Ubuntu Manpage: firehol-defaults.conf - control variables for FireHOL

NAME

       firehol-defaults.conf - control variables for FireHOL

SYNOPSIS

       Defaults in /etc/firehol/firehol-defaults.conf:

       • DEFAULT_INTERFACE_POLICY=“DROP”

       • DEFAULT_ROUTER_POLICY=“RETURN”

       • UNMATCHED_INPUT_POLICY=“DROP”

       • UNMATCHED_OUTPUT_POLICY=“DROP”

       • UNMATCHED_FORWARD_POLICY=“DROP”

       • FIREHOL_INPUT_ACTIVATION_POLICY=“ACCEPT”

       • FIREHOL_OUTPUT_ACTIVATION_POLICY=“ACCEPT”

       • FIREHOL_FORWARD_ACTIVATION_POLICY=“ACCEPT”

       • FIREHOL_LOG_MODE=“LOG”

       • FIREHOL_LOG_LEVEL=see notes

       • FIREHOL_LOG_OPTIONS=“–log-level warning”

       • FIREHOL_LOG_FREQUENCY=“1/second”

       • FIREHOL_LOG_BURST=“5”

       • FIREHOL_LOG_PREFIX=“”

       • FIREHOL_DROP_INVALID=“0”

       • DEFAULT_CLIENT_PORTS=“1000:65535”

       • FIREHOL_NAT=“0”

       • FIREHOL_ROUTING=“0”

       • FIREHOL_AUTOSAVE=see notes

       • FIREHOL_AUTOSAVE6=see notes

       • FIREHOL_LOAD_KERNEL_MODULES=“1”

       • FIREHOL_TRUST_LOOPBACK=“1”

       • FIREHOL_DROP_ORPHAN_TCP_ACK_FIN=“1”

       • FIREHOL_DROP_ORPHAN_TCP_ACK_RST=“1”

       • FIREHOL_DROP_ORPHAN_TCP_ACK=“1”

       • FIREHOL_DROP_ORPHAN_TCP_RST=“1”

       • FIREHOL_DROP_ORPHAN_IPV4_ICMP_TYPE3=“1”

       • WAIT_FOR_IFACE=“”

DESCRIPTION

       From FireHOL 3 upwards, variables which control FireHOL behaviour are held in a separate file: /etc/fire‐
       hol/firehol-defaults.conf.

       Some  variables can also be set in the main firehol.conf file but that is not recommended, since they may
       be used before the main configuration is processed.

       FireHOL also sets some variables before processing the configuration file which you can use  as  part  of
       your configuration.  These are described in firehol.conf(5).

VARIABLES

DEFAULT_INTERFACE_POLICY
This variable controls the default action to be taken on traffic not matched by any rule within an
interface. It can be overridden using firehol-policy(5).

Packets that reach the end of an interface without an action of return or accept are logged. You
can control the frequency of this logging by altering FIREHOL_LOG_FREQUENCY.

Example:

DEFAULT_INTERFACE_POLICY="REJECT"

DEFAULT_ROUTER_POLICY
This variable controls the default action to be taken on traffic not matched by any rule within a
router. It can be overridden using firehol-policy(5).

Packets that reach the end of a router without an action of return or accept are logged. You can
control the frequency of this logging by altering FIREHOL_LOG_FREQUENCY.

Example:

DEFAULT_ROUTER_POLICY="REJECT"

UNMATCHED_{INPUT|OUTPUT|FORWARD}_POLICY
These variables control the default action to be taken on traffic not matched by any interface or
router definition that was incoming, outgoing or for forwarding respectively. Any supported value
from firehol-actions(5) may be set.

All packets that reach the end of a chain are logged, regardless of these settings. You can con‐
trol the frequency of this logging by altering FIREHOL_LOG_FREQUENCY.

Example:

UNMATCHED_INPUT_POLICY="REJECT"
UNMATCHED_OUTPUT_POLICY="REJECT"
UNMATCHED_FORWARD_POLICY="REJECT"

FIREHOL_{INPUT|OUTPUT|FORWARD}_ACTIVATION_POLICY
These variables control the default action to be taken on traffic during firewall activation for
incoming, outgoing and forwarding respectively. Acceptable values are ACCEPT, DROP and REJECT.

