Whether to clean up firewall rules when firewalld stops.

Whether to unload all firewall-related kernel modules when firewalld stops.

The firewall backend implementation

Whether to use individual -restore calls to apply changes to the firewall

Whether to filter IPv6 traffic with 6to4 destination addresses that correspond to IPv4 addresses that should not be routed over the public internet.

Default zone for connections.

The policy during reload.

Whether to flush all runtime rules on a reload.

Add logging rules right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones for the configured link-layer packet type.

Whether to add a counter to every nftables rule.

If enabled, the generated nftables rule set will be owned exclusively by firewalld

If enabled, the generated destination NAT (DNAT) rules will NOT accept traffic that was DNAT'd by other entities, e.g. docker

This may improve forwarded traffic throughput by enabling nftables flowtable

Performs reverse path filtering (RPF) on IPv6 packets as per RFC 3704