GNU.WIKI: The GNU/Linux Knowledge Base

  [HOME] [PHP Manual] [HowTo] [ABS] [MAN1] [MAN2] [MAN3] [MAN4] [MAN5] [MAN6] [MAN7] [MAN8] [MAN9]

  [0-9] [Aa] [Bb] [Cc] [Dd] [Ee] [Ff] [Gg] [Hh] [Ii] [Jj] [Kk] [Ll] [Mm] [Nn] [Oo] [Pp] [Qq] [Rr] [Ss] [Tt] [Uu] [Vv] [Ww] [Xx] [Yy] [Zz]


NAME

       zone.conf - fiaif zone configuration files

DESCRIPTION

       fiaif.conf  is  the  file that determines how zones should be set up in
       the firewall. A zone describes how traffic from other zones are allowed
       into  a zone, and what packets are allowed from the zone itself.  Zones
       are based upon the interface and the network the interface is connected
       to. It is possible to have multiple zones per interface, if and only if
       the interface is not declared public. See the PUBLIC variable for  more
       information.

       The general syntax of a configuration file is the same as for a bash(1)
       script, in which only variables should be present.

       The variables can be on three forms:

       VARIABLE
              This is a simple variable. It can  only  be  assigned  a  single
              value.

       VARIABLE_FOO
              The  denotes a variable sequence. The FOO can be replaced by any
              keyword, allowing multiple values to be specified.

       VARIABLE[N]
              A variable array. Any number  of  values  can  be  specified  by
              increasing N for each value.

VARIABLES

   NAME
       Syntax: <name>

       Specify  the  name  of  the zone. This must be the same as specified in
       /etc/fiaif/fiaif.conf.

   DEV
       Syntax: <interface-name>

       Specifies the interface name in which this zone is connected.

   DYNAMIC
       Syntax: 0|1

       Specifies whether the IP of the interface is  dynamic  (e.g.,  obtained
       via  DHCP  or  unknown  when  FIAIF  is started) or not. Disabling this
       provides better security, but this is not always an option  given  from
       ISPs.

   GLOBAL
       Syntax: 0|1

       Is  set to one, any packets originating from IANA reserved networks are
       discarded (except those specified in the NET and NET_EXTRA  variables).
       This should be set on your internet connection. If this is set to true,
       the interface cannot have multible zone definitions.

   IP
       Syntax: <IP address>

       The IP of  the  interface.   This  is  only  necessary  to  specify  if
       DYNAMIC=0.

   MASK
       Syntax: <network mask>

       The  network  mask of the network connected to this interface.  This is
       only necessary to specify if DYNAMIC=0.  This information can be  found
       be using the ifconfig command.

   NET
       Syntax: <ip address/networkmask>

       The  network mask for the interface.  This is only necessary to specify
       if DYNAMIC=0.  This information can be  found  be  using  the  ifconfig
       command.

   BCAST
       Syntax: <broadcast address>

       The  broadcast  address  of  the  interface.  This is only necessary to
       specify if DYNAMIC=0.  This information  can  be  found  be  using  the
       ifconfig command.

   IP_EXTRA
       Syntax: [IP]*

       Contains  a  list  of  additional  IP  addresses that the interface can
       receive. Extra IP's for  an  interface  is  usually  created  by  using
       interface aliases (e.g. eth0:0).

   NET_EXTRA
       Syntax: [IP/MASK]*

       A list specifying any extra networks besides the NET variables that are
       connected to this zone (interface). The extra nets  would  normally  be
       connected though other routers.

   DHCP_SERVER
       Syntax: <0|1>

       Set to '1' if the server should accept DHCP queries.  Only one zone per
       interface should have this enabled, since DHCP packets do not hold  any
       valid destination address.

   INPUT[N]
       Syntax:     <ACCEPT|REJECT|DROP|LOG|ACCEPT_LOG|REJECT_NOLOG|DROP_NOLOG>
       <protocol> [port<:port>[<,port>[:port]]*] ip/[mask]=>ip/[mask]

       The INPUT variable describes how packets are handled through the  input
       chain.  Packets  on the INPUT chain are packets coming from the zone to
       the firewall itself. The first argument is  how  a  matched  packet  is
       treated.  Protocol  and  ports  and  ip/mask  are used to match packets
       (destination port, and source=>destination ip  address).  If  none  are
       specified, the rule matches all packets. The port argument must only be
       specified if the protocol is udp, tcp or icmp When using these rules, a
       rule  of  thumb is only to accept specific packets, and to drop any not
       matched. The following  line  1  accepts  HTTP-requests  over  the  TCP
       protocol:

       INPUT[0]="ACCEPT tcp 80 0.0.0.0/0=>0.0.0.0/0"

       INPUT[1]="ACCEPT udp 1024:65535 0.0.0.0/0=>0.0.0.0/0"

