Provided by: firehol-doc_3.1.7+ds-2.1_all bug

NAME

       firehol-actions - actions for rules

SYNOPSIS

       accept

       accept    with    hashlimit   name   upto|above   amount/period   [burst   amount]   [mode
       {srcip|srcport|dstip|dstport},...] [srcmask prefix] [dstmask prefix] [htable-size buckets]
       [htable-max entries] [htable-expire msec] [htable-gcinterval msec]

       accept with connlimit upto|above limit [mask mask] [saddr|daddr]

       accept with limit requests/period burst [overflow action]

       accept with recent name seconds hits

       accept with knock name

       reject [with message]

       drop | deny

       return

       tarpit

DESCRIPTION

       These actions are the actions to be taken on traffic that has been matched by a particular
       rule.

       FireHOL will also pass  through  any  actions  that  iptables(8)  accepts,  however  these
       definitions  provide lowercase versions which accept arguments where appropriate and which
       could otherwise not be passed through.

              Note

              The iptables(8) LOG action is best used through the  optional  rule  parameter  log
              since  the  latter can be combined with one of these actions (FireHOL will generate
              multiple firewall rules to make this happen).  For more  information  see  log  and
              loglimit.

       The following actions are defined:

   accept
       accept allows the traffic matching the rules to reach its destination.

       For example, to allow SMTP requests and their replies to flow:

              server smtp accept

   accept    with    hashlimit    name    upto|above    amount/period    [burst   amount]   [mode
       {srcip|srcport|dstip|dstport},...] [srcmask prefix] [dstmask prefix] [htable-size buckets]
       [htable-max entries] [htable-expire msec] [htable-gcinterval msec]
       hashlimit  hashlimit  uses  hash  buckets to express a rate limiting match (like the limit
       match) for a group of connections using a single iptables rule.  Grouping can be done per-
       hostgroup (source and/or destination address) and/or per-port.

       name The name for the /proc/net/ipt_hashlimit/name entry.

       upto   amount[/second|/minute|/hour|/day]   Match  if  the  rate  is  below  or  equal  to
       amount/quantum.  It is specified either as a number, with an optional time quantum  suffix
       (the default is 3/hour).

       above amount[/second|/minute|/hour|/day] Match if the rate is above amount/quantum.

       burst amount Maximum initial number of packets to match: this number gets recharged by one
       every time the limit specified above is not reached, up to this number; the default is  5.
       This  option  should be used with caution - if the entry expires, the burst value is reset
       too.

       mode {srcip|srcport|dstip|dstport},... A comma-separated list  of  objects  to  take  into
       consideration.  If no mode option is given, srcip,dstport is assumed.

       srcmask  prefix  When –hashlimit-mode srcip is used, all source addresses encountered will
       be grouped according to the given prefix length and the so-created subnet will be  subject
       to  hashlimit.   prefix  must  be  between  (inclusive)  0 and 32.  Note that srcmask 0 is
       basically doing the same thing as not specifying srcip for mode, but is  technically  more
       expensive.

       dstmask prefix Like srcmask, but for destination addresses.

       htable-size buckets The number of buckets of the hash table

       htable-max entries Maximum entries in the hash.

       htable-expire msec After how many milliseconds do hash entries expire.

       htable-gcinterval msec How many milliseconds between garbage collection intervals.

       Examples:

       Allow up to 5 connections per second per client to SMTP server:

              server smtp accept with hashlimit smtplimit upto 5/s

       You can monitor it using the file /proc/net/ipt_hashlimit/smtplimit

   accept with connlimit upto|above limit [mask mask] [saddr|daddr]
       accept with connlimit matches on the number of connections per IP.

       saddr  matches  on  source IP.  daddr matches on destination IP.  mask groups IPs with the
       mask given upto matches when the number of connections is up  to  the  given  limit  above
       matches when the number of connections above to the given limit

       The  number of connections counted are system wide, not service specific.  For example for
       saddr, you cannot connlimit 2 connections for SSH and 4 for  SMTP.   If  you  connlimit  2
       connections for SSH, then the first 2 connections of a client can be SSH.  If a client has
       already 2 connections to another service, the client will not be able to connect to SSH.

       So, connlimit can safely be used:

       • with daddr to limit the connections a server can accept

       • with saddr to limit the total connections per client to all services.

   accept with limit requests/period burst [overflow action]
       accept with limit allows the traffic, with new connections limited to requests/period with
       a maximum burst.  Run iptables -m limit --help for more information.

       The  default  overflow  action  is  to  REJECT  the excess connections (DROP would produce
       timeouts on otherwise valid service clients).

       Examples:

              server smtp accept with limit 10/sec 100

              server smtp accept with limit 10/sec 100 overflow drop

   accept with recent name seconds hits
       accept with recent allows the traffic matching the rules to reach its destination, limited
       per remote IP to hits per seconds.  Run iptables -m recent --help for more information.

       The name parameter is used to allow multiple rules to share the same table of recent IPs.

       For  example,  to  allow  only  2  connections every 60 seconds per remote IP, to the smtp
       server:

              server smtp accept with recent mail 60 2

              Note

              When a new connection is not allowed, the traffic will continue to  be  matched  by
              the rest of the firewall.  In other words, if the traffic is not allowed due to the
              limitations set here, it is not dropped, it is just not matched by this rule.

   accept with knock name
       accept      with      knock      allows      easy      integration       with       knockd
       (http://www.zeroflux.org/projects/knock/),  a  server that allows you to control access to
       services by sending certain packets to “knock” on the door, before the door is opened  for
       service.

       The  name  is  used  to  build  a special chain knock_<name> which contains rules to allow
       established connections to work.  If knockd has not allowed new  connections  any  traffic
       entering  this  chain  will just return back and continue to match against the other rules
       until the end of the firewall.

       For example, to allow HTTPS requests based on a knock write:

              server https accept with knock hidden

       then configure knockd to enable the HTTPS service with:

              iptables -A knock_hidden -s %IP% -j ACCEPT

       and disable it with:

              iptables -D knock_hidden -s %IP% -j ACCEPT

       You can use the same knock name in more than one FireHOL rule to  enable/disable  all  the
       services based on a single knockd configuration entry.

              Note

              There  is  no  need to match anything other than the IP in knockd.  FireHOL already
              matches everything else needed for its rules to work.

   reject
       reject discards the traffic matching the rules and sends a rejecting message back  to  the
       sender.

   reject with message
       When  used  with  with  the  specific message to return can be specified.  Run iptables -j
       REJECT --help for a list of the --reject-with values which can be used for  message.   See
       REJECT WITH MESSAGES for some examples.

       The  default (no message specified) is to send tcp-reset when dealing with TCP connections
       and icmp-port-unreachable for all other protocols.

       For example:

              UNMATCHED_INPUT_POLICY="reject with host-prohib"

              policy reject with host-unreach

              server ident reject with tcp-reset

   drop; deny
       drop discards the traffic matching the rules.  It does so silently  and  the  sender  will
       need to timeout to conclude it cannot reach the service.

       deny  is  a  synonym  for  drop.  For example, either of these would silently discard SMTP
       traffic:

              server smtp drop

              server smtp deny

   return
       return will return the flow of processing to the parent of the current command.

       Currently, the only time return can be used meaningfully  used  is  as  a  policy  for  an
       interface   definition.    Unmatched  traffic  will  continue  being  processed  with  the
       possibility of being matched by a later definition.  For example:

              policy return

   tarpit
       tarpit captures and holds incoming TCP connections open.

       Connections are accepted and immediately switched to the persist state (0 byte window), in
       which the remote side stops sending data and asks to continue every 60-240 seconds.

       Attempts  to  close  the  connection  are ignored, forcing the remote side to time out the
       connection after 12-24 minutes.

       Example:

              server smtp tarpit

              Note

              As the kernel conntrack modules are always loaded by FireHOL,  some  per-connection
              resources      will      be      consumed.       See      this      bug      report
              (http://bugs.sanewall.org/sanewall/issues/10) for details.

