src/functions/functions.constants-firewall

   1 #!/bin/bash
   2 ###############################################################################
   3 #                                                                             #
   4 # IPFire.org - A linux based firewall                                         #
   5 # Copyright (C) 2012  IPFire Network Development Team                         #
   6 #                                                                             #
   7 # This program is free software: you can redistribute it and/or modify        #
   8 # it under the terms of the GNU General Public License as published by        #
   9 # the Free Software Foundation, either version 3 of the License, or           #
  10 # (at your option) any later version.                                         #
  11 #                                                                             #
  12 # This program is distributed in the hope that it will be useful,             #
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of              #
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the               #
  15 # GNU General Public License for more details.                                #
  16 #                                                                             #
  17 # You should have received a copy of the GNU General Public License           #
  18 # along with this program.  If not, see <http://www.gnu.org/licenses/>.       #
  19 #                                                                             #
  20 ###############################################################################
  21
  22 # Firewall file configuration
  23 FIREWALL_SETTINGS_DIR="/etc/firewall"
  24 FIREWALL_SETTINGS_FILE="${FIREWALL_SETTINGS_DIR}/settings"
  25
  26 # This variable is used to point to a directory
  27 # in which the iptables ruleset will be generated.
  28 IPTABLES_TMPDIR=
  29
  30 FIREWALL_CONFIG_DIR="/etc/firewall"
  31 FIREWALL_ZONES_DIR="${FIREWALL_CONFIG_DIR}/zones"
  32 FIREWALL_CONFIG_FILE="${FIREWALL_CONFIG_DIR}/config"
  33 FIREWALL_CONFIG_RULES="${FIREWALL_CONFIG_DIR}/rules"
  34
  35 FIREWALL_MACROS_DIRS="${FIREWALL_CONFIG_DIR}/macros"
  36 FIREWALL_MACROS_DIRS="${FIREWALL_MACROS_DIRS} /usr/share/firewall/macros"
  37
  38 # List of parameters which are saved in the configuration file.
  39 FIREWALL_SETTINGS=( "DEBUG" )
  40
  41 # Valid arguments in the rules file.
  42 FIREWALL_RULES_CONFIG_PARAMS="src dst proto action sport dport in out"
  43
  44 # Define the default logging method (nflog or syslog).
  45 FIREWALL_LOG_METHOD="nflog"
  46 FIREWALL_SETTINGS+=( "FIREWALL_LOG_METHOD" )
  47
  48 # Set the default threshold for the nflog method.
  49 FIREWALL_NFLOG_THRESHOLD=30
  50 FIREWALL_SETTINGS+=( "FIREWALL_NFLOG_THRESHOLD" )
  51
  52 # Enable clamping MSS for braindead ISPs which filter ICMP packets.
  53 FIREWALL_CLAMP_PATH_MTU="false"
  54 FIREWALL_SETTINGS+=( "FIREWALL_CLAMP_PATH_MTU" )
  55
  56 # Conntrack: Max. amount of simultaneous connections.
  57 CONNTRACK_MAX_CONNECTIONS="16384"
  58 FIREWALL_SETTINGS+=( "CONNTRACK_MAX_CONNECTIONS" )
  59
  60 # Conntrack: UDP timeout
  61 CONNTRACK_UDP_TIMEOUT="60"
  62 FIREWALL_SETTINGS+=( "CONNTRACK_UDP_TIMEOUT" )
  63
  64 # Use SYN cookies or not
  65 FIREWALL_SYN_COOKIES="true"
  66 FIREWALL_SETTINGS+=( "FIREWALL_SYN_COOKIES" )
  67
  68 # rp_filter
  69 FIREWALL_RP_FILTER="true"
  70 FIREWALL_SETTINGS+=( "FIREWALL_RP_FILTER" )
  71
  72 # Log martians
  73 FIREWALL_LOG_MARTIANS="false"
  74 FIREWALL_SETTINGS+=( "FIREWALL_LOG_MARTIANS" )
  75
  76 # Accept ICMP redirects
  77 FIREWALL_ACCEPT_ICMP_REDIRECTS="false"
  78 FIREWALL_SETTINGS+=( "FIREWALL_ACCEPT_ICMP_REDIRECTS" )
  79
  80 # ECN (Explicit Congestion Notification)
  81 FIREWALL_USE_ECN="true"
  82 FIREWALL_SETTINGS+=( "FIREWALL_USE_ECN" )
  83
  84 # Path MTU discovery
  85 FIREWALL_PMTU_DISCOVERY="true"
  86 FIREWALL_SETTINGS+=( "FIREWALL_PMTU_DISCOVERY" )
  87
  88 # Default TTL
  89 FIREWALL_DEFAULT_TTL="64"
  90 FIREWALL_SETTINGS+=( "FIREWALL_DEFