was removed. Possible errors: INVALID\_ZONE, INVALID\_ADDR, NOT\_ENABLED, INVALID\_COMMAND removeSourcePort(s: zone, s: port, s: protocol) → s Remove *port*/*protocol* from *zone*. If *zone* is empty, use default zone. For permanent operation see org.fedoraproject.FirewallD1.config.zone.Methods.removeSourcePort. Returns name of zone from which the source port was removed. Possible errors: INVALID\_ZONE, INVALID\_PORT, MISSING\_PROTOCOL, INVALID\_PROTOCOL, NOT\_ENABLED, INVALID\_COMMAND **Signals** ForwardPortAdded(s: zone, s: port, s: protocol, s: toport, s: toaddr, i: timeout) Emitted when forward port has been added to *zone* with *timeout*. ForwardPortRemoved(s: zone, s: port, s: protocol, s: toport, s: toaddr) Emitted when forward port has been removed from *zone*. IcmpBlockAdded(s: zone, s: icmp, i: timeout) Emitted when ICMP block for *icmp* has been added to *zone* with *timeout*. IcmpBlockInversionAdded(s: zone) Emitted when ICMP block inversion has been added to *zone*. IcmpBlockInversionRemoved(s: zone) Emitted when ICMP block inversion has been removed from *zone*. IcmpBlockRemoved(s: zone, s: icmp) Emitted when ICMP block for *icmp* has been removed from *zone*. InterfaceAdded(s: zone, s: interface) Emitted when *interface* has been added to *zone*. InterfaceRemoved(s: zone, s: interface) Emitted when *interface* has been removed from *zone*. MasqueradeAdded(s: zone, i: timeout) Emitted when masquerade has been enabled for *zone*. MasqueradeRemoved(s: zone) Emitted when masquerade has been disabled for *zone*. PortAdded(s: zone, s: port, s: protocol, i: timeout) Emitted when *port*/*protocol* has been added to *zone* with *timeout*. PortRemoved(s: zone, s: port, s: protocol) Emitted when *port*/*protocol* has been removed from *zone*. ProtocolAdded(s: zone, s: protocol, i: timeout) Emitted when *protocol* has been added to *zone* with *timeout*. ProtocolRemoved(s: zone, s: protocol) Emitted when *protocol* has been removed from *zone*. RichRuleAdded(s: zone, s: rule, i: timeout) Emitted when rich language *rule* has been added to *zone* with *timeout*. RichRuleRemoved(s: zone, s: rule) Emitted when rich language *rule* has been removed from *zone*. ServiceAdded(s: zone, s: service, i: timeout) Emitted when *service* has been added to *zone* with *timeout*. ServiceRemoved(s: zone, s: service) Emitted when *service* has been removed from *zone*. SourceAdded(s: zone, s: source) Emitted when *source* has been added to *zone*. SourcePortAdded(s: zone, s: port, s: protocol, i: timeout) Emitted when *source-port*/*protocol* has been added to *zone* with *timeout*. SourcePortRemoved(s: zone, s: port, s: protocol) Emitted when *source-port*/*protocol* has been removed from *zone*. SourceRemoved(s: zone, s: source) Emitted when *source* has been removed from *zone*. ZoneChanged(s: zone, s: interface) Deprecated ZoneOfInterfaceChanged(s: zone, s: interface) Emitted when a zone an *interface* is part of has been changed to *zone*. ZoneOfSourceChanged(s: zone, s: source) Emitted when a zone an *source* is part of has been changed to *zone*. ZoneUpdated2(s: zone, a{sv}: settings) Emitted when a zone's settings are updated via org.fedoraproject.FirewallD1.zone.Methods.setZoneSettings2 ### org.fedoraproject.FirewallD1.policy Operations in this interface allows one to get, add, remove and query runtime policy settings. For permanent settings see org.fedoraproject.FirewallD1.config.policy interface. **Methods** getActivePolicies() → a{sa{sas}} Return dictionary of currently active policies altogether with ingress zones and egress zones used in these policies. Active policies are policies, that have a binding to an active ingress zone and an active egress zone. Return value is a dictionary where keys are policy names (s) and values are again dictionaries where keys are either 'ingress\_zones' or 'egress\_zones' and values are arrays of zone names (s). getPolicies() → as Return array of names (s) of predefined policies known to current runtime environment. For list of policies known to permanent environment see org.fedoraproject.FirewallD1.config.Methods.listPolicies. The lists (of policies known to runtime and permanent environment) will contain same policies in most cases, but might differ for example if org.fedoraproject.FirewallD1.config.Methods.addPolicy has been called recently, but firewalld has not been reloaded since then. getPolicySettings(s: *policy*) → a{sv} Return runtime settings of given *policy*. For getting permanent settings see org.fedoraproject.FirewallD1.config.policy.Methods.getSettings. Settings are a dictionary indexed by keywords. For possible keywords see org.fedoraproject.FirewallD1.config.Methods.addPolicy. If the value is empty it may be omitted. Possible errors: INVALID\_POLICY setPolicySettings(s: *policy*, a{sv}: *settings*, i: *timeout*) Set runtime settings of given *policy*. For setting permanent settings see org.fedoraproject.FirewallD1.config.policy.Methods.update. Settings are a dictionary indexed by keywords. For possible keywords see org.fedoraproject.FirewallD1.config.Methods.addPolicy. To zero a value pass an empty string or list. Some keywords are not available to modify in the runtime: *description*, *name*, *priority*, *target*, *version*. Possible errors: INVALID\_POLICY **Signals** ForwardPortAdded(s: policy, a{sv}: settings) Emitted when a policy's settings are updated via org.fedoraproject.FirewallD1.policy.Methods.setPolicySettings ### org.fedoraproject.FirewallD1.config Allows one to permanently add, remove and query zones, services and icmp types. **Methods** addIPSet(s: ipset, (ssssa{ss}as): settings) → o Add *ipset* with given *settings* into permanent configuration. Settings are in format: *version*, *name*, *description*, *type*, dictionary of *options* and array of *entries*. *version (s)*: see *version* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *name (s)*: see *short* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *description (s)*: see *description* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *type (s)*: see *type* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *options (a{ss})*: dictionary of {option : value} . See *options* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *entries (as)*: array of entries, see *entry* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). Possible errors: NAME\_CONFLICT, INVALID\_NAME, INVALID\_TYPE addIcmpType(s: icmptype, (sssas): settings) → o Add *icmptype* with given *settings* into permanent configuration. Settings are in format: *version*, *name*, *description*, array of *destinations*. Returns object path of the new icmp type. *version (s)*: see *version* attribute of *icmptype* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *name (s)*: see *short* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *description (s)*: see *description* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *destinations (as)*: array, either empty or containing strings 'ipv4' or 'ipv6', see *destination* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). Possible errors: NAME\_CONFLICT, INVALID\_NAME, INVALID\_TYPE addService(s: service, (sssa(ss)asa{ss}asa(ss)): settings) → o This function is deprecated, use org.fedoraproject.FirewallD1.config.Methods.addService2 instead. addService2s: service, a{sv}: settings) → o Add *service* with given *settings* into permanent configuration. Settings are a dictionary indexed by keywords. For the type of each value see below. To zero a value pass an empty string or list. *version (s)*: see *version* attribute of *service* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *name (s)*: see *short* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *description (s)*: see *description* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *module names (as)*: array of kernel netfilter helpers, see *module* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *destinations (a{ss})*: dictionary of {IP family : IP address} where 'IP family' key can be either 'ipv4' or 'ipv6'. See *destination* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *protocols (as)*: array of protocols, see *protocol* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *source\_ports (a(ss))*: array of port and protocol pairs. See *source-port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *includes (as)*: array of service includes, see *include* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *helpers (as)*: array of service helpers, see *helper* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: NAME\_CONFLICT, INVALID\_NAME, INVALID\_TYPE addZone(s: zone, (sssbsasa(ss)asba(ssss)asasasasa(ss)b): settings) → o This function is deprecated, use org.fedoraproject.FirewallD1.config.Methods.addZone2 instead. addZone2(s: zone, a{sv}: settings) → o Add *zone* with given *settings* into permanent configuration. Settings are a dictionary indexed by keywords. For the type of each value see below. To zero a value pass an