NAME

       uif.conf - default configuration file for the Universal Internet Firewall

DESCRIPTION

       /etc/uif/uif.conf  is  the default configuration file for uif(8).  This file may contain several sections
       and comments. Each section begins with the section name and the left curly brace and ends with the  right
       curly  brace  in  a  single line. A comment starts with a hash mark (#) at the beginning of a line. Blank
       lines are silently ignored.

       The following sections are valid: include, include4, include6, sysconfig,  service,  network,  interface,
       Imarker, filter, nat, input, output, forward, masquerade and stateless.

       The  sections  service,  network,  marker and interface have all a very similar syntax.  Each line starts
       with an identifier followed by one or more blanks and one or more section  specific  entries  or  defined
       identifiers  separated  by blanks.  A valid identifier is case sensitive and consists of letters, digits,
       underscores and hyphens.

       If two or more identifiers in one section are equal, the corresponding entries are merged  to  the  first
       identifier.  Hence,  it's not possible to overwrite previously defined identifiers. As a result the order
       of the section entries is irrelevant and it's possible to define a section more than once.

   include section
       Include other configuration files. Each line in this section, enclosed in quotation marks ("), must be  a
       valid  filename or a valid file globbing pattern (it is ok, if no files match this pattern). The contents
       of this file / these files are added to the actual configuration and each file should  contain  at  least
       one section (a comment only file is not really useful...).

   include4 section
       Include other configuration files but ONLY in IPv4 mode (WITHOUT -6 switch to uif).  Otherwise equivalent
       to the include section above.

   include6 section
       Include other configuration files but ONLY in IPv6 mode (WITH -6 switch to uif).  Otherwise equivalent to
       the include section above.

   sysconfig section
       Set some global settings. Each line in this section starts with one of the following identifiers followed
       by one or more blanks and the desired value: LogLevel, LogPrefix, LogLimit,  LogBurst,  Limit,  Burst  or
       AccountPrefix.  If there are multiple definitions of one entry the last definition is stored.

       LogLevel
              A valid default log priority (see syslog.conf(5)).

       LogPrefix
              The default log prefix. Each netfilter (or iptables) log message starts with this prefix.

       LogLimit
              The default limit value for log messages (see nft(8) or iptables(8)).

       LogBurst
              The default burst value for log messages (see nft(8) or iptables(8)).

       Limit  The default limit value (see nft(8) or iptables(8)).

       Burst  The default burst value (see nft(8) or iptables(8)).

       AccountPrefix
              The default prefix for accounting chains.

   service section
       This  section  defines  all  needed  services.  A  service  description  starts  with  the  protocol (see
       protocols(5)) followed by parameters in parenthesis. Most protocols don't need any parameters.  The  only
       exceptions  are  tcp,  udp  and  icmp.  The  tcp  and  udp  parameters define the source and destionation
       port(-range). The source and destination ports are separated by a slash (/) and port ranges are separated
       by  a  colon  (eg.  tcp(123:333/99): tcp protocol, source port range 123-333, destination port 99). Empty
       source or destination ports are expanded to 1:65535. The icmp protocol parameter must  be  a  valid  icmp
       type (see iptables -p icmp --help).

   network section
       This  section  defines  all  needed  networks  and  hosts. A network description starts with a valid IPv4
       address (dotted quad), a valid IPv6 address (colon syntax,  square  brackets  not  needed),  an  optional
       netmask  in  cidr  notation  (number of bits) or an optional MAC-address (with a prefixed equal sign (=).
       Some valid entries are: 127.0.0.1, 127.0.0.0/8, ::1, fd00:1:2:3::/64,
        and 192.168.0.1=00:00:00:00:00:FF.

   interface section
       This section defines all needed (physical and bridged) interfaces (eg. eth0, lo, ppp0).

   marker section
       This section defines all needed numerical (decimal) values for packet marking purposes.

   filter, nat, input, output, forward, masquerade and stateless sections
       Due to better partitioning of the packetfilter, rules can be split into these sections.  Internally  they
       are equivalent and contain all rules. As an exception to all other sections the order of entries in these
       sections is important.

       The default policy for the chains INPUT, OUTPUT and FORWARD is DROP (see nft(8) or iptables(8)) and  it's
       not possible to change this.

       Each  line  in in this section begins with in, out, fw, nat, masq, slin, slout or  slfw, followed by '+',
       '-' or a mark identifier enclosed in curly braces (or, in case of fw followed by '>').   The  identifiers
       in,  out and fw define rules for incoming, outgoing and forwarded IP-packets. Each packet with an INVALID
       state (see nft(8) or iptables(8)) is matched by slin, slout and slfw.  The lines starting  with  nat  and
       masq define rules to modify the source or destination address or the destination port.

       Note:  The  identifiers nat and masq are non-operational in IPv6 mode. They simply get ignored as NAT and
       Masquerading are not supported by the IPv6 protocol.

       The plus and minus signs specify the type of the rule: '+' accepts matching packets and '-'  drops  them.
       As  a special case the identifier out and fw accept the greater than (>) sign to modify the MSS depending
       on the PMTU (see iptables(8)).

       A very basic ruleset may look like this: out+

       This allows every outgoing traffic and rejects all incoming connections (because of the default policy).

       To be more specific, each line may contain several  parameters.  Each  parameter  starts  with  a  single
       character  followed  by  an  equal  sign  (=)  and  one  or  more  previously defined identifiers (in the
       corresponding sections) separated by commas. The following parameters are valid:

       s      The source address or network. Append "(4)" or "(6)" to the network name to make this  rule  apply
              to IPv4 or IPv6 only.

       d      The  destination  address  or network. Append "(4)" or "(6)" to the network name to make this rule
              apply to IPv4 or IPv6 only.

       i      The input interface.

       o      The output interface.

       pi     The physical input interface (only useful when used with bridged interfaces,  not  supported  with
              nft as deprecated there).

       po     The  physical  output interface (only useful when used with bridged interfaces, not supported with
              nft as deprecated there).

       p      The service description (protocol).

       m      The mark field associated with a packet.

       S      The the new source address in nat rules. Supported in IPv4 mode only. Ignored in IPv6 mode.

       D      The the new destination address in nat rules. Supported in IPv4 mode only. Ignored in IPv6 mode.

       P      The the new service description in nat rules. This is only valid with tcp or udp packets.

       f      This parameter sets some 'flags'. A flag definition starts with the flag identifier  and  optional
              parameters in parenthesis. Valid flags are:

       log  -  Logs matching packages to syslog. The given parameter is included in the log entry. The number of
       logged packets and the loglevel can be set in the sysconfig section.

       reject - Only valid in DROP rules. This is used to send back an error packet in response to  the  matched
       packet.   The   default   behaviour   is   a   packet  with  set  RST  flag  on  tcp  connections  and  a
       destination-unreachable icmp packet in every other case. Valid parameters are listed  in  iptables(8)  in
       the REJECT section.

       account  -  Create  an  accounting  chain for all matching packages and possible responses.  The optional
       parameter is a part of the name of the chain.

       limit - Limits the number of matching packets. The default values are set in the sysconfig section. Other
       values  can  be  defined  with  the  optional parameter.  The first entry sets a new limit and the second
       parameter (separated by a comma (,)) sets the burst value (see Limit and Burst in sysconfig section).

       It's possible to invert the identifier of one of following parameters - if  it  expands  to  ecactly  one
       object - by prepending a exclamation mark (!): s, d, i, o, p (eg.: s=!local p=!http).

FILES

       Configuration    files    are    located    in   /etc/uif.   There   is   a   sample   configuration   in
       /usr/share/doc/uif/uif.conf.tmpl.gz.

SEE ALSO

       nft(8) iptables(8) uif(8)

AUTHOR

       This  manual  page   was   written   by   Jörg   Platte   <joerg.platte@gmx.de>   and   Cajus   Pollmeier
       <pollmeier@gonicus.de>,  and  has  been  adjusted  for  nft  support  by  Mike Gabriel <mike.gabriel@das-
       netzwerkteam.de>.