I need to allow Protocol 50 (esp) traffic for ipsec.

I can do:

iptables -A INPUT -p esp
iptables -A OUTPUT -p esp

How could I do this with firewalld instead?

  • For further reference, here's the first Google result for your question: fedoraproject.org/wiki/FirewallD It has a lot of examples, including one that's precisely what you're asking for (with ah instead of esp).
    – gparent
    Commented Mar 4, 2015 at 18:20
  • @gparent There are no add-rich-rule examples, nor any examples using non-tcp/udp protocols. Are you looking at a different page than you linked? Also, that link doesn't show up on any of the first 5 pages for my question, so... did you search something different? Commented Mar 4, 2015 at 22:57

3 Answers 3


You'll need to use a (fairly simple) rich rule for this.

For example:

firewall-cmd --zone=vpnendpoint --add-rich-rule="rule protocol value=esp accept"
  • In case someone else sees, the syntax is --add-rich-rule="protocol value=esp accept" Commented Mar 5, 2015 at 8:32
  • Can you please provide service.xml method of declaring this? Commented Jun 25, 2020 at 0:42

This post is obsolete for newer versions of firewalld.

If anyone comes by this post as of when I'm looking at it (2023-01-21), firewalld has a definition for esp, so you don't need to do these more complicated rules, any more...

firewall-cmd --add-protocol=esp


I'm by no means an iptables or firewalld expert, but it seems to me something like this would work:

firewall-cmd --permanent --direct --add-rule filter INPUT -p esp -j ACCEPT
firewall-cmd --permanent --direct --add-rule filter OUTPUT -p esp -j ACCEPT

If you have zones and such all setup, you could also do it with the --zone and --add-rich-rule options instead of --direct.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .