bionic (5) firehol-variables.5.gz

Provided by: firehol-doc_3.1.5+ds-1ubuntu1_all bug

NAME

       firehol-defaults.conf - control variables for FireHOL

SYNOPSIS

       Defaults in /etc/firehol/firehol-defaults.conf:

       • DEFAULT_INTERFACE_POLICY="DROP"

       • DEFAULT_ROUTER_POLICY="RETURN"

       • UNMATCHED_INPUT_POLICY="DROP"

       • UNMATCHED_OUTPUT_POLICY="DROP"

       • UNMATCHED_FORWARD_POLICY="DROP"

       • FIREHOL_INPUT_ACTIVATION_POLICY="ACCEPT"

       • FIREHOL_OUTPUT_ACTIVATION_POLICY="ACCEPT"

       • FIREHOL_FORWARD_ACTIVATION_POLICY="ACCEPT"

       • FIREHOL_LOG_MODE="LOG"

       • FIREHOL_LOG_LEVEL=see notes

       • FIREHOL_LOG_OPTIONS="--log-level warning"

       • FIREHOL_LOG_FREQUENCY="1/second"

       • FIREHOL_LOG_BURST="5"

       • FIREHOL_LOG_PREFIX=""

       • FIREHOL_DROP_INVALID="0"

       • DEFAULT_CLIENT_PORTS="1000:65535"

       • FIREHOL_NAT="0"

       • FIREHOL_ROUTING="0"

       • FIREHOL_AUTOSAVE=see notes

       • FIREHOL_AUTOSAVE6=see notes

       • FIREHOL_LOAD_KERNEL_MODULES="1"

       • FIREHOL_TRUST_LOOPBACK="1"

       • FIREHOL_DROP_ORPHAN_TCP_ACK_FIN="1"

       • FIREHOL_DROP_ORPHAN_TCP_ACK_RST="1"

       • FIREHOL_DROP_ORPHAN_TCP_ACK="1"

       • FIREHOL_DROP_ORPHAN_TCP_RST="1"

       • FIREHOL_DROP_ORPHAN_IPV4_ICMP_TYPE3="1"

       • WAIT_FOR_IFACE=""

DESCRIPTION

       From  FireHOL  3  upwards,  variables  which  control  FireHOL  behaviour  are  held  in a separate file:
       /etc/firehol/firehol-defaults.conf.

       Some variables can also be set in the main firehol.conf file but that is not recommended, since they  may
       be used before the main configuration is processed.

       FireHOL  also  sets  some variables before processing the configuration file which you can use as part of
       your configuration.  These are described in firehol.conf(5).

VARIABLES

       DEFAULT_INTERFACE_POLICY
              This variable controls the default action to be taken on traffic not matched by any rule within an
              interface.  It can be overridden using firehol-policy(5).

              Packets  that reach the end of an interface without an action of return or accept are logged.  You
              can control the frequency of this logging by altering FIREHOL_LOG_FREQUENCY.

              Example:

                     DEFAULT_INTERFACE_POLICY="REJECT"

       DEFAULT_ROUTER_POLICY
              This variable controls the default action to be taken on traffic not matched by any rule within  a
              router.  It can be overridden using firehol-policy(5).

              Packets  that reach the end of a router without an action of return or accept are logged.  You can
              control the frequency of this logging by altering FIREHOL_LOG_FREQUENCY.

              Example:

                     DEFAULT_ROUTER_POLICY="REJECT"

       UNMATCHED_{INPUT|OUTPUT|FORWARD}_POLICY
              These variables control the default action to be taken on traffic not matched by any interface  or
              router definition that was incoming, outgoing or for forwarding respectively.  Any supported value
              from firehol-actions(5) may be set.

              All packets that reach the end of a chain are logged,  regardless  of  these  settings.   You  can
              control the frequency of this logging by altering FIREHOL_LOG_FREQUENCY.

              Example:

                     UNMATCHED_INPUT_POLICY="REJECT"
                     UNMATCHED_OUTPUT_POLICY="REJECT"
                     UNMATCHED_FORWARD_POLICY="REJECT"

       FIREHOL_{INPUT|OUTPUT|FORWARD}_ACTIVATION_POLICY
              These  variables  control the default action to be taken on traffic during firewall activation for
              incoming, outgoing and forwarding respectively.  Acceptable values are ACCEPT, DROP and REJECT.

              FireHOL defaults all values to ACCEPT so that your communications continue to work uninterrupted.

              If you wish to prevent connections whilst the new firewall is  activating,  set  these  values  to
              DROP.   This  is  important  to  do  if  you  are  using  all or any to match traffic; connections
              established during activation will continue even if they would not be allowed once the firewall is
              established.

              Example:

                     FIREHOL_INPUT_ACTIVATION_POLICY="DROP"
                     FIREHOL_OUTPUT_ACTIVATION_POLICY="DROP"
                     FIREHOL_FORWARD_ACTIVATION_POLICY="DROP"

       FIREHOL_LOG_MODE
              This variable controls method that FireHOL uses for logging.

              Acceptable  values  are  LOG  (normal  syslog) and ULOG (netfilter ulogd).  When ULOG is selected,
              FIREHOL_LOG_LEVEL is ignored.

              Example:

                     FIREHOL_LOG_MODE="ULOG"

              To see the available options run: /sbin/iptables -j LOG --help or /sbin/iptables -j ULOG --help

       FIREHOL_LOG_LEVEL
              This variable controls the level at which events will be logged to syslog.

              To avoid packet logs appearing on your console you should ensure klogd only logs traffic  that  is
              more important than that produced by FireHOL.

              Use  the  following  option  to choose an iptables(8) log level (alpha or numeric) which is higher
              than the -c of klogd.

              iptables/klogd levels

              iptables      klogd   description
              ───────────────────────────────────────────────────
              emerg (0)     0       system is unusable
              alert (1)     1       action   must    be    taken
                                    immediately
              crit (2)      2       critical conditions
              error (3)     3       error conditions
              warning (4)   4       warning conditions
              notice (5)    5       normal    but    significant
                                    condition
              info (6)      6       informational
              debug (7)     7       debug-level messages

                     Note

                     The default for klogd is generally to log everything (7 and lower) and  the  default  level
                     for iptables(4) is to log as warning (4).

       FIREHOL_LOG_OPTIONS
              This variable controls the way in which events will be logged to syslog.

              Example:

                     FIREHOL_LOG_OPTIONS="--log-level info \
                                          --log-tcp-options --log-ip-options"

              To see the available options run: /sbin/iptables -j LOG --help

       FIREHOL_LOG_FREQUENCY; FIREHOL_LOG_BURST
              These  variables  control  the  frequency  that  each  logging  rule  will write events to syslog.
              FIREHOL_LOG_FREQUENCY is set to the maximum average frequency and FIREHOL_LOG_BURST specifies  the
              maximum initial number.

              Example:

                     FIREHOL_LOG_FREQUENCY="30/minute"
                     FIREHOL_LOG_BURST="2"

              To see the available options run: /sbin/iptables -m limit --help

       FIREHOL_LOG_PREFIX
              This value is added to the contents of each logged line for easy detection of FireHOL lines in the
              system logs.  By default it is empty.

              Example:

                     FIREHOL_LOG_PREFIX="FIREHOL:"

       FIREHOL_DROP_INVALID
              If set to 1, this variable  causes  FireHOL  to  drop  all  packets  matched  as  INVALID  in  the
              iptables(8) connection tracker.

              You  may  be  better  off  using  firehol-protection(5) to control matching of INVALID packets and
              others on a per-interface and per-router basis.

                     Note

                     Care must be taken on IPv6 interfaces, since ICMPv6 packets such as Neighbour Discovery are
                     not tracked, meaning they are marked as INVALID.

              Example:

                     FIREHOL_DROP_INVALID="1"

       DEFAULT_CLIENT_PORTS
              This variable controls the port range that is used when a remote client is specified.  For clients
              on the local host, FireHOL finds the exact client ports by querying the kernel options.

              Example:

                     DEFAULT_CLIENT_PORTS="0:65535"

       FIREHOL_NAT
              If set to 1, this variable causes FireHOL to load the NAT kernel modules.  If you make use of  the
              NAT helper commands, the variable will be set to 1 automatically.

              Example:

                     FIREHOL_NAT="1"

       FIREHOL_ROUTING
              If  set  to  1,  this variable causes FireHOL to enable routing in the kernel.  If you make use of
              router definitions or certain helper commands the variable will be set to 1 automatically.

              Example:

                     FIREHOL_ROUTING="1"

       FIREHOL_AUTOSAVE; FIREHOL_AUTOSAVE6
              These variables specify the file of IPv4/IPv6 rules that will be created when firehol(1) is called
              with the save argument.

              If  the  variable is not set, a system-specific value is used which was defined at configure-time.
              If no value was chosen then the save fails.

              Example:

                     FIREHOL_AUTOSAVE="/tmp/firehol-saved-ipv4.txt"
                     FIREHOL_AUTOSAVE6="/tmp/firehol-saved-ipv6.txt"

       FIREHOL_LOAD_KERNEL_MODULES
              If set to 0, this variable forces FireHOL to not load any kernel modules.  It is  needed  only  if
              the  kernel  has  modules statically included and in the rare event that FireHOL cannot access the
              kernel configuration.

              Example:

                     FIREHOL_LOAD_KERNEL_MODULES="0"

       FIREHOL_TRUST_LOOPBACK
              If set to 0, the loopback device "lo" will not be trusted and  you  can  write  standard  firewall
              rules for it.

                     Warning

                     If  you  do  not  set up appropriate rules, local processes will not be able to communicate
                     with each other which can result in serious breakages.

              By default "lo" is trusted and all INPUT  and  OUTPUT  traffic  is  accepted  (forwarding  is  not
              included).

              Example:

                     FIREHOL_TRUST_LOOPBACK="0"

       FIREHOL_DROP_ORPHAN_TCP_ACK_FIN
              If set to 1, FireHOL will drop all orphan such packets without logging them.

              In  busy  environments the iptables(8) connection tracker removes connection tracking list entries
              as soon as it receives a FIN.  This makes the ACK FIN appear  as  an  invalid  packet  which  will
              normally be logged by FireHOL.

              Example:

                     FIREHOL_DROP_ORPHAN_TCP_ACK_FIN="1"

       FIREHOL_DROP_ORPHAN_TCP_ACK_RST
              If set to 1, FireHOL will drop all orphan such packets without logging them.

              In  busy  environments the iptables(8) connection tracker removes connection tracking list entries
              as soon as it receives a RST.  This makes the ACK RST appear  as  an  invalid  packet  which  will
              normally be logged by FireHOL.

              Example:

                     FIREHOL_DROP_ORPHAN_TCP_ACK_RST="1"

       FIREHOL_DROP_ORPHAN_TCP_ACK
              If set to 1, FireHOL will drop all orphan such packets without logging them.

              In  busy environments the iptables(8) connection tracker removes unneeded connection tracking list
              entries.  This makes ACK packets appear as an invalid packet which  will  normally  be  logged  by
              FireHOL.

              Example:

                     FIREHOL_DROP_ORPHAN_TCP_ACK="1"

       FIREHOL_DROP_ORPHAN_TCP_RST
              If set to 1, FireHOL will drop all orphan such packets without logging them.

              In  busy environments the iptables(8) connection tracker removes unneeded connection tracking list
              entries.  This makes RST packets appear as an invalid packet which  will  normally  be  logged  by
              FireHOL.

              Example:

                     FIREHOL_DROP_ORPHAN_TCP_RST="1"

       FIREHOL_DROP_ORPHAN_IPV4_ICMP_TYPE3
              If  set  to  1,  FireHOL will drop all orphan ICMP destination unreachable packets without logging
              them.

              In busy environments the iptables(8) connection tracker removes unneeded connection tracking  list
              entries.   This makes ICMP destination unreachable appear as an invalid packet which will normally
              be logged by FireHOL.

              Example:

                     FIREHOL_DROP_ORPHAN_IPV4_ICMP_TYPE3="1"

       WAIT_FOR_IFACE
              If set to the name of a network device (e.g.  eth0), FireHOL will wait until the device is up  (or
              until 60 seconds have elapsed) before continuing.

              A  device  does  not  need to be up in order to have firewall rules created for it, so this option
              should only be used if you have a specific need to wait (e.g.  the  network  must  be  queried  to
              determine the hosts or ports which will be firewalled).

              Example:

                     WAIT_FOR_IFACE="eth0"

SEE ALSO

firehol(1) - FireHOL program

       • firehol.conf(5) - FireHOL configuration

       • firehol-nat(5) - nat, snat, dnat, redirect helpers

       • firehol-actions(5) - actions for rules

       • iptables(8) (http://ipset.netfilter.org/iptables.man.html) - administration tool for IPv4 firewalls

       • ip6tables(8) (http://ipset.netfilter.org/ip6tables.man.html) - administration tool for IPv6 firewalls

       • FireHOL Website (http://firehol.org/)

       • FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

       • FireHOL Online Documentation (http://firehol.org/documentation/)

AUTHORS

       FireHOL Team.