       The following actions also exist but should not be used under normal circumstances:

   mirror
       mirror returns the traffic it receives by switching the  source  and  destination  fields.
       REJECT will be used for traffic generated by the local host.

              Warning

              The  MIRROR  target  was  removed  from  the  Linux  kernel  due  to  its  security
              implications.

              MIRROR is dangerous; use it with care and only  if  you  understand  what  you  are
              doing.

   redirect; redirect to-port port
       redirect is used internally by FireHOL helper commands.

       Only FireHOL developers should need to use this action directly.

REJECT WITH MESSAGES

       The following RFCs contain information relevant to these messages:

       • RFC 1812 (http://www.ietf.org/rfc/rfc1812.txt)

       • RFC 1122 (http://www.ietf.org/rfc/rfc1122.txt)

       • RFC 792 (http://www.ietf.org/rfc/rfc0792.txt)

       icmp-net-unreachable; net-unreach
         ICMP network unreachable

         Generated  by  a  router  if a forwarding path (route) to the destination network is not
         available.

         From RFC 1812, section 5.2.7.1.  See RFC 1812 and RFC 792.

                Note

                Use with care.  The sender and  the  routers  between  you  and  the  sender  may
                conclude  that the whole network your host resides in is unreachable, and prevent
                other traffic from reaching you.

       icmp-host-unreachable; host-unreach
         ICMP host unreachable

         Generated by a router if a forwarding path (route) to the destination host on a directly
         connected network is not available (does not respond to ARP).

         From RFC 1812, section 5.2.7.1.  See RFC 1812 and RFC 792.

                Note

                Use  with  care.   The  sender  and  the  routers  between you and the sender may
                conclude that your host is entirely unreachable, and prevent other  traffic  from
                reaching you.

       icmp-proto-unreachable; proto-unreach
         ICMP protocol unreachable

         Generated  if  the  transport  protocol designated in a datagram is not supported in the
         transport layer of the final destination.

         From RFC 1812, section 5.2.7.1.  See RFC 1812 and RFC 792.

       icmp-port-unreachable; port-unreach
         ICMP port unreachable

         Generated if the designated transport protocol  (e.g. TCP,  UDP,  etc.)   is  unable  to
         demultiplex  the  datagram  in  the  transport layer of the final destination but has no
         protocol mechanism to inform the sender.

         From RFC 1812, section 5.2.7.1.  See RFC 1812 and RFC 792.

         Generated by hosts to indicate that the required port is not active.

       icmp-net-prohibited; net-prohib
         ICMP communication with destination network administratively prohibited

         This code was intended for use by end-to-end encryption devices used by  U.S.   military
         agencies.   Routers SHOULD use the newly defined Code 13 (Communication Administratively
         Prohibited) if they administratively filter packets.

         From RFC 1812, section 5.2.7.1.  See RFC 1812 and RFC 1122.

                Note

                This message may not be widely understood.

       icmp-host-prohibited; host-prohib
         ICMP communication with destination host administratively prohibited

         This code was intended for use by end-to-end encryption devices used by  U.S.   military
         agencies.   Routers SHOULD use the newly defined Code 13 (Communication Administratively
         Prohibited) if they administratively filter packets.

         From RFC 1812, section 5.2.7.1.  See RFC 1812 and RFC 1122.

                Note

                This message may not be widely understood.

       tcp-reset
         TCP RST

         The port unreachable message of the TCP stack.

         See RFC 1122.

                Note

                tcp-reset is useful when you want to prevent timeouts on  rejected  TCP  services
                where the client incorrectly ignores ICMP port unreachable messages.

SEE ALSO

firehol(1) - FireHOL program

       • firehol.conf(5) - FireHOL configuration

       • firehol-interface(5) - interface definition

       • firehol-router(5) - router definition

       • firehol-params(5) - optional rule parameters

       • FireHOL Website (http://firehol.org/)

       • FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

       • FireHOL Online Documentation (http://firehol.org/documentation/)

AUTHORS

       FireHOL Team.