       INPUT[2]="DROP ALL 0.0.0.0=>0.0.0.0"

   OUTPUT[N]
       Syntax:     <ACCEPT|REJECT|DROP|LOG|ACCEPT_LOG|REJECT_NOLOG|DROP_NOLOG>
       <protocol> [port<:port>[<,port>[:port]]*] ip/[mask]=>ip/[mask]

       Like the INPUT[N]  rule.  Packets  on  the  OUTPUT  chain  are  packets
       originating  from  the  firewall itself going out into the zone itself.
       ports are destination ports, and ip/mask is the source and  destination
       ip/mask  (if '=>' is not given, the ip is assumed to be the destination
       ip). The port argument must only be specified if the protocol  is  udp,
       tcp or icmp The following example drops all telnet packets over the tcp
       protocol, drops any udp packets, and allows any  other  send  from  the
       firewall itself.

       OUTPUT[0]="DROP tcp 21 0.0.0.0/0=>0.0.0.0/0"

       OUTPUT[1]="DROP udp ALL 0.0.0.0/0=>0.0.0.0/0"

       OUTPUT[2]="ACCEPT ALL 0.0.0.0/0=>0.0.0.0/0"

   FORWARD[N]
       Syntax:                                                      <zone|ALL>
       <ACCEPT|REJECT|DROP|LOG|ACCEPT_LOG|REJECT_NOLOG|DROP_NOLOG>
       <protocol[port<:port>[<,port>[:port]]*]> <ip/[mask]=>ip/[mask]>

       Use to specify how packets arriving from other zones are to be treated.
       If protocol or ports and ip/mask is not specified, then ALL is assumed.
       The  port  specifies  the destination port, and ip specifies the source
       and destination ip. The port argument must only  be  specified  if  the
       protocol  is udp, tcp or icmp An example: A demilitarized zone may only
       accept HTTP requests from  the  internet  (zone  EXT).  This  would  be
       specified by:

       FORWARD[0]="EXT ACCEPT tcp 80 0.0.0.0/0=>0.0.0.0/0"

       FORWARD[1]="ALL DROP ALL 0.0.0.0/0=>0.0.0.0/0"

   MARK[N]
       Syntax:                     <zone|ALL>                    <mark number>
       <protocol[port<:port>[<,port>[:port]]*]> <ip/[mask]=>ip/[mask]>

       Use the MARK rules to  set  a  MARK  on  packets  passing  through  the
       firewall.  This  can  then be used to determine how a packet is routed.
       The port argument must only be specified if the protocol is udp, tcp or
       icmp If the source zone is ALL then all packets going into the zone are
       marked. If the source zone equals the zone-name of which the rule is in
       then only packets originating from the firewall are marked.

       Otherwise,  only  packets  routed  through  the  firewall  are  marked.
       Example: Mark all tcp packets going into the zone with '1' and all  udp
       packets with mark '2'.

       MARK[0]="ALL 1 tcp ALL 0.0.0.0/0=>0.0.0.0/0"

       MARK[1]="ALL 2 udp ALL 0.0.0.0/0=>0.0.0.0/0"

   REPLY_FOO
       Syntax:    <zone>    <type>   <protocol [port[:port][<,port>[:port]]*]>
       <ip[/mask]=>ip[/mask]>

       Make special replies to packets. The type can be one of the following:

       icmp-net-unreachable,   icmp-host-unreachable,   icmp-port-unreachable,
       icmp-proto-unreachable,  icmp-net-prohibited,  icmp-host-prohibited  or
       tcp-reset (Only valid for the TCP protocol).

       The zone argument specifies the source of the packet.

       This can be used, for example, to disallow authentication requests, but
       instead of dropping the packets, close the connection by sending a tcp-
       reset.

       REPLY_AUTH="EXT tcp-reset tcp auth 0.0.0.0/0=>0.0.0.0/0"

   MAC_DROP
       Syntax: [MAC_ADDRESS]*|[file]

       Disallow any communication with specified MAC-addresses in  this  zone.
       Inserted on PREROUTING chain. If the value is a file, then each line in
       the file is treated as an MAC address. Anything after a '#' is regarded
       as a comment and is ignored.

   IP_DROP
       Syntax: [IP/MASK]*|[file]

       Disallow  any  communication  with specified IP addresses in this zone.
       If the value is a file, then each line in the file is treated as an  ip
       address. Anything after a '#' is regarded as a comment and is ignored.

   ECN_REMOVE
       Syntax: [IP/MASK]*|[file]

       Remove  the  ECN bit from all packets destined to the specified servers
       (located in the zone). If the value is a file, then each  line  in  the
       file is treated as an ip address. Anything after a '#' is regarded as a
       comment and is ignored.

