Ubuntu Manpage: nufw - NUFW User filtering gateway server

NAME

       nufw - NUFW User filtering gateway server

SYNOPSIS

       nufw  [ -h ] [ -V ] [ -D ] [ -m ] [ -v[v...] ] [ -s ] [ -S ] [ -N ] [ -A debug_area ] [ -k
       keyfile ] [ -c certfile ] [ -a cafile ] [ -r crlfile ] [ -n nuauth_cert_dn ] [ -d  address
       ]  [  -p  (remote)  port  ]  [  -t  timeout  ]  [  -T track_size ] [ -q NfQueue_num ] [ -L
       Nfqueue_length ] [ -C ] [ -M ]

DESCRIPTION

       This manual page documents the nufw command.

       nufw is the minimalist server, designed to run on the gateway(s) of the network.  nufw  is
       designed  to  run  in  conjunction  with  nuauth, the authenticating server. nufw receives
       network packets from the local firewall (on Linux 2.4 and 2.6, this is  set  up  with  the
       help  of  '-j  NFQUEUE'  or  '-j  QUEUE' netfilter target), and synchronizes with a nuauth
       server to check packet is authorized to travel through the gateway.

       The design of the NUFW package lets administrator filter network  traffic  per  user,  not
       only per IP. This means you can now deal with different permissions for user A and user B,
       even if they work at the same moment, on the same multiuser machine. In other words,  this
       extends firewalling criteria to userID, at the network scale.

       Original packaging and informations and help can be found from http://www.nufw.org/

OPTIONS

-h Issues usage details and exits.

-V Issues version and exits.

-D Run as a daemon. If started as a daemon, nufw logs message to syslog. If you don't
specify this option, messages go to the console nufw is running on, both on STDOUT
and STDERR. Unless you are debugging something, you should run nufw with this
option.

-m Mark packets with UserID. This requires the wvmark POM patch applied to netfilter,
and is necessary for per user QoS or routing.

-v Increases debug level. Multiple switches are accepted and each of them increases
the debug level by one. Default debug level is 2, max is 10.

-A debug_areas
Chooses debug_area. Default debug area is ALL. To select a subset add value from
the following list:

• DEBUG_AREA_MAIN (1) main domain

• DEBUG_AREA_PACKET (2) packet domain

• DEBUG_AREA_USER (4) user domain

• DEBUG_AREA_GW (8) Gateway domain, interaction with nufw servers.

• DEBUG_AREA_AUTH (16) Authentication domain

-k keyfile
Use specified file as SSL (private) key file.

-c certfile
Use specified file as SSL (public) certificate file.

-a cafile
Use specified file as SSL certificate authority file.

-r crlfile
Use specified file as SSL certificate revocation list file. You will need to
restart nufw if you modify this file. Since 2.2.19, nufw reloads this file
dynamically when receiving a HUP signal.

-n nuauth_dn
Use specified string as the needed DN of nuauth. nufw will refuse to connect if the
provided string does not match the DN of the certificate provided by nuauth. If you
do not use this option, the DN of the nuauth certificate will be checked against
the fully qualified domain name of the nuauth server, obtained from a reverse DNS
lookup on nuauth IP address.

-s Disable strict TLS checking of the certificate provided by nuauth.

-S Force strict TLS checking of the certificate provided by nuauth. This is the
default behavior of the daemon since 2.2.18.

-N Suppress error if server FQDN does not match certificate CN.

-d address
Network address of the nuauth server.

-p port
Specifies TCP port to send data to when addressing the nuauth server. Nuauth server
must be setup to listen on that port. Default value : 4128

-t seconds
Specifies timeout to forget packets not answered for by nuauth. Default value : 15
s.

-T track_size
Set maximum number of packets that can wait a decision in nufw. Default value :
1000.

-q NfQueue number
If Nufw was compiled with NfQueue support, Id of the NfQueue to use (default : 0).

-L NfQueue length
Specify the length of the nfnetlink queue used by nufw. This is the number of
packets that the kernel will keep internally before dropping new coming packets.

-C Listen to conntrack events (needed for connection expiration).

-M Only report event on marked connections to nuauth (implies -C and -m)

This is the way to do an efficient selection of events to be sent to nuauth but
this REQUIRES a kernel with transmit_mark applied (should be ok for 2.6.18+) and
the use of CONNMARK to propagate the initial mark across all the packets of the
connection.

SIGNALS

       The  nufw  daemon  is  designed  to deal with several signals : USR1, USR2, SYS, WINCH and
       POLL.

       USR1   Increases verbosity. The daemon then acts as if  it  had  been  launched  with  one
              supplementary  '-v'.A  line  is  also added to the system log to mention the signal
              event.

       USR2   Decreases verbosity. The daemon then acts as if it had been launched with one  less
              '-v'. A line is also added to the system log to mention the signal event.

       SYS    Removes  the  Conntrack  events thread. This gets the daemon to work as if the "-C"
              switch had not been set. This is useful on HA  configurations,  when  one  firewall
              gets passive, for instance.

       WINCH  Starts  the  Conntrack  events  thread. This gets the daemon to work as if the "-C"
              switch had been set at startup. This is  useful  on  HA  configurations,  when  one
              firewall gets active, for instance.

       POLL   Logs an "audit" line, mentionning how many network datagrams were received and sent
              since daemon startup.

AUTHOR