FireHOL defaults all values to ACCEPT so that your communications continue to work uninterrupted.

If you wish to prevent connections whilst the new firewall is activating, set these values to
DROP. This is important to do if you are using all or any to match traffic; connections estab‐
lished during activation will continue even if they would not be allowed once the firewall is es‐
tablished.

Example:

FIREHOL_INPUT_ACTIVATION_POLICY="DROP"
FIREHOL_OUTPUT_ACTIVATION_POLICY="DROP"
FIREHOL_FORWARD_ACTIVATION_POLICY="DROP"

FIREHOL_LOG_MODE
This variable controls method that FireHOL uses for logging.

Acceptable values are LOG (normal syslog) and ULOG (netfilter ulogd). When ULOG is selected,
FIREHOL_LOG_LEVEL is ignored.

Example:

FIREHOL_LOG_MODE="ULOG"

To see the available options run: /sbin/iptables -j LOG --help or /sbin/iptables -j ULOG --help

FIREHOL_LOG_LEVEL
This variable controls the level at which events will be logged to syslog.

To avoid packet logs appearing on your console you should ensure klogd only logs traffic that is
more important than that produced by FireHOL.

Use the following option to choose an iptables(8) log level (alpha or numeric) which is higher
than the -c of klogd.

iptables/klogd levels
iptables klogd description
───────────────────────────────────────────────────
emerg (0) 0 system is unusable
alert (1) 1 action must be taken immedi‐
ately
crit (2) 2 critical conditions
error (3) 3 error conditions
warning (4) 4 warning conditions
notice (5) 5 normal but significant con‐
dition
info (6) 6 informational
debug (7) 7 debug-level messages

Note

The default for klogd is generally to log everything (7 and lower) and the default level
for iptables(4) is to log as warning (4).

FIREHOL_LOG_OPTIONS
This variable controls the way in which events will be logged to syslog.

Example:

FIREHOL_LOG_OPTIONS="--log-level info \
--log-tcp-options --log-ip-options"

To see the available options run: /sbin/iptables -j LOG --help

FIREHOL_LOG_FREQUENCY; FIREHOL_LOG_BURST
These variables control the frequency that each logging rule will write events to syslog. FIRE‐
HOL_LOG_FREQUENCY is set to the maximum average frequency and FIREHOL_LOG_BURST specifies the max‐
imum initial number.

Example:

FIREHOL_LOG_FREQUENCY="30/minute"
FIREHOL_LOG_BURST="2"

To see the available options run: /sbin/iptables -m limit --help

FIREHOL_LOG_PREFIX
This value is added to the contents of each logged line for easy detection of FireHOL lines in the
system logs. By default it is empty.

Example:

FIREHOL_LOG_PREFIX="FIREHOL:"

FIREHOL_DROP_INVALID
If set to 1, this variable causes FireHOL to drop all packets matched as INVALID in the ipta‐
bles(8) connection tracker.

You may be better off using firehol-protection(5) to control matching of INVALID packets and oth‐
ers on a per-interface and per-router basis.

Note

Care must be taken on IPv6 interfaces, since ICMPv6 packets such as Neighbour Discovery are
not tracked, meaning they are marked as INVALID.

Example:

FIREHOL_DROP_INVALID="1"

DEFAULT_CLIENT_PORTS
This variable controls the port range that is used when a remote client is specified. For clients
on the local host, FireHOL finds the exact client ports by querying the kernel options.

Example:

DEFAULT_CLIENT_PORTS="0:65535"

FIREHOL_NAT
If set to 1, this variable causes FireHOL to load the NAT kernel modules. If you make use of the
NAT helper commands, the variable will be set to 1 automatically.

Example:

FIREHOL_NAT="1"

FIREHOL_ROUTING
If set to 1, this variable causes FireHOL to enable routing in the kernel. If you make use of
router definitions or certain helper commands the variable will be set to 1 automatically.

