NAME

       fiaif - FIAIF is an Intelligent Firewall.

SYNOPSIS

       fiaif <start|stop|restart|force-reload|status|panic|tc-start|tc-stop|tc-status>

DESCRIPTION

       Fiaif  deploys  a  packet-filtering  firewall  by  reading  configuration  files and setting up IP packet
       filtering rules using iptables.  The firewall is "zone" based, meaning that  each  network  interface  is
       associated  with  a defined piece of the "IP universe" on the other side of that interface from the host.
       A zone is defined in a text file (the zone configuration file) listing  rules  for  the  handling  of  IP
       traffic  into,  out  of,  and through the associated interface.  The rules spell out which connections to
       accept, which to reject, which to ignore, and which to forward through the firewall.  It is also possible
       to setup source and destination NAT for altering the source and/or destination addresses  of  packets  as
       they pass through.  All non-accepted packets are logged to the system log.

       It  should  be  noted  that  any  packet  related to an already accepted connection is allowed though the
       firewall.

OPTIONS

       start  This will save the current state of netfilter, and apply the new  firewall  as  described  in  the
              configuration files.

       stop   Restores the state saved when FIAIF was started.

       restart
              Same as stop,start

       force-reload
              This  option is the same as start, although it does not use any previously saved rules, and can be
              used even if fiaif has already been started.

       panic  Shut off all IP traffic - don't accept any packets from anywhere for  any  reason.   This  can  be
              used,  for example, if uninvited guests are discovered on the system to quickly close the firewall
              and start analyzing log files.

       status Lists all rules in the firewall.

       test   Instead of deploying the firewall, all rules are written to the file specified in the  "TEST_FILE"
              parameter  in  the  global  configuration  file.  This  command  also  runs  a sanity check on the
              networking configuration.  Any problems or warnings arising from this check are printed to STDERR.
              Refer  to  http://www.linuxhq.com/kernel/v2.4/doc/networking/ip-sysctl.txt.html  for  details   on
              settings  tested. When deployed, FIAIF can automatically fix the warnings and/or errors displayed.
              Please see fiaif.conf(8) for more information.

FILES

       /etc/fiaif/fiaif.conf
              The global configuration file. See fiaif.conf(8) for further details.

       /var/lib/fiaif/fiaif
              file containing rules generated by fiaif.
       /var/lib/fiaif/iptables
              previous netfilter state

       /var/lib/fiaif/sysctl
              previous state of /proc before fiaif was started.

       /var/log/messages
              All illegal packets are logged to this file though syslog(3)

DIAGNOSTICS

       Errors are logged to STDOUT. If any errors is printed, then please recheck your configuration files.

ENVIRONMENT

       If the NO_CLEANUP variable is set to a non-empty value, then rules are not  cleaned  up  after  FIAIF  is
       started.  This  will speed up FIAIF startup time, but at the cost of having lots of rules and performance
       may (on small systems with many zones) be affected. On a three zone system FIAIF generated in  total  310
       rules. After cleaning up the rules, the number of rules was down to 241. A reduction of 22%.

       The  FIAIF_CONF  can  be  used  to specify an anternative global configurationfile, rather than using the
       default /etc/fiaif/fiaif.conf. This can  be  used  to  ease  switching  between  two  different  firewall
       configurations.

BUGS

       The  test  command  line option is no guarantee that the firewall will perform as expected, only that the
       syntax is correct. Only limited semantic checks of rulesis performed.

REPORTING BUGS

       Report bugs to <fiaif@fiaif.net>.

AUTHOR

       Anders Fugmann <anders(at)fugmann.net>

SEE ALSO

       fiaif.conf(8), zone.conf(8), iptables(8), syslog(3)

Linux                                               Dec 2003                                            FIAIF(8)