2 ###############################################################################
4 # IPFire.org - A linux based firewall #
5 # Copyright (C) 2012 IPFire Network Development Team #
7 # This program is free software: you can redistribute it and/or modify #
8 # it under the terms of the GNU General Public License as published by #
9 # the Free Software Foundation, either version 3 of the License, or #
10 # (at your option) any later version. #
12 # This program is distributed in the hope that it will be useful, #
13 # but WITHOUT ANY WARRANTY; without even the implied warranty of #
14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the #
15 # GNU General Public License for more details. #
17 # You should have received a copy of the GNU General Public License #
18 # along with this program. If not, see <http://www.gnu.org/licenses/>. #
20 ###############################################################################
22 # This variable is used to point to a directory
23 # in which the iptables ruleset will be generated.
26 FIREWALL_CONFIG_DIR
="/etc/firewall"
27 FIREWALL_ZONES_DIR
="${FIREWALL_CONFIG_DIR}/zones"
28 FIREWALL_CONFIG_FILE
="${FIREWALL_CONFIG_DIR}/config"
29 FIREWALL_CONFIG_RULES
="${FIREWALL_CONFIG_DIR}/rules"
31 FIREWALL_MACROS_DIRS
="${FIREWALL_CONFIG_DIR}/macros"
32 FIREWALL_MACROS_DIRS
="${FIREWALL_MACROS_DIRS} /usr/share/firewall/macros"
34 # List of parameters which are saved in the configuration file.
35 FIREWALL_CONFIG_PARAMS
=""
37 # Valid arguments in the rules file.
38 FIREWALL_RULES_CONFIG_PARAMS
="src dst proto action sport dport in out"
40 # Define the default logging method (nflog or syslog).
41 FIREWALL_LOG_METHOD
="nflog"
42 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_METHOD"
44 # Set the default threshold for the nflog method.
45 FIREWALL_NFLOG_THRESHOLD
=30
46 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_NFLOG_THRESHOLD"
48 # Enable clamping MSS for braindead ISPs which filter ICMP packets.
49 FIREWALL_CLAMP_PATH_MTU
="false"
50 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_CLAMP_PATH_MTU"
52 # Conntrack: Max. amount of simultaneous connections.
53 CONNTRACK_MAX_CONNECTIONS
="16384"
54 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} CONNTRACK_MAX_CONNECTIONS"
56 # Conntrack: UDP timeout
57 CONNTRACK_UDP_TIMEOUT
="60"
58 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} CONNTRACK_UDP_TIMEOUT"
60 # Use SYN cookies or not
61 FIREWALL_SYN_COOKIES
="true"
62 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_SYN_COOKIES"
65 FIREWALL_RP_FILTER
="true"
66 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_RP_FILTER"
69 FIREWALL_LOG_MARTIANS
="false"
70 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_MARTIANS"
72 # Accept ICMP redirects
73 FIREWALL_ACCEPT_ICMP_REDIRECTS
="false"
74 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_ACCEPT_ICMP_REDIRECTS"
76 # ECN (Explicit Congestion Notification)
77 FIREWALL_USE_ECN
="false"
78 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_USE_ECN"
81 FIREWALL_PMTU_DISCOVERY
="true"
82 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_PMTU_DISCOVERY"
85 FIREWALL_DEFAULT_TTL
="64"
86 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_DEFAULT_TTL"
89 FIREWALL_LOG_STEALTH_SCANS
="true"
90 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_STEALTH_SCANS"
92 # Log packets with bad TCP flags
93 FIREWALL_LOG_BAD_TCP_FLAGS
="true"
94 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_BAD_TCP_FLAGS"
96 # Log INVALID TCP packets
97 FIREWALL_LOG_INVALID_TCP
="true"
98 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_INVALID_TCP"
100 # Log INVALID UDP packets
101 FIREWALL_LOG_INVALID_UDP
="true"
102 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_INVALID_UDP"
104 # Log INVALID ICMP packets
105 FIREWALL_LOG_INVALID_ICMP
="true"
106 FIREWALL_CONFIG_PARAMS
="${FIREWALL_CONFIG_PARAMS} FIREWALL_LOG_INVALID_ICMP"
108 FIREWALL_SUPPORTED_PROTOCOLS
="tcp udp icmp igmp esp ah gre"
109 FIREWALL_PROTOCOLS_SUPPORTING_PORTS
="tcp udp"
111 # Firewall zone settings.
112 FIREWALL_ZONE_SETTINGS
="FRIEND_ZONES MASQUERADE4"
115 FIREWALL_ZONE_SETTINGS_MASQUERADE4
="false"