Location for built-in ipsets
<?xml version="1.0" encoding="utf-8"?>
<policy target="CONTINUE" priority="-15000">
  <short>Allow host IPv6</short>
  <description>Allows basic IPv6 functionality for the host running firewalld.</description>
  <ingress-zone name="ANY" />
  <egress-zone name="HOST" />
  <rule family="ipv6">
    <icmp-type name="neighbour-advertisement" />
    <accept />
  </rule>
  <rule family="ipv6">
    <icmp-type name="neighbour-solicitation" />
    <accept />
  </rule>
  <rule family="ipv6">
    <icmp-type name="router-advertisement" />
    <accept />
  </rule>
  <rule family="ipv6">
    <icmp-type name="redirect" />
    <accept />
  </rule>
</policy>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>kprop</short>
  <description>Kerberos KDC Propagation Protocol</description>
  <port protocol="tcp" port="754"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>NUT</short>
  <description>Network UPS Tools (NUT) is a protocol that allows to monitor and control power devices like uninterruptible power supplies.</description>
  <port port="3493" protocol="tcp"/>
  <!-- <port port="3493" protocol="udp"/> according to upstream never really worked over UDP -->
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>kadmin</short>
  <description>Kerberos Administration Protocol</description>
  <port protocol="tcp" port="749"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Zabbix Server</short>
  <description>Zabbix is a mature and effortless enterprise-class open source monitoring solution for network monitoring and application monitoring of millions of metrics.</description>
  <port protocol="tcp" port="10051"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service version="1.0">
  <short>dropboxlansync</short>
  <description>Dropbox LAN sync</description>
  <port protocol="udp" port="17500"/>
  <port protocol="tcp" port="17500"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Amanda Backup Client (kerberized)</short>
  <description>The Amanda backup client option allows you to connect to a Amanda backup and archiving server. You need the amanda-client package installed for this option to be useful. This service specifically allows krb5 authentication</description>
  <port protocol="tcp" port="10082"/>
  <helper name="amanda"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>SNMP</short>
  <description>Simple Network Management Protocol is an "Internet-standard protocol for managing devices on IP networks". Enable this service if you run SNMP agent (server).</description>
  <port protocol="tcp" port="161"/>
  <port protocol="udp" port="161"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Secure performance metrics web API (pmwebapis)</short>
  <description>This option allows web clients to use PCP (Performance Co-Pilot) monitoring services over a secure connection. If you need to allow remote web clients to connect to your machine to monitor aspects of its performance, and you consider that information to be sensitive, enable this option. You need the pcp package installed for this option to be useful.</description>
  <port protocol="tcp" port="44324"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>XMPP (Jabber) client</short>
  <description>Extensible Messaging and Presence Protocol (XMPP) client connection protocol allows XMPP (Jabber) clients such as Empathy, Pidgin, Kopete and Jitsi to connect to an XMPP (Jabber) server. Enable this if you run an XMPP (Jabber) server and you wish clients to be able to connect to the server and communicate with each other.</description>
  <port protocol="tcp" port="5222"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Amanda Backup Client</short>
  <description>The Amanda backup client option allows you to connect to a Amanda backup and archiving server. You need the amanda-client package installed for this option to be useful.</description>
  <port protocol="udp" port="10080"/>
  <port protocol="tcp" port="10080"/>
  <helper name="amanda"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>UPnP Client</short>
  <description>Universal Plug and Play client for auto-configuration of network routers (use only in trusted zones).</description>
  <source-port port="1900" protocol="udp"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>IMAP over SSL</short>
  <description>The Internet Message Access Protocol over SSL (IMAPs) allows a local client to access email on a remote server in a secure way. If you plan to provide a IMAP over SSL service (e.g. with dovecot), enable this option.</description>