Example:

FIREHOL_ROUTING="1"

FIREHOL_AUTOSAVE; FIREHOL_AUTOSAVE6
These variables specify the file of IPv4/IPv6 rules that will be created when firehol(1) is called
with the save argument.

If the variable is not set, a system-specific value is used which was defined at configure-time.
If no value was chosen then the save fails.

Example:

FIREHOL_AUTOSAVE="/tmp/firehol-saved-ipv4.txt"
FIREHOL_AUTOSAVE6="/tmp/firehol-saved-ipv6.txt"

FIREHOL_LOAD_KERNEL_MODULES
If set to 0, this variable forces FireHOL to not load any kernel modules. It is needed only if
the kernel has modules statically included and in the rare event that FireHOL cannot access the
kernel configuration.

Example:

FIREHOL_LOAD_KERNEL_MODULES="0"

FIREHOL_TRUST_LOOPBACK
If set to 0, the loopback device “lo” will not be trusted and you can write standard firewall
rules for it.

Warning

If you do not set up appropriate rules, local processes will not be able to communicate
with each other which can result in serious breakages.

By default “lo” is trusted and all INPUT and OUTPUT traffic is accepted (forwarding is not includ‐
ed).

Example:

FIREHOL_TRUST_LOOPBACK="0"

FIREHOL_DROP_ORPHAN_TCP_ACK_FIN
If set to 1, FireHOL will drop all orphan such packets without logging them.

In busy environments the iptables(8) connection tracker removes connection tracking list entries
as soon as it receives a FIN. This makes the ACK FIN appear as an invalid packet which will nor‐
mally be logged by FireHOL.

Example:

FIREHOL_DROP_ORPHAN_TCP_ACK_FIN="1"

FIREHOL_DROP_ORPHAN_TCP_ACK_RST
If set to 1, FireHOL will drop all orphan such packets without logging them.

In busy environments the iptables(8) connection tracker removes connection tracking list entries
as soon as it receives a RST. This makes the ACK RST appear as an invalid packet which will nor‐
mally be logged by FireHOL.

Example:

FIREHOL_DROP_ORPHAN_TCP_ACK_RST="1"

FIREHOL_DROP_ORPHAN_TCP_ACK
If set to 1, FireHOL will drop all orphan such packets without logging them.

In busy environments the iptables(8) connection tracker removes unneeded connection tracking list
entries. This makes ACK packets appear as an invalid packet which will normally be logged by
FireHOL.

Example:

FIREHOL_DROP_ORPHAN_TCP_ACK="1"

FIREHOL_DROP_ORPHAN_TCP_RST
If set to 1, FireHOL will drop all orphan such packets without logging them.

In busy environments the iptables(8) connection tracker removes unneeded connection tracking list
entries. This makes RST packets appear as an invalid packet which will normally be logged by
FireHOL.

Example:

FIREHOL_DROP_ORPHAN_TCP_RST="1"

FIREHOL_DROP_ORPHAN_IPV4_ICMP_TYPE3
If set to 1, FireHOL will drop all orphan ICMP destination unreachable packets without logging
them.

In busy environments the iptables(8) connection tracker removes unneeded connection tracking list
entries. This makes ICMP destination unreachable appear as an invalid packet which will normally
be logged by FireHOL.

Example:

FIREHOL_DROP_ORPHAN_IPV4_ICMP_TYPE3="1"

WAIT_FOR_IFACE
If set to the name of a network device (e.g. eth0), FireHOL will wait until the device is up (or
until 60 seconds have elapsed) before continuing.

A device does not need to be up in order to have firewall rules created for it, so this option
should only be used if you have a specific need to wait (e.g. the network must be queried to de‐
termine the hosts or ports which will be firewalled).

Example:

WAIT_FOR_IFACE="eth0"

AUTHORS

       FireHOL Team.

FireHOL Reference                               Built 24 Jan 2024                       firehol-defaults.conf(5)

NAME

SYNOPSIS

DESCRIPTION

VARIABLES

SEE ALSO

AUTHORS