   REDIRECT_FOO
       Syntax:         <protocol[port[:port]]>          <ip[/mask]=>ip[/mask]>
       <[ipaddr[,ipaddr]*]> [port]

       Alter  the  destination  of packets.  The rule applies only for packets
       originating from this zone. Packets can be redirected to  the  firewall
       itself  (127.0.0.1),  to  other  zones  or  back  into  the zone itself
       (requires DYNAMIC==0 and GLOBAL==0). If packets are redirected to other
       zones,  then  remember  to add a FORWARD rule in the configuration file
       for the destination zone, allowing the packets to pass through.  Please
       note,  that  redirecting  packets  back into the zone may cause serious
       network degradation.

       Example:

       REDIRECT_PROXY="tcp 80 0.0.0.0/0=>0.0.0.0/0 127.0.0.1 3128"

       All packets coming from the zone itself to port 80  are  redirected  to
       the  firewall  itself  port  3128, and this line can be used to setup a
       transparent proxy.

   WATCH_IP
       Syntax: [IP]*|[file]

       Log every packet coming from or going to the specific IP addresses.  If
       the  value  is  a  file, then each line in the file is treated as an IP
       address. Anything after a '#' is regarded as a comment and is ignored.

   SNAT[N]
       Syntax:       <ZONE|ip>        <protocol[port[:port][<,port>[:port]]*]>
       <ip[/mask]=>ip[/mask]>

       Change  the source address of a packet coming from this zone. If a ZONE
       is specified, then all packets are masqueraded to all ip addresses  for
       the  specified  zone,  specified  by the IP or IP_EXTRA directive, in a
       round robin fashion. The last options specifies the protocol, port  and
       original source and destination of the packets to be SNAT'ed.

       To use MASQUADING, where EXT is the zone for the internet use:

       SNAT[0]="EXT ALL 0.0.0.0/0=>0.0.0.0/0"

   LIMIT_FOO
       Syntax:                                                          <zone>
       <ACCEPT|REJECT|DROP|LOG|ACCEPT_LOG|REJECT_NOLOG|DROP_NOLOG>     <limit>
       <burt> <protocol[port<:port>[<,port>[:port]]*]> <ip[/mask]=>ip[/mask]>

       Limit  number  of  packets. A LIMIT rule specifies how many packets are
       acceptable within the specified period of time. If more packets arrive,
       policy specifies how to handle these.

       zone:  Is  the  zone from which the packet originates. This can be this
       zone itself.

       limit: Maximum average matching rate: specified as a  number,  with  an
       optional ´/second´, ´/minute´, ´/hour´, or ´/day´ suffix.

       burst:  Maximum  initial  number  of packets to match: this number gets
       incremented by one every time the limit specified above is not reached,
       up to this number.

       protocol:  The  protocol: TCP|UDP|ICMP|ALL. This parameter is optional.
       The port argument must only be specified if the protocol is udp, tcp or
       icmp

       ports:  If protocol is tcp|udp: A list of ports or a port range.  icmp:
       A list of icmp types separated by commas. This  parameter  is  optional
       pending on the specified protocol.

       ip[/mask]=>ip[/mask]  Specifies source address and optional destination
       address. This can only be specified if protocol is also specified.

       For example to limit number of echo requests (ping) from zone EXT, use:

       LIMIT_PING="EXT DROP 1/second 3 ICMP echo-request 0.0.0.0/0=>0.0.0.0/0"

   IPSET_FOO
       Syntax: <ip</mask>>[ip</mask>]*| <file>

       Specify a set of ip's to be used in zone rules. Ip's specified  can  be
       either   numbers,  hostnames,  networks  or  names  of  other  ip  sets
       (recursively). The name of the set will  be  the  name  occuring  after
       IPSET_.  Ip  sets  is bound to a zone, and cannot be used across zones.
       Currently, ip-sets can only be used in INPUT,  OUTPUT,  FORWARD,  SNAT,
       REDIRECT  and  MARK rules. If the ipset points to a file, then the file
       is read (relative to CONF_PATH  ).   The  name  of  IP  sets  must  not
       conflict  with  aliases  defined  in the file pointed to by the ALIASES
       directive in fiaif global configuration file.

       An example of the use of IP sets:

       IPSET_NAMESERVERS="1.2.3.4 1.2.3.5"

       INPUT[N]="ACCEPT tcp domain NAMESERVERS=>0.0.0.0/0"

       Which is equivalent to:

       INPUT[N]="ACCEPT tcp domain 1.2.3.4=>0.0.0.0/0"

       INPUT[N+1]="ACCEPT tcp domain 1.2.3.5=>0.0.0.0/0"

AUTHOR

       Anders Fugmann <anders(at)fugmann.net>

SEE ALSO

       fiaif(8), fiaif.conf(8), iptables(8), ifconfig(8)



  All copyrights belong to their respective owners. Other content (c) 2014-2018, GNU.WIKI. Please report site errors to webmaster@gnu.wiki.
Page load time: 0.109 seconds. Last modified: November 04 2018 12:49:43.