| 192 |
- |
1 |
# firewalld config file
|
|
|
2 |
|
|
|
3 |
# default zone
|
|
|
4 |
# The default zone used if an empty zone string is used.
|
|
|
5 |
# Default: public
|
|
|
6 |
DefaultZone=public
|
|
|
7 |
|
|
|
8 |
# Clean up on exit
|
|
|
9 |
# If set to no or false the firewall configuration will not get cleaned up
|
|
|
10 |
# on exit or stop of firewalld
|
|
|
11 |
# Default: yes
|
|
|
12 |
CleanupOnExit=yes
|
|
|
13 |
|
|
|
14 |
# Lockdown
|
|
|
15 |
# If set to enabled, firewall changes with the D-Bus interface will be limited
|
|
|
16 |
# to applications that are listed in the lockdown whitelist.
|
|
|
17 |
# The lockdown whitelist file is lockdown-whitelist.xml
|
|
|
18 |
# Default: no
|
|
|
19 |
Lockdown=no
|
|
|
20 |
|
|
|
21 |
# IPv6_rpfilter
|
|
|
22 |
# Performs a reverse path filter test on a packet for IPv6. If a reply to the
|
|
|
23 |
# packet would be sent via the same interface that the packet arrived on, the
|
|
|
24 |
# packet will match and be accepted, otherwise dropped.
|
|
|
25 |
# The rp_filter for IPv4 is controlled using sysctl.
|
| 203 |
- |
26 |
# Note: This feature has a performance impact. See man page FIREWALLD.CONF(5)
|
|
|
27 |
# for details.
|
| 192 |
- |
28 |
# Default: yes
|
|
|
29 |
IPv6_rpfilter=yes
|
|
|
30 |
|
|
|
31 |
# IndividualCalls
|
|
|
32 |
# Do not use combined -restore calls, but individual calls. This increases the
|
|
|
33 |
# time that is needed to apply changes and to start the daemon, but is good for
|
|
|
34 |
# debugging.
|
|
|
35 |
# Default: no
|
|
|
36 |
IndividualCalls=no
|
|
|
37 |
|
|
|
38 |
# LogDenied
|
|
|
39 |
# Add logging rules right before reject and drop rules in the INPUT, FORWARD
|
|
|
40 |
# and OUTPUT chains for the default rules and also final reject and drop rules
|
|
|
41 |
# in zones. Possible values are: all, unicast, broadcast, multicast and off.
|
|
|
42 |
# Default: off
|
|
|
43 |
LogDenied=off
|
|
|
44 |
|
|
|
45 |
# FirewallBackend
|
|
|
46 |
# Selects the firewall backend implementation.
|
|
|
47 |
# Choices are:
|
|
|
48 |
# - nftables (default)
|
|
|
49 |
# - iptables (iptables, ip6tables, ebtables and ipset)
|
|
|
50 |
FirewallBackend=nftables
|
|
|
51 |
|
|
|
52 |
# FlushAllOnReload
|
|
|
53 |
# Flush all runtime rules on a reload. In previous releases some runtime
|
|
|
54 |
# configuration was retained during a reload, namely; interface to zone
|
|
|
55 |
# assignment, and direct rules. This was confusing to users. To get the old
|
|
|
56 |
# behavior set this to "no".
|
|
|
57 |
# Default: yes
|
|
|
58 |
FlushAllOnReload=yes
|
|
|
59 |
|
|
|
60 |
# RFC3964_IPv4
|
|
|
61 |
# As per RFC 3964, filter IPv6 traffic with 6to4 destination addresses that
|
|
|
62 |
# correspond to IPv4 addresses that should not be routed over the public
|
|
|
63 |
# internet.
|
|
|
64 |
# Defaults to "yes".
|
|
|
65 |
RFC3964_IPv4=yes
|
|
|
66 |
|
|
|
67 |
# AllowZoneDrifting
|
|
|
68 |
# Older versions of firewalld had undocumented behavior known as "zone
|
|
|
69 |
# drifting". This allowed packets to ingress multiple zones - this is a
|
|
|
70 |
# violation of zone based firewalls. However, some users rely on this behavior
|
|
|
71 |
# to have a "catch-all" zone, e.g. the default zone. You can enable this if you
|
|
|
72 |
# desire such behavior. It's disabled by default for security reasons.
|
|
|
73 |
# Note: If "yes" packets will only drift from source based zones to interface
|
|
|
74 |
# based zones (including the default zone). Packets never drift from interface
|
|
|
75 |
# based zones to other interfaces based zones (including the default zone).
|
|
|
76 |
# Possible values; "yes", "no". Defaults to "yes".
|
|
|
77 |
AllowZoneDrifting=yes
|