empty string or list. *version (s)*: see *version* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *name (s)*: see *short* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *description (s)*: see *description* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *target (s)*: see *target* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *services (as)*: array of service names, see *service* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *icmp\_blocks (as)*: array of icmp-blocks. See *icmp-block* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *masquerade (b)*: see *masquerade* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *forward\_ports (a(ssss))*: array of (port, protocol, to-port, to-addr). See *forward-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *interfaces (as)*: array of interfaces. See *interface* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *sources (as)*: array of source addresses. See *source* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *rules\_str (as)*: array of rich-language rules. See *rule* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *protocols (as)*: array of protocols, see *protocol* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *source\_ports (a(ss))*: array of port and protocol pairs. See *source-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *icmp\_block\_inversion (b)*: see *icmp-block-inversion* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *forward (b)*: see *forward* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *ingress\_priority (i)*: see *ingress-priority* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *egress\_priority (i)*: see *egress-priority* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). Possible errors: NAME\_CONFLICT, INVALID\_NAME, INVALID\_TYPE addPolicy(s: policy, a{sv}: settings) → o Add *policy* with given *settings* into permanent configuration. Settings are a dictionary indexed by keywords. For the type of each value see below. If a keyword is omitted the default value will be used. *description (s)*: see *description* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *egress\_zones as*: array of zone names. See *egress-zone* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *forward\_ports (a(ssss))*: array of (port, protocol, to-port, to-addr). See *forward-port* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *icmp\_blocks (as)*: array of icmp-blocks. See *icmp-block* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *ingress\_zones as*: array of zone names. See *ingress-zone* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *masquerade (b)*: see *masquerade* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *priority (i)*: see *priority* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *protocols (as)*: array of protocols, see *protocol* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *rich\_rules (as)*: array of rich-language rules. See *rule* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *services (as)*: array of service names, see *service* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *short (s)*: see *short* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *source\_ports (a(ss))*: array of port and protocol pairs. See *source-port* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *target (s)*: see *target* attribute of *policy* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). *version (s)*: see *version* attribute of *policy* tag in [**firewalld.policy**(5)](/firewalld.policy/5.md). Possible errors: NAME\_CONFLICT, INVALID\_NAME, INVALID\_TYPE getHelperByName(s: helper) → o Return object path (permanent configuration) of *helper* with given name. Possible errors: INVALID\_HELPER getHelperNames() → as Return list of *helper* names (permanent configuration). getIPSetByName(s: ipset) → o Return object path (permanent configuration) of *ipset* with given name. Possible errors: INVALID\_IPSET getIPSetNames() → as Return list of *ipset* names (permanent configuration). getIcmpTypeByName(s: icmptype) → o Return object path (permanent configuration) of *icmptype* with given name. Possible errors: INVALID\_ICMPTYPE getIcmpTypeNames() → as Return list of *icmptype* names (permanent configuration). getServiceByName(s: service) → o Return object path (permanent configuration) of *service* with given name. Possible errors: INVALID\_SERVICE getServiceNames() → as Return list of *service* names (permanent configuration). getZoneByName(s: zone) → o Return object path (permanent configuration) of *zone* with given name. Possible errors: INVALID\_ZONE getZoneNames() → as Return list of *zone* names (permanent configuration) of. getZoneOfInterface(s: iface) → s Return name of zone the *iface* is bound to or empty string. getZoneOfSource(s: source) → s Return name of zone the *source* is bound to or empty string. getPolicyByName(s: policy) → o Return object path (permanent configuration) of *policy* with given name. Possible errors: INVALID\_POLICY getPolicyNames() → as Return list of *policy* names (permanent configuration). listHelpers() → ao Return array of object paths (o) of helper in permanent configuration. For runtime configuration see org.fedoraproject.FirewallD1.Methods.getHelpers. listIPSets() → ao Return array of object paths (o) of ipset in permanent configuration. For runtime configuration see org.fedoraproject.FirewallD1.ipset.Methods.getIPSets. listIcmpTypes() → ao Return array of object paths (o) of icmp types in permanent configuration. For runtime configuration see org.fedoraproject.FirewallD1.Methods.listIcmpTypes. listServices() → ao Return array of objects paths (o) of services in permanent configuration. For runtime configuration see org.fedoraproject.FirewallD1.Methods.listServices. listZones() → ao List object paths of zones known to permanent environment. For list of zones known to runtime environment see org.fedoraproject.FirewallD1.zone.Methods.getZones. The lists (of zones known to runtime and permanent environment) will contain same zones in most cases, but might differ for example if org.fedoraproject.FirewallD1.config.Methods.addZone has been called recently, but firewalld has not been reloaded since then. listPolicies() → ao List object paths of policies known to permanent environment. For list of policies known to runtime environment see org.fedoraproject.FirewallD1.policy.Methods.getPolicies. The lists (of policies known to runtime and permanent environment) will contain same policies in most cases, but might differ for example if org.fedoraproject.FirewallD1.config.Methods.addPolicy has been called recently, but firewalld has not been reloaded since then. **Signals** HelperAdded(s: helper) Emitted when *helper* has been added. IPSetAdded(s: ipset) Emitted when *ipset* has been added. IcmpTypeAdded(s: icmptype) Emitted when *icmptype* has been added. ServiceAdded(s: service) Emitted when *service* has been added. ZoneAdded(s: zone) Emitted when *zone* has been added. **Properties** *AllowZoneDrifting* - s - (rw) Deprecated. Getting this value always returns "no". Setting this value is ignored. AutomaticHelpers - s - (rw) Deprecated. Getting this value always returns "no". Setting this value is ignored. CleanupModulesOnExit - s - (rw) Setting this option to yes or true unloads all firewall-related kernel modules when firewalld is stopped. CleanupOnExit - s - (rw) If firewalld stops, it cleans up all firewall rules. Setting this option to no or false leaves the current firewall rules untouched. DefaultZone - s - (ro) Default zone for connections or interfaces if the zone is not selected or specified by NetworkManager, initscripts or command line tool. FirewallBackend - s - (rw) Selects the firewalld backend for all rules except the direct interface. Valid options are; nftables, iptables. Default in nftables. **Note**: The iptables backend is deprecated. It will be removed in a future release. FlushAllOnReload - s - (rw) Flush all runtime rules on a reload. Valid options are; yes, no. *IPv6\_rpfilter* - b - (rw) Deprecated. See org.fedoraproject.FirewallD1.config.Properties.IPv6\_rpfilter2. *IPv6\_rpfilter2* - s - (rw) Indicates whether the reverse path filter (RFE 3704) test on a packet for IPv6 is enabled. *IndividualCalls* - s - (ro) Indicates whether individual calls combined -restore calls are used. If enabled, this increases the time that is needed to apply changes and to start the daemon, but is good for debugging. LogDenied - s - (rw) If LogDenied is enabled, then logging rules are added right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones. Possible values are: *all*, *unicast*, *broadcast*, *multicast* and *off*. MinimalMark - i - (rw) Deprecated. This option is ignored and no longer used. Marks are no longer used internally. RFC3964\_IPv4 - s - (rw) As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that correspond to IPv4 addresses that should not be routed over the public internet. Valid options are; yes, no. StrictForwardPorts - s - (rw) If set to yes, the generated destination NAT (DNAT) rules will NOT accept traffic that was DNAT'd by other entities, e.g. docker. Firewalld will be strict and not allow published container ports until they're explicitly allowed via firewalld. If set to no, then docker (and podman) integrates seamlessly with firewalld. Published container ports are implicitly allowed. NftablesFlowtable - s - (rw) This may improve forwarded traffic throughput by enabling nftables flowtable. It is a software fastpath and avoids calling nftables rule evaluation for data packets. Its value is a space separate list of interfaces. NftablesCounters - s - (rw) If set to yes, add a counter to every nftables rule. This is useful for debugging and comes with a small performance cost. NftablesTableOwner - s - (rw) If set to yes, the generated nftables rule set will be owned exclusively by firewalld. This prevents other entities from mistakenly (or maliciously) modifying firewalld's rule set. If you intentionally modify firewalld's rules, then you will have to set this to "no". ### org.fedoraproject.FirewallD1.config.direct **DEPRECATED** The direct interface has been deprecated. It will be removed in a future release. It is superseded by policies, see [**firewalld.policies**(5)](/firewalld.policies/5.md). Interface for permanent direct configuration, see also [**firewalld.direct**(5)](/firewalld.direct/5.md). For runtime direct configuration see org.fedoraproject.FirewallD1.direct interface. **Methods** addChain(s: ipv, s: table, s: chain) → Nothing Add a new *chain* to *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). Make sure there's no other chain with this name already. There already exist basic chains to use with direct methods, for example *INPUT\_direct* chain. These chains are jumped into before chains for zones, i.e. every rule put into *INPUT\_direct* will be checked before rules in zones. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.addChain. Possible errors: INVALID\_IPV, INVALID\_TABLE, ALREADY\_ENABLED addPassthrough(s: ipv, as: args) → Nothing Add a passthrough rule with the arguments *args* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.addPassthrough. Possible errors: INVALID\_IPV, ALREADY\_ENABLED addRule(s: ipv, s: table, s: chain, i: priority, as: args) → Nothing Add a rule with the arguments *args* to *chain* in *table* with *priority* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). The priority is used to order rules. Priority 0 means add rule on top of the chain, with a higher priority the rule will be added further down. Rules with the same priority are on the same level and the order of these rules is not fixed and may change. If you want to make sure that a rule will be added after another one, use a low priority for the first and a higher for the following. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.addRule. Possible errors: INVALID\_IPV, INVALID\_TABLE, ALREADY\_ENABLED getAllChains() → a(sss) Get all chains added to all tables in format: ipv, table, chain. This concerns only chains previously added with addChain. Return value is a array of (*ipv*, *table*, *chain*). For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.getAllChains. *ipv (s)*: either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). *table (s)*: one of *filter*, *mangle*, *nat*, *raw*, *security* *chain (s)*: name of a chain. getAllPassthroughs() → a(sas) Get all passthrough rules added in all ipv types in format: ipv, rule. This concerns only rules previously added with addPassthrough. Return value is a array of (*ipv*, array of *arguments*). For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.getAllPassthroughs. *ipv (s)*: either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). *arguments (as)*: array of commands, parameters and other iptables/ip6tables/ebtables command line options. getAllRules() → a(sssias) Get all rules added to all chains in all tables in format: ipv, table, chain, priority, rule. This concerns only rules previously added with addRule. Return value is a array of (*ipv*, *table*, *chain*, *priority*, array of *arguments*). For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.getAllRules. *ipv (s)*: either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). *table (s)*: one of *filter*, *mangle*, *nat*, *raw*, *security* *chain (s)*: name of a chain. *priority (i)*: used to order rules. *arguments (as)*: array of commands, parameters and other iptables/ip6tables/ebtables command line options. getChains(s: ipv, s: table) → as Return an array of chains (s) added to *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only chains previously added with addChain. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.getChains. Possible errors: INVALID\_IPV, INVALID\_TABLE getPassthroughs(s: ipv) → aas Get tracked passthrough rules added in either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only rules previously added with addPassthrough. Return value is a array of (array of *arguments*). For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.getPassthroughs. *arguments (as)*: array of commands, parameters and other iptables/ip6tables/ebtables command line options. getRules(s: ipv, s: table, s: chain) → a(ias) Get all rules added to *chain* in *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only rules previously added with addRule. Return value is a array of (*priority*, array of *arguments*). For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.getRules. *priority (i)*: used to order rules. *arguments (as)*: array of commands, parameters and other iptables/ip6tables/ebtables command line options. Possible errors: INVALID\_IPV, INVALID\_TABLE getSettings() → (a(sss)a(sssias)a(sas)) Get settings of permanent direct configuration in format: array of *chains*, array of *rules*, array of *passthroughs*. *chains (a(sss))*: array of (*ipv*, *table*, *chain*), see 'chain' in [**firewalld.direct**(5)](/firewalld.direct/5.md). .\ .PP *rules (a(sssias))*: array of (*ipv*, *table*, *chain*, *priority*, array of *arguments*), see 'rule' in [**firewalld.direct**(5)](/firewalld.direct/5.md). .\ .PP *passthroughs (a(sas))*: array of (*ipv*, array of *arguments*), see passthrough in [**firewalld.direct**(5)](/firewalld.direct/5.md). .\ .sp queryChain(s: ipv, s: table, s: chain) → b Return whether a *chain* exists in *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only chains previously added with addChain. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.queryChain. Possible errors: INVALID\_IPV, INVALID\_TABLE queryPassthrough(s: ipv, as: args) → b Return whether a tracked passthrough rule with the arguments *args* exists for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only rules previously added with addPassthrough. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.queryPassthrough. Possible errors: INVALID\_IPV queryRule(s: ipv, s: table, s: chain, i: priority, as: args) → b Return whether a rule with *priority* and the arguments *args* exists in *chain* in *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only rules previously added with addRule. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.queryRule. Possible errors: INVALID\_IPV, INVALID\_TABLE removeChain(s: ipv, s: table, s: chain) → Nothing Remove a *chain* from *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). Only chains previously added with addChain can be removed this way. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.removeChain. Possible errors: INVALID\_IPV, INVALID\_TABLE, NOT\_ENABLED removePassthrough(s: ipv, as: args) → Nothing Remove a passthrough rule with arguments *args* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). Only rules previously added with addPassthrough can be removed this way. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.removePassthrough. Possible errors: INVALID\_IPV, NOT\_ENABLED removeRule(s: ipv, s: table, s: chain, i: priority, as: args) → Nothing Remove a rule with *priority* and arguments *args* from *chain* in *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). Only rules previously added with addRule can be removed this way. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.removeRule. Possible errors: INVALID\_IPV, INVALID\_TABLE, NOT\_ENABLED removeRules(s: ipv, s: table, s: chain) → Nothing Remove all rules from *chain* in *table* for *ipv* being either *ipv4* (iptables) or *ipv6* (ip6tables) or *eb* (ebtables). This concerns only rules previously added with addRule. For runtime operation see org.fedoraproject.FirewallD1.direct.Methods.removeRules. Possible errors: INVALID\_IPV, INVALID\_TABLE update((a(sss)a(sssias)a(sas)): settings) → Nothing Update permanent direct configuration with given *settings*. Settings are in format: array of *chains*, array of *rules*, array of *passthroughs*. *chains (a(sss))*: array of (*ipv*, *table*, *chain*), see 'chain' in [**firewalld.direct**(5)](/firewalld.direct/5.md). .\ .PP *rules (a(sssias))*: array of (*ipv*, *table*, *chain*, *priority*, array of *arguments*), see 'rule' in [**firewalld.direct**(5)](/firewalld.direct/5.md). .\ .PP *passthroughs (a(sas))*: array of (*ipv*, array of *arguments*), see passthrough in [**firewalld.direct**(5)](/firewalld.direct/5.md). .\ .sp Possible errors: INVALID\_TYPE **Signals** Updated() Emitted when configuration has been updated. ### org.fedoraproject.FirewallD1.config.ipset Interface for permanent ipset configuration, see also [**firewalld.ipset**(5)](/firewalld.ipset/5.md). **Methods** addEntry(s: entry) → Nothing Permanently add *entry* to list of entries of ipset. See *entry* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). For runtime operation see org.fedoraproject.FirewallD1.ipset.Methods.addEntry. Possible errors: ALREADY\_ENABLED addOption(s: key, s: value) → Nothing Permanently add (*key*, *value*) to the ipset. See *option* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). Possible errors: ALREADY\_ENABLED getDescription() → s Get description of ipset. See *description* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). getEntries() → as Get list of entries added to ipset. See *entry* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). For runtime operation see org.fedoraproject.FirewallD1.ipset.Methods.getEntries. Possible errors: IPSET\_WITH\_TIMEOUT getOptions() → a{ss} Get dictionary of *options* set for ipset. See *option* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). getSettings() → (ssssa{ss}as) Return permanent settings of the ipset. For getting runtime settings see org.fedoraproject.FirewallD1.ipset.Methods.getIPSetSettings. Settings are in format: *version*, *name*, *description*, *type*, dictionary of *options* and array of *entries*. *version (s)*: see *version* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *name (s)*: see *short* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *description (s)*: see *description* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *type (s)*: see *type* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *options (a{ss})*: dictionary of {option : value} . See *options* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *entries (as)*: array of entries, see *entry* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). getShort() → s Get name of ipset. See *short* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). getType() → s Get type of ipset. See *type* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). getVersion() → s Get version of ipset. See *version* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). loadDefaults() → Nothing Load default settings for built-in ipset. Possible errors: NO\_DEFAULTS queryEntry(s: entry) → b Return whether *entry* has been added to *ipset*. For runtime operation see org.fedoraproject.FirewallD1.ipset.Methods.queryEntry. queryOption(s: key, s: value) → b Return whether (*key*, *value*) has been added to options of the *ipset*. remove() → Nothing Remove not built-in ipset. Possible errors: BUILTIN\_IPSET removeEntry(s: entry) → Nothing Permanently remove *entry* from ipset. See *entry* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). For runtime operation see org.fedoraproject.FirewallD1.ipset.Methods.removeEntry. Possible errors: NOT\_ENABLED removeOption(s: key) → Nothing Permanently remove *key* from the ipset. See *option* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). Possible errors: NOT\_ENABLED rename(s: name) → Nothing Rename not built-in ipset to *name*. Possible errors: BUILTIN\_IPSET setDescription(s: description) → Nothing Permanently set description of ipset to *description*. See *description* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). setEntries(as: entries) → Nothing Permanently set list of entries to *entries*. See *entry* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). setOptions(a{ss}: options) → Nothing Permanently set dict of options to *options*. See *option* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). setShort(s: short) → Nothing Permanently set name of ipset to *short*. See *short* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). setType(s: ipset\_type) → Nothing Permanently set type of ipset to *ipset\_type*. See *type* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). setVersion(s: version) → Nothing Permanently set version of ipset to *version*. See *version* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). update((ssssa{ss}as): settings) → Nothing Update settings of ipset to *settings*. Settings are in format: *version*, *name*, *description*, *type*, dictionary of *options* and array of *entries*. *version (s)*: see *version* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *name (s)*: see *short* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *description (s)*: see *description* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *type (s)*: see *type* attribute of *ipset* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *options (a{ss})*: dictionary of {option : value} . See *options* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). *entries (as)*: array of entries, see *entry* tag in [**firewalld.ipset**(5)](/firewalld.ipset/5.md). Possible errors: INVALID\_TYPE **Signals** Removed(s: name) Emitted when ipset with *name* has been removed. Renamed(s: name) Emitted when ipset has been renamed to *name*. Updated(s: name) Emitted when ipset with *name* has been updated. **Properties** builtin - b - (ro) True if ipset is build-in, false else. default - b - (ro) True if build-in ipset has default settings. False if it has been modified. Always False for not build-in ipsets. filename - s - (ro) Name (including .xml extension) of file where the configuration is stored. name - s - (ro) Name of ipset. path - s - (ro) Path to directory where the ipset configuration is stored. Should be either /usr/lib/firewalld/ipsets or /etc/firewalld/ipsets. ### org.fedoraproject.FirewallD1.config.zone Interface for permanent zone configuration, see also [**firewalld.zone**(5)](/firewalld.zone/5.md). **Methods** addForwardPort(s: port, s: protocol, s: toport, s: toaddr) → Nothing Permanently add (*port*, *protocol*, *toport*, *toaddr*) to list of forward ports of zone. See *forward-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addForwardPort. Possible errors: ALREADY\_ENABLED addIcmpBlock(s: icmptype) → Nothing Permanently add *icmptype* to list of icmp types blocked in zone. See *icmp-block* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addIcmpBlock. Possible errors: ALREADY\_ENABLED addIcmpBlock(s: icmptype) → Nothing Permanently add icmp block inversion to zone. See *icmp-block-inversion* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addIcmpBlockInversion. Possible errors: ALREADY\_ENABLED addInterface(s: interface) → Nothing Permanently add *interface* to list of interfaces bound to zone. See *interface* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addInterface. Possible errors: ALREADY\_ENABLED addMasquerade() → Nothing Permanently enable masquerading in zone. See *masquerade* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addMasquerade. Possible errors: ALREADY\_ENABLED addPort(s: port, s: protocol) → Nothing Permanently add (*port*, *protocol*) to list of ports of zone. See *port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addPort. Possible errors: ALREADY\_ENABLED addProtocol(s: protocol) → Nothing Permanently add protocol into *zone*. The protocol can be any protocol supported by the system. Please have a look at */etc/protocols* for supported protocols. For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addProtocol. Possible errors: INVALID\_PROTOCOL, ALREADY\_ENABLED addRichRule(s: rule) → Nothing Permanently add *rule* to list of rich-language rules in zone. See *rule* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addRichRule. Possible errors: ALREADY\_ENABLED addService(s: service) → Nothing Permanently add *service* to list of services used in zone. See *service* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addService. Possible errors: ALREADY\_ENABLED addSource(s: source) → Nothing Permanently add *source* to list of source addresses bound to zone. See *source* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addSource. Possible errors: ALREADY\_ENABLED addSourcePort(s: port, s: protocol) → Nothing Permanently add (*port*, *protocol*) to list of source ports of zone. See *source-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.addSourcePort. Possible errors: ALREADY\_ENABLED getDescription() → s Get description of zone. See *description* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). getForwardPorts() → a(ssss) Get list of (*port*, *protocol*, *toport*, *toaddr*) defined in zone. See *forward-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.getForwardPorts. getIcmpBlockInversion() → b Get icmp block inversion flag of zone. See *icmp-block-inversion* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). getIcmpBlocks() → as Get list of icmp type names blocked in zone. See *icmp-block* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.getIcmpBlocks. getInterfaces() → as Get list of interfaces bound to zone. See *interface* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.getInterfaces. getMasquerade() → b Return whether *masquerade* is enabled in zone. This is the same as queryMasquerade() method. See *masquerade* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). getPorts() → a(ss) Get list of (*port*, *protocol*) defined in zone. See *port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.getPorts. getProtocols() → as Return array of protocols (s) previously enabled in *zone*. For getting runtime settings see org.fedoraproject.FirewallD1.zone.Methods.getProtocols. getRichRules() → as Get list of rich-language rules in zone. See *rule* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.getRichRules. getServices() → as Get list of service names used in zone. See *service* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.getServices. getSettings() → (sssbsasa(ss)asba(ssss)asasasasa(ss)b) This function is deprecated, use org.fedoraproject.FirewallD1.config.zone.Methods.getSettings2 instead. getSettings2() → a{sv} Return permanent settings of given *zone*. For getting runtime settings see org.fedoraproject.FirewallD1.zone.Methods.getZoneSettings2. Settings are a dictionary indexed by keywords. For the type of each value see below. If the value is empty it may be omitted. *version (s)*: see *version* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *name (s)*: see *short* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *description (s)*: see *description* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *target (s)*: see *target* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *services (as)*: array of service names, see *service* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *icmp\_blocks (as)*: array of icmp-blocks. See *icmp-block* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *masquerade (b)*: see *masquerade* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *forward\_ports (a(ssss))*: array of (port, protocol, to-port, to-addr). See *forward-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *interfaces (as)*: array of interfaces. See *interface* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *sources (as)*: array of source addresses. See *source* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *rules\_str (as)*: array of rich-language rules. See *rule* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *protocols (as)*: array of protocols, see *protocol* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *source\_ports (a(ss))*: array of port and protocol pairs. See *source-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *icmp\_block\_inversion (b)*: see *icmp-block-inversion* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *forward (b)*: see *forward* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *ingress\_priority (i)*: see *ingress-priority* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *egress\_priority (i)*: see *egress-priority* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). getShort() → s Get name of zone. See *short* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). getSourcePorts() → a(ss) Get list of (*port*, *protocol*) defined in zone. See *source-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.getSourcePorts. getSources() → as Get list of source addresses bound to zone. See *source* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.getSources. getTarget() → s Get target of zone. See *target* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). getVersion() → s Get version of zone. See *version* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). loadDefaults() → Nothing Load default settings for built-in zone. Possible errors: NO\_DEFAULTS queryForwardPort(s: port, s: protocol, s: toport, s: toaddr) → b Return whether (*port*, *protocol*, *toport*, *toaddr*) is in list of forward ports of zone. See *forward-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.queryForwardPort. queryIcmpBlock(s: icmptype) → b Return whether *icmptype* is in list of icmp types blocked in zone. See *icmp-block* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.queryIcmpBlock. queryIcmpBlockInversion() → b Return whether *icmp block inversion* is in enabled in zone. See *icmp-block-inversion* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.queryIcmpBlockInversion. queryInterface(s: interface) → b Return whether *interface* is in list of interfaces bound to zone. See *interface* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.queryInterface. queryMasquerade() → b Return whether *masquerade* is enabled in zone. This is the same as getMasquerade() method. See *masquerade* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.queryMasquerade. queryPort(s: port, s: protocol) → b Return whether (*port*, *protocol*) is in list of ports of zone. See *port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.queryPort. queryProtocol(s: protocol) → b Return whether *protocol* has been added in *zone*. For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.queryProtocol. Possible errors: INVALID\_PROTOCOL queryRichRule(s: rule) → b Return whether *rule* is in list of rich-language rules in zone. See *rule* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.queryRichRule. queryService(s: service) → b Return whether *service* is in list of services used in zone. See *service* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.queryService. querySource(s: source) → b Return whether *source* is in list of source addresses bound to zone. See *source* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.querySource. querySourcePort(s: port, s: protocol) → b Return whether (*port*, *protocol*) is in list of source ports of zone. See *source-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.querySourcePort. remove() → Nothing Remove not built-in zone. Possible errors: BUILTIN\_ZONE removeForwardPort(s: port, s: protocol, s: toport, s: toaddr) → Nothing Permanently remove (*port*, *protocol*, *toport*, *toaddr*) from list of forward ports of zone. See *forward-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removeForwardPort. Possible errors: NOT\_ENABLED removeIcmpBlock(s: icmptype) → Nothing Permanently remove *icmptype* from list of icmp types blocked in zone. See *icmp-block* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removeIcmpBlock. Possible errors: NOT\_ENABLED removeIcmpBlockInversion() → Nothing Permanently remove *icmp block inversion* from the zone. See *icmp-block-inversion* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removeIcmpBlockInversion. Possible errors: NOT\_ENABLED removeInterface(s: interface) → Nothing Permanently remove *interface* from list of interfaces bound to zone. See *interface* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removeInterface. Possible errors: NOT\_ENABLED removeMasquerade() → Nothing Permanently disable masquerading in zone. See *masquerade* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removeMasquerade. Possible errors: NOT\_ENABLED removePort(s: port, s: protocol) → Nothing Permanently remove (*port*, *protocol*) from list of ports of zone. See *port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removePort. Possible errors: NOT\_ENABLED removeProtocol(s: protocol) → Nothing Permanently remove protocol from *zone*. For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removeProtocol. Possible errors: INVALID\_PROTOCOL, NOT\_ENABLED removeRichRule(s: rule) → Nothing Permanently remove *rule* from list of rich-language rules in zone. See *rule* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removeRichRule. Possible errors: NOT\_ENABLED removeService(s: service) → Nothing Permanently remove *service* from list of services used in zone. See *service* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removeService. Possible errors: NOT\_ENABLED removeSource(s: source) → Nothing Permanently remove *source* from list of source addresses bound to zone. See *source* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removeSource. Possible errors: NOT\_ENABLED removeSourcePort(s: port, s: protocol) → Nothing Permanently remove (*port*, *protocol*) from list of source ports of zone. See *source-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). For runtime operation see org.fedoraproject.FirewallD1.zone.Methods.removeSourcePort. Possible errors: NOT\_ENABLED rename(s: name) → Nothing Rename not built-in zone to *name*. Possible errors: BUILTIN\_ZONE setDescription(s: description) → Nothing Permanently set description of zone to *description*. See *description* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setForwardPorts(a(ssss): ports) → Nothing Permanently set forward ports of zone to list of (*port*, *protocol*, *toport*, *toaddr*). See *forward-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setIcmpBlockInversion(b: flag) → Nothing Permanently set icmp block inversion flag of zone to *flag*. See *icmp-block-inversion* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setIcmpBlocks(as: icmptypes) → Nothing Permanently set list of icmp types blocked in zone to *icmptypes*. See *icmp-block* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setInterfaces(as: interfaces) → Nothing Permanently set list of interfaces bound to zone to *interfaces*. See *interface* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setMasquerade(b: masquerade) → Nothing Permanently set masquerading in zone to *masquerade*. See *masquerade* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setPorts(a(ss): ports) → Nothing Permanently set ports of zone to list of (*port*, *protocol*). See *port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setProtocols(as: protocols) → Nothing Permanently set list of protocols used in zone to *protocols*. See *protocol* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setRichRules(as: rules) → Nothing Permanently set list of rich-language rules to *rules*. See *rule* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setServices(as: services) → Nothing Permanently set list of services used in zone to *services*. See *service* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setShort(s: short) → Nothing Permanently set name of zone to *short*. See *short* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setSourcePorts(a(ss): ports) → Nothing Permanently set source-ports of zone to list of (*port*, *protocol*). See *source-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setSources(as: sources) → Nothing Permanently set list of source addresses bound to zone to *sources*. See *source* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setTarget(s: target) → Nothing Permanently set target of zone to *target*. See *target* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). setVersion(s: version) → Nothing Permanently set version of zone to *version*. See *version* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). update((sssbsasa(ss)asba(ssss)asasasasa(ss)b): settings) → Nothing This function is deprecated, use org.fedoraproject.FirewallD1.config.zone.Methods.update2 instead. update2(a{sv}: settings) → Nothing Update settings of zone to *settings*. Settings are a dictionary indexed by keywords. For the type of each value see below. To zero a value pass an empty string or list. *version (s)*: see *version* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *name (s)*: see *short* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *description (s)*: see *description* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *target (s)*: see *target* attribute of *zone* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *services (as)*: array of service names, see *service* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *icmp\_blocks (as)*: array of icmp-blocks. See *icmp-block* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *masquerade (b)*: see *masquerade* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *forward\_ports (a(ssss))*: array of (port, protocol, to-port, to-addr). See *forward-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *interfaces (as)*: array of interfaces. See *interface* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *sources (as)*: array of source addresses. See *source* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *rules\_str (as)*: array of rich-language rules. See *rule* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *protocols (as)*: array of protocols, see *protocol* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *source\_ports (a(ss))*: array of port and protocol pairs. See *source-port* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *icmp\_block\_inversion (b)*: see *icmp-block-inversion* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *forward (b)*: see *forward* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *ingress\_priority (i)*: see *ingress-priority* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). *egress\_priority (i)*: see *egress-priority* tag in [**firewalld.zone**(5)](/firewalld.zone/5.md). Possible errors: INVALID\_TYPE **Signals** Removed(s: name) Emitted when zone with *name* has been removed. Renamed(s: name) Emitted when zone has been renamed to *name*. Updated(s: name) Emitted when zone with *name* has been updated. **Properties** builtin - b - (ro) True if zone is build-in, false else. default - b - (ro) True if build-in zone has default settings. False if it has been modified. Always False for not build-in zones. filename - s - (ro) Name (including .xml extension) of file where the configuration is stored. name - s - (ro) Name of zone. path - s - (ro) Path to directory where the zone configuration is stored. Should be either /usr/lib/firewalld/zones or /etc/firewalld/zones. ### org.fedoraproject.FirewallD1.config.policy Interface for permanent policy configuration, see also [**firewalld.policy**(5)](/firewalld.policy/5.md). **Methods** getSettings() → a{sv} Return permanent settings of given *policy*. For getting runtime settings see org.fedoraproject.FirewallD1.policy.Methods.getPolicySettings. Settings are a dictionary indexed by keywords. For possible keywords see org.fedoraproject.FirewallD1.config.Methods.addPolicy. loadDefaults() → Nothing Load default settings for built-in policy. Possible errors: NO\_DEFAULTS remove() → Nothing Remove not built-in policy. Possible errors: BUILTIN\_POLICY rename(s: name) → Nothing Rename not built-in policy to *name*. Possible errors: BUILTIN\_POLICY update(a{sv}: settings) → Nothing Update settings of policy to *settings*. Settings are a dictionary indexed by keywords. For possible keywords see org.fedoraproject.FirewallD1.config.Methods.addPolicy. To zero a value pass an empty string or list. Possible errors: INVALID\_TYPE **Signals** Removed(s: name) Emitted when policy with *name* has been removed. Renamed(s: name) Emitted when policy has been renamed to *name*. Updated(s: name) Emitted when policy with *name* has been updated. **Properties** builtin - b - (ro) True if policy is build-in, false else. default - b - (ro) True if build-in policy has default settings. False if it has been modified. Always False for not build-in policies. filename - s - (ro) Name (including .xml extension) of file where the configuration is stored. name - s - (ro) Name of policy. path - s - (ro) Path to directory where the policy configuration is stored. Should be either /usr/lib/firewalld/policies or /etc/firewalld/policies. ### org.fedoraproject.FirewallD1.config.service Interface for permanent service configuration, see also [**firewalld.service**(5)](/firewalld.service/5.md). **Methods** addModule(s: module) → Nothing This method is deprecated. Please use "helpers" in the update2() method. addPort(s: port, s: protocol) → Nothing Permanently add (*port*, *protocol*) to list of ports in service. See *port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: ALREADY\_ENABLED addProtocol(s: protocol) → Nothing Permanently add protocol into *zone*. The protocol can be any protocol supported by the system. Please have a look at */etc/protocols* for supported protocols. See *protocol* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: INVALID\_PROTOCOL, ALREADY\_ENABLED addSourcePort(s: port, s: protocol) → Nothing Permanently add (*port*, *protocol*) to list of source ports in service. See *source-port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: ALREADY\_ENABLED getDescription() → s Get description of service. See *description* tag in [**firewalld.service**(5)](/firewalld.service/5.md). getDestination(s: family) → s Get destination for IP family being either 'ipv4' or 'ipv6'. See *destination* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: ALREADY\_ENABLED getDestinations() → a{ss} Get list of destinations. Return value is a dictionary of {IP family : IP address} where 'IP family' key can be either 'ipv4' or 'ipv6'. See *destination* tag in [**firewalld.service**(5)](/firewalld.service/5.md). getModules() → as This method is deprecated. Please use "helpers" in the getSettings2() method. getPorts() → a(ss) Get list of (*port*, *protocol*) defined in service. See *port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). getProtocols() → as Return array of protocols (s) defined in *service*. See *protocol* tag in [**firewalld.service**(5)](/firewalld.service/5.md). getSettings() → (sssa(ss)asa{ss}asa(ss)) This function is deprecated, use org.fedoraproject.FirewallD1.config.service.Methods.getSettings2 instead. getSettings2(s: *service*) → s{sv} Return runtime settings of given *service*. For getting runtime settings see org.fedoraproject.FirewallD1.Methods.getServiceSettings2. Settings are a dictionary indexed by keywords. For the type of each value see below. If the value is empty it may be omitted. *version (s)*: see *version* attribute of *service* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *name (s)*: see *short* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *description (s)*: see *description* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *module names (as)*: array of kernel netfilter helpers, see *module* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *destinations (a{ss})*: dictionary of {IP family : IP address} where 'IP family' key can be either 'ipv4' or 'ipv6'. See *destination* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *protocols (as)*: array of protocols, see *protocol* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *source\_ports (a(ss))*: array of port and protocol pairs. See *source-port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *includes (as)*: array of service includes, see *include* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *helpers (as)*: array of service helpers, see *helper* tag in [**firewalld.service**(5)](/firewalld.service/5.md). getShort() → s Get name of service. See *short* tag in [**firewalld.service**(5)](/firewalld.service/5.md). getSourcePorts() → a(ss) Get list of (*port*, *protocol*) defined in service. See *source-port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). getVersion() → s Get version of service. See *version* attribute of *service* tag in [**firewalld.service**(5)](/firewalld.service/5.md). loadDefaults() → Nothing Load default settings for built-in service. Possible errors: NO\_DEFAULTS queryDestination(s: family, s: address) → b Return whether a *destination* is in dictionary of destinations of this service. destination is in format: (*IP family*, *IP address*) where *IP family* can be either 'ipv4' or 'ipv6'. See *destination* tag in [**firewalld.service**(5)](/firewalld.service/5.md). queryModule(s: module) → b This method is deprecated. Please use "helpers" in the getSettings2() method. queryPort(s: port, s: protocol) → b Return whether (*port*, *protocol*) is in list of ports in service. See *port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). queryProtocol(s: protocol) → b Return whether *protocol* is in list of protocols in service. See *protocol* tag in [**firewalld.service**(5)](/firewalld.service/5.md). querySourcePort(s: port, s: protocol) → b Return whether (*port*, *protocol*) is in list of source ports in service. See *source-port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). remove() → Nothing Remove not built-in service. Possible errors: BUILTIN\_SERVICE removeDestination(s: family) → Nothing Permanently remove a destination with *family* ('ipv4' or 'ipv6') from service. See *destination* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: NOT\_ENABLED removeModule(s: module) → Nothing This method is deprecated. Please use "helpers" in the update2() method. removePort(s: port, s: protocol) → Nothing Permanently remove (*port*, *protocol*) from list of ports in service. See *port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: NOT\_ENABLED removeProtocol(s: protocol) → Nothing Permanently remove *protocol* from list of protocols in service. See *protocol* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: NOT\_ENABLED removeSourcePort(s: port, s: protocol) → Nothing Permanently remove (*port*, *protocol*) from list of source ports in service. See *source-port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: NOT\_ENABLED rename(s: name) → Nothing Rename not built-in service to *name*. Possible errors: BUILTIN\_SERVICE setDescription(s: description) → Nothing Permanently set description of service to *description*. See *description* tag in [**firewalld.service**(5)](/firewalld.service/5.md). setDestination(s: family, s: address) → Nothing Permanently set a destination address. destination is in format: (*IP family*, *IP address*) where *IP family* can be either 'ipv4' or 'ipv6'. See *destination* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: ALREADY\_ENABLED setDestinations(a{ss}: destinations) → Nothing Permanently set destinations of service to *destinations*, which is a dictionary of {IP family : IP address} where 'IP family' key can be either 'ipv4' or 'ipv6'. See *destination* tag in [**firewalld.service**(5)](/firewalld.service/5.md). setModules(as: modules) → Nothing This method is deprecated. Please use "helpers" in the update2() method. setPorts(a(ss): ports) → Nothing Permanently set ports of service to list of (*port*, *protocol*). See *port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). setProtocols(as: protocols) → Nothing Permanently set protocols of service to list of *protocols*. See *protocol* tag in [**firewalld.service**(5)](/firewalld.service/5.md). setShort(s: short) → Nothing Permanently set name of service to *short*. See *short* tag in [**firewalld.service**(5)](/firewalld.service/5.md). setSourcePorts(a(ss): ports) → Nothing Permanently set source-ports of service to list of (*port*, *protocol*). See *source-port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). setVersion(s: version) → Nothing Permanently set version of service to *version*. See *version* attribute of *service* tag in [**firewalld.service**(5)](/firewalld.service/5.md). update((sssa(ss)asa{ss}asa(ss)): settings) → Nothing This function is deprecated, use org.fedoraproject.FirewallD1.config.service.Methods.update2 instead. update2a{sv}: settings) → Nothing Update settings of service to *settings*. Settings are a dictionary indexed by keywords. For the type of each value see below. To zero a value pass an empty string or list. *version (s)*: see *version* attribute of *service* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *name (s)*: see *short* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *description (s)*: see *description* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *module names (as)*: array of kernel netfilter helpers, see *module* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *destinations (a{ss})*: dictionary of {IP family : IP address} where 'IP family' key can be either 'ipv4' or 'ipv6'. See *destination* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *protocols (as)*: array of protocols, see *protocol* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *source\_ports (a(ss))*: array of port and protocol pairs. See *source-port* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *includes (as)*: array of service includes, see *include* tag in [**firewalld.service**(5)](/firewalld.service/5.md). *helpers (as)*: array of service helpers, see *helper* tag in [**firewalld.service**(5)](/firewalld.service/5.md). Possible errors: INVALID\_TYPE **Signals** Removed(s: name) Emitted when service with *name* has been removed. Renamed(s: name) Emitted when service has been renamed to *name*. Updated(s: name) Emitted when service with *name* has been updated. **Properties** builtin - b - (ro) True if service is build-in, false else. default - b - (ro) True if build-in service has default settings. False if it has been modified. Always False for not build-in services. filename - s - (ro) Name (including .xml extension) of file where the configuration is stored. name - s - (ro) Name of service. path - s - (ro) Path to directory where the configuration is stored. Should be either /usr/lib/firewalld/services or /etc/firewalld/services. ### org.fedoraproject.FirewallD1.config.helper Interface for permanent helper configuration, see also [**firewalld.helper**(5)](/firewalld.helper/5.md). **Methods** addPort(s: port, s: protocol) → Nothing Permanently add (*port*, *protocol*) to list of ports in helper. See *port* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). Possible errors: ALREADY\_ENABLED getDescription() → s Get description of helper. See *description* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). getFamily() → s Get family being 'ipv4', 'ipv6' or empty for both. See *family* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). getModule() → s Get modules (netfilter kernel helpers) used in helper. See *module* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). getPorts() → a(ss) Get list of (*port*, *protocol*) defined in helper. See *port* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). getSettings() → (sssssa(ss)) Return permanent settings of a *helper*. For getting runtime settings see org.fedoraproject.FirewallD1.Methods.getHelperSettings. Settings are in format: *version*, *name*, *description*, *family*, *module*, array of *ports* (port, protocol). *version (s)*: see *version* attribute of *helper* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *name (s)*: see *short* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *description (s)*: see *description* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *family (s)*: see *family* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *module (s)*: see *module* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). getShort() → s Get name of helper. See *short* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). getVersion() → s Get version of helper. See *version* attribute of *helper* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). loadDefaults() → Nothing Load default settings for built-in helper. Possible errors: NO\_DEFAULTS queryFamily(s: module) → b Return whether *family* is set for helper. See *family* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). queryModule(s: module) → b Return whether *module* (netfilter kernel helpers) is used in helper. See *module* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). queryPort(s: port, s: protocol) → b Return whether (*port*, *protocol*) is in list of ports in helper. See *port* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). remove() → Nothing Remove not built-in helper. Possible errors: BUILTIN\_HELPER removePort(s: port, s: protocol) → Nothing Permanently remove (*port*, *protocol*) from list of ports in helper. See *port* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). Possible errors: NOT\_ENABLED rename(s: name) → Nothing Rename not built-in helper to *name*. Possible errors: BUILTIN\_HELPER setDescription(s: description) → Nothing Permanently set description of helper to *description*. See *description* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). setFamily(s: family) → Nothing Permanently set family of helper to *family*. See *family* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). setModule(s: module) → Nothing Permanently set module of helper to *description*. See *module* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). setPorts(a(ss): ports) → Nothing Permanently set ports of helper to list of (*port*, *protocol*). See *port* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). setShort(s: short) → Nothing Permanently set name of helper to *short*. See *short* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). setVersion(s: version) → Nothing Permanently set version of helper to *version*. See *version* attribute of *helper* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). update((sssssa(ss)): settings) → Nothing Update settings of helper to *settings*. Settings are in format: *version*, *name*, *description*, *family*, *module* and array of *ports*. *version (s)*: see *version* attribute of *helper* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *name (s)*: see *short* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *description (s)*: see *description* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *family (s)*: see *family* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *module (s)*: see *module* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). *ports (a(ss))*: array of port and protocol pairs. See *port* tag in [**firewalld.helper**(5)](/firewalld.helper/5.md). Possible errors: INVALID\_HELPER **Signals** Removed(s: name) Emitted when helper with *name* has been removed. Renamed(s: name) Emitted when helper has been renamed to *name*. Updated(s: name) Emitted when helper with *name* has been updated. **Properties** builtin - b - (ro) True if helper is build-in, false else. default - b - (ro) True if build-in helper has default settings. False if it has been modified. Always False for not build-in helpers. filename - s - (ro) Name (including .xml extension) of file where the configuration is stored. name - s - (ro) Name of helper. path - s - (ro) Path to directory where the configuration is stored. Should be either /usr/lib/firewalld/helpers or /etc/firewalld/helpers. ### org.fedoraproject.FirewallD1.config.icmptype Interface for permanent icmp type configuration, see also [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). **Methods** addDestination(s: destination) → Nothing Permanently add a *destination* ('ipv4' or 'ipv6') to list of destinations of this icmp type. See *destination* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). Possible errors: ALREADY\_ENABLED getDescription() → s Get description of icmp type. See *description* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). getDestinations() → as Get list of destinations. See *destination* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). getSettings() → (sssas) Return permanent settings of *icmp type*. For getting runtime settings see org.fedoraproject.FirewallD1.Methods.getIcmpTypeSettings. Settings are in format: *version*, *name*, *description*, array of *destinations*. *version (s)*: see *version* attribute of *icmptype* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *name (s)*: see *short* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *description (s)*: see *description* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *destinations (as)*: array, either empty or containing strings 'ipv4' and/or 'ipv6', see destination tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). getShort() → s Get name of icmp type. See *short* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). getVersion() → s Get version of icmp type. See *version* attribute of *icmptype* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). loadDefaults() → Nothing Load default settings for built-in icmp type. Possible errors: NO\_DEFAULTS queryDestination(s: destination) → b Return whether a *destination* ('ipv4' or 'ipv6') is in list of destinations of this icmp type. See *destination* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). remove() → Nothing Remove not built-in icmp type. Possible errors: BUILTIN\_ICMPTYPE removeDestination(s: destination) → Nothing Permanently remove a *destination* ('ipv4' or 'ipv6') from list of destinations of this icmp type. See *destination* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). Possible errors: NOT\_ENABLED rename(s: name) → Nothing Rename not built-in icmp type to *name*. Possible errors: BUILTIN\_ICMPTYPE setDescription(s: description) → Nothing Permanently set description of icmp type to *description*. See *description* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). setDestinations(as: destinations) → Nothing Permanently set destinations of icmp type to *destinations*, which is array, either empty or containing strings 'ipv4' and/or 'ipv6'. See *destination* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). setShort(s: short) → Nothing Permanently set name of icmp type to *short*. See *short* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). setVersion(s: version) → Nothing Permanently set version of icmp type to *version*. See *version* attribute of *icmptype* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). update((sssas): settings) → Nothing Update permanent settings of icmp type to *settings*. Settings are in format: *version*, *name*, *description*, array of *destinations*. *version (s)*: see *version* attribute of *icmptype* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *name (s)*: see *short* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *description (s)*: see *description* tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). *destinations (as)*: array, either empty or containing strings 'ipv4' and/or 'ipv6', see destination tag in [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md). **Signals** Removed(s: name) Emitted when icmp type with *name* has been removed. Renamed(s: name) Emitted when icmp type has been renamed to *name*. Updated(s: name) Emitted when icmp type with *name* has been updated. **Properties** builtin - b - (ro) True if icmptype is build-in, false else. default - b - (ro) True if build-in icmp type has default settings. False if it has been modified. Always False for not build-in zones. filename - s - (ro) Name (including .xml extension) of file where the configuration is stored. name - s - (ro) Name of icmp type. path - s - (ro) Path to directory where the icmp type configuration is stored. Should be either /usr/lib/firewalld/icmptypes or /etc/firewalld/icmptypes. ## SEE ALSO [**firewall-applet**(1)](/firewall-applet/1.md), [**firewalld**(1)](/firewalld/1.md), [**firewall-cmd**(1)](/firewall-cmd/1.md), [**firewall-config**(1)](/firewall-config/1.md), [**firewalld.conf**(5)](/firewalld.conf/5.md), [**firewalld.direct**(5)](/firewalld.direct/5.md), [**firewalld.dbus**(5)](/firewalld.dbus/5.md), [**firewalld.icmptype**(5)](/firewalld.icmptype/5.md), [**firewall-offline-cmd**(1)](/firewall-offline-cmd/1.md), [**firewalld.richlanguage**(5)](/firewalld.richlanguage/5.md), [**firewalld.service**(5)](/firewalld.service/5.md), [**firewalld.zone**(5)](/firewalld.zone/5.md), [**firewalld.zones**(5)](/firewalld.zones/5.md), [**firewalld.policy**(5)](/firewalld.policy/5.md), [**firewalld.policies**(5)](/firewalld.policies/5.md), [**firewalld.ipset**(5)](/firewalld.ipset/5.md), [**firewalld.helper**(5)](/firewalld.helper/5.md) ## NOTES firewalld home page: **http://firewalld.org** ## AUTHORS **Thomas Woerner** \ Developer **Jiri Popelka** \ Developer **Eric Garver** \ Developer