  <port protocol="tcp" port="993"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Secure WWW (HTTPS)</short>
  <description>HTTPS is a modified HTTP used to serve Web pages when security is important. Examples are sites that require logins like stores or web mail. This option is not required for viewing pages locally or developing Web pages. You need the httpd package installed for this option to be useful.</description>
  <port protocol="tcp" port="443"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Bitcoin</short>
  <description>The default port used by Bitcoin.  Enable this option if you plan to be a full Bitcoin node.</description>
  <port protocol="tcp" port="8333"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>wbem-http</short>
  <description>Web-Based Enterprise Management (WBEM) is a set of systems management technologies developed to unify the management of distributed computing environments. This is the unencrypted protocol variant.</description>
  <port protocol="tcp" port="5988"/>
</service>

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Telnet</short>
  <description>Telnet is a protocol for logging into remote machines. It is unencrypted, and provides little security from network snooping attacks. Enabling telnet is not recommended. You need the telnet-server package installed for this option to be useful.</description>
  <port port="23" protocol="tcp"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>DHCP</short>
  <description>This allows a DHCP server to accept messages from DHCP clients and relay agents.</description>
  <port protocol="udp" port="67"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Elasticsearch</short>
  <description>Elasticsearch is a distributed, open source search and analytics engine, designed for horizontal scalability, reliability, and easy management.</description>
  <port protocol="tcp" port="9300"/>
  <port protocol="tcp" port="9200"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>mqtt-tls</short>
  <description>The Message Queuing Telemetry Transport (MQTT) is a machine-to-machine connectivity protocol. This variant of the protocol uses TLS encryption.</description>
  <port port="8883" protocol="tcp"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>IPsec</short>
  <description>Internet Protocol Security (IPsec) is the standarized IETF VPN architecture defined in RFC 4301. IPsec is negotiated using the IKEv1 (RFC 2409) or IKEv2 (RFC 7296) protocol, which in itself uses encryption and authentication. IPsec provides Internet Protocol (IP) packet encryption and authentication. Both IKE and IPsec can be encapsulated in UDP (RFC 3948) or TCP (RFC 8229 to make it easier to traverse NAT. Enabling this service will enable IKE, IPsec and their encapsulation protocols and ports. Note that IKE and IPsec can also be configured to use non-default ports, but this is not common practise.</description>
  <port protocol="ah" port=""/>
  <port protocol="esp" port=""/>
  <port protocol="udp" port="500"/>
  <port protocol="udp" port="4500"/>
  <port protocol="tcp" port="4500"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>NFS3</short>
  <description>The NFS3 protocol is used to share files. You will need to have the NFS tools installed and properly configure your NFS server for this option to be useful.</description>
  <port protocol="tcp" port="2049"/>
  <port protocol="udp" port="2049"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Virtual Network Computing Server (VNC)</short>
  <description>A VNC server provides an external accessible X session. Enable this option if you plan to provide a VNC server with direct access. The access will be possible for displays :0 to :3. If you plan to provide access with SSH, do not open this option and use the via option of the VNC viewer.</description>
  <port protocol="tcp" port="5900-5903"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>XMPP (Jabber) web client</short>
  <description>Extensible Messaging and Presence Protocol (XMPP) web client protocol allows web based chat clients such as JWChat to connect to the XMPP (Jabber) server. This is also known as the Bidirectional-streams Over Synchronous HTTP (BOSH) protocol. Enable this if you run an XMPP (Jabber) server and you wish web clients to connect to your server.</description>
  <port protocol="tcp" port="5280"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>PLEX</short>
  <description> Plex Media Server (PMS) is the back-end media server component of Plex.
  It organizes audio (music) and visual (photos and videos) content from personal media
  libraries and streams it to their player counterparts, either on the same machine,
  the same local area network, or over the Internet. </description>
  <port protocol="tcp" port="32400"/><port protocol="udp" port="32400"/> <!-- Plex media server access (required)> -->
  <port protocol="tcp" port="32469"/><port protocol="udp" port="1900"/> <!-- Plex DLNA -->
  <port protocol="tcp" port="3005"/><!-- plex home theater control (plex companion) -->
  <port protocol="tcp" port="8324"/><!-- Roku control (plex companion) -->
  <port protocol="udp" port="32410"/><!-- gdm discovery -->
  <port protocol="udp" port="32412"/><!-- gdm discovery -->
  <port protocol="udp" port="32413"/><!-- gdm discovery -->
  <port protocol="udp" port="32414"/><!-- gdm discovery -->
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>FTP</short>
  <description>FTP is a protocol used for remote file transfer. If you plan to make your FTP server publicly available, enable this option. You need the vsftpd package installed for this option to be useful.</description>
  <port protocol="tcp" port="21"/>
  <helper name="ftp"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>FreeIPA with LDAP (deprecated)</short>
  <description>This service is deprecated. Please use freeipa-4 service instead.</description>
  <port protocol="tcp" port="80"/>
  <port protocol="tcp" port="443"/>
  <port protocol="tcp" port="88"/>
  <port protocol="udp" port="88"/>
  <port protocol="tcp" port="464"/>
  <port protocol="udp" port="464"/>
  <port protocol="udp" port="123"/>
  <port protocol="tcp" port="389"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>syslog</short>
  <description>Syslog is a client/server protocol: a logging application transmits a text message to the syslog receiver. The receiver is commonly called syslogd, syslog daemon or syslog server.</description>
  <port protocol="udp" port="514"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>finger</short>
  <description>Finger is a protocol for obtaining information about users on remote hosts.</description>
  <port port="79" protocol="tcp"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>oVirt VM Console</short>
  <description>oVirt VM Consoles enables secure access to virtual machine serial console.</description>
  <port protocol="tcp" port="2223"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>amqps</short>
  <description>The Advanced Message Queuing Protocol (AMQP) over SSL is an open standard application layer protocol for message-oriented middleware.</description>
  <port protocol="tcp" port="5671"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>SVDRP</short>
  <description>The Simple Video Disk Recorder Protocol (SVDRP) allows to control video disk recorder functionality.</description>
  <port port="6419" protocol="tcp"/>
  <port port="6419" protocol="udp"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Kubernetes Api Server</short>
  <description>The Kubernetes API server validates and configures data for the api objects which include pods, services, replicationcontrollers, and others.</description>
  <port protocol="tcp" port="6443"/>
</service>

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>iSNS</short>
  <description>The Internet Storage Name Service (iSNS) is a protocol that allows automated discovery, management and configuration of iSCSI and Fibre Channel devices on a TCP/IP network.</description>
  <port port="3205" protocol="tcp"/>
  <port port="3205" protocol="udp"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Syncthing</short>
  <description>Syncthing is a peer-to-peer file synchronization service. Enable this option, if you plan to run the Syncthing service.</description>
  <port protocol="tcp" port="22000"/>
  <port protocol="udp" port="22000"/>
  <port protocol="udp" port="21027"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>XMPP (Jabber) server</short>
  <description>Extensible Messaging and Presence Protocol (XMPP) server connection protocols allows multiple XMPP (Jabber) servers to work in a federated fashion. Users on one server will be able to see the presence of and communicate with users on another servers. Enable this if you run an XMPP (Jabber) server and you wish users on your server to communicate with users on other XMPP servers.</description>
  <port protocol="tcp" port="5269"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Kibana</short>
  <description>Kibana is an open source data visualization platform that allows you to interact with your data through stunning, powerful graphics that can be combined into custom dashboards that help you share insights from your data far and wide.</description>
  <port protocol="tcp" port="5601"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>mssql</short>
  <description>Microsoft SQL Server</description>
  <port protocol="tcp" port="1433"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
    <protocol value="gre"/>
    <helper name="proto-gre"/>
</service>
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Bitcoin RPC</short>
  <description>Enable this option if you need access to the Bitcoin RPC interface.  This is not required when connecting on localhost.</description>
  <port protocol="tcp" port="8332"/>
</service>