Location for built-in ipsets
<?xml version="1.0" encoding="utf-8"?>
<policy target="CONTINUE" priority="-15000">
  <short>Allow host IPv6</short>
  <description>Allows basic IPv6 functionality for the host running firewalld.</description>
  <ingress-zone name="ANY" />
  <egress-zone name="HOST" />
  <rule family="ipv6">
    <icmp-type name="neighbour-advertisement" />
    <accept />
  </rule>
  <rule family="ipv6">
    <icmp-type name="neighbour-solicitation" />
    <accept />
  </rule>
  <rule family="ipv6">
    <icmp-type name="router-advertisement" />
    <accept />
  </rule>
  <rule family="ipv6">
    <icmp-type name="redirect" />
    <accept />
  </rule>
</policy>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>kprop</short>
  <description>Kerberos KDC Propagation Protocol</description>
  <port protocol="tcp" port="754"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>NUT</short>
  <description>Network UPS Tools (NUT) is a protocol that allows to monitor and control power devices like uninterruptible power supplies.</description>
  <port port="3493" protocol="tcp"/>
  <!-- <port port="3493" protocol="udp"/> according to upstream never really worked over UDP -->
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>kadmin</short>
  <description>Kerberos Administration Protocol</description>
  <port protocol="tcp" port="749"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Zabbix Server</short>
  <description>Zabbix is a mature and effortless enterprise-class open source monitoring solution for network monitoring and application monitoring of millions of metrics.</description>
  <port protocol="tcp" port="10051"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service version="1.0">
  <short>dropboxlansync</short>
  <description>Dropbox LAN sync</description>
  <port protocol="udp" port="17500"/>
  <port protocol="tcp" port="17500"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Amanda Backup Client (kerberized)</short>
  <description>The Amanda backup client option allows you to connect to a Amanda backup and archiving server. You need the amanda-client package installed for this option to be useful. This service specifically allows krb5 authentication</description>
  <port protocol="tcp" port="10082"/>
  <helper name="amanda"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>SNMP</short>
  <description>Simple Network Management Protocol is an "Internet-standard protocol for managing devices on IP networks". Enable this service if you run SNMP agent (server).</description>
  <port protocol="tcp" port="161"/>
  <port protocol="udp" port="161"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Secure performance metrics web API (pmwebapis)</short>
  <description>This option allows web clients to use PCP (Performance Co-Pilot) monitoring services over a secure connection. If you need to allow remote web clients to connect to your machine to monitor aspects of its performance, and you consider that information to be sensitive, enable this option. You need the pcp package installed for this option to be useful.</description>
  <port protocol="tcp" port="44324"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>XMPP (Jabber) client</short>
  <description>Extensible Messaging and Presence Protocol (XMPP) client connection protocol allows XMPP (Jabber) clients such as Empathy, Pidgin, Kopete and Jitsi to connect to an XMPP (Jabber) server. Enable this if you run an XMPP (Jabber) server and you wish clients to be able to connect to the server and communicate with each other.</description>
  <port protocol="tcp" port="5222"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Amanda Backup Client</short>
  <description>The Amanda backup client option allows you to connect to a Amanda backup and archiving server. You need the amanda-client package installed for this option to be useful.</description>
  <port protocol="udp" port="10080"/>
  <port protocol="tcp" port="10080"/>
  <helper name="amanda"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>UPnP Client</short>
  <description>Universal Plug and Play client for auto-configuration of network routers (use only in trusted zones).</description>
  <source-port port="1900" protocol="udp"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>IMAP over SSL</short>
  <description>The Internet Message Access Protocol over SSL (IMAPs) allows a local client to access email on a remote server in a secure way. If you plan to provide a IMAP over SSL service (e.g. with dovecot), enable this option.</description>
  <port protocol="tcp" port="993"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Secure WWW (HTTPS)</short>
  <description>HTTPS is a modified HTTP used to serve Web pages when security is important. Examples are sites that require logins like stores or web mail. This option is not required for viewing pages locally or developing Web pages. You need the httpd package installed for this option to be useful.</description>
  <port protocol="tcp" port="443"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Bitcoin</short>
  <description>The default port used by Bitcoin.  Enable this option if you plan to be a full Bitcoin node.</description>
  <port protocol="tcp" port="8333"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>wbem-http</short>
  <description>Web-Based Enterprise Management (WBEM) is a set of systems management technologies developed to unify the management of distributed computing environments. This is the unencrypted protocol variant.</description>
  <port protocol="tcp" port="5988"/>
</service>

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Telnet</short>
  <description>Telnet is a protocol for logging into remote machines. It is unencrypted, and provides little security from network snooping attacks. Enabling telnet is not recommended. You need the telnet-server package installed for this option to be useful.</description>
  <port port="23" protocol="tcp"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>DHCP</short>
  <description>This allows a DHCP server to accept messages from DHCP clients and relay agents.</description>
  <port protocol="udp" port="67"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Elasticsearch</short>
  <description>Elasticsearch is a distributed, open source search and analytics engine, designed for horizontal scalability, reliability, and easy management.</description>
  <port protocol="tcp" port="9300"/>
  <port protocol="tcp" port="9200"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>mqtt-tls</short>
  <description>The Message Queuing Telemetry Transport (MQTT) is a machine-to-machine connectivity protocol. This variant of the protocol uses TLS encryption.</description>
  <port port="8883" protocol="tcp"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>IPsec</short>
  <description>Internet Protocol Security (IPsec) is the standarized IETF VPN architecture defined in RFC 4301. IPsec is negotiated using the IKEv1 (RFC 2409) or IKEv2 (RFC 7296) protocol, which in itself uses encryption and authentication. IPsec provides Internet Protocol (IP) packet encryption and authentication. Both IKE and IPsec can be encapsulated in UDP (RFC 3948) or TCP (RFC 8229 to make it easier to traverse NAT. Enabling this service will enable IKE, IPsec and their encapsulation protocols and ports. Note that IKE and IPsec can also be configured to use non-default ports, but this is not common practise.</description>
  <port protocol="ah" port=""/>
  <port protocol="esp" port=""/>
  <port protocol="udp" port="500"/>
  <port protocol="udp" port="4500"/>
  <port protocol="tcp" port="4500"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>NFS3</short>
  <description>The NFS3 protocol is used to share files. You will need to have the NFS tools installed and properly configure your NFS server for this option to be useful.</description>
  <port protocol="tcp" port="2049"/>
  <port protocol="udp" port="2049"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Virtual Network Computing Server (VNC)</short>
  <description>A VNC server provides an external accessible X session. Enable this option if you plan to provide a VNC server with direct access. The access will be possible for displays :0 to :3. If you plan to provide access with SSH, do not open this option and use the via option of the VNC viewer.</description>
  <port protocol="tcp" port="5900-5903"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>XMPP (Jabber) web client</short>
  <description>Extensible Messaging and Presence Protocol (XMPP) web client protocol allows web based chat clients such as JWChat to connect to the XMPP (Jabber) server. This is also known as the Bidirectional-streams Over Synchronous HTTP (BOSH) protocol. Enable this if you run an XMPP (Jabber) server and you wish web clients to connect to your server.</description>
  <port protocol="tcp" port="5280"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>PLEX</short>
  <description> Plex Media Server (PMS) is the back-end media server component of Plex.
  It organizes audio (music) and visual (photos and videos) content from personal media
  libraries and streams it to their player counterparts, either on the same machine,
  the same local area network, or over the Internet. </description>
  <port protocol="tcp" port="32400"/><port protocol="udp" port="32400"/> <!-- Plex media server access (required)> -->
  <port protocol="tcp" port="32469"/><port protocol="udp" port="1900"/> <!-- Plex DLNA -->
  <port protocol="tcp" port="3005"/><!-- plex home theater control (plex companion) -->
  <port protocol="tcp" port="8324"/><!-- Roku control (plex companion) -->
  <port protocol="udp" port="32410"/><!-- gdm discovery -->
  <port protocol="udp" port="32412"/><!-- gdm discovery -->
  <port protocol="udp" port="32413"/><!-- gdm discovery -->
  <port protocol="udp" port="32414"/><!-- gdm discovery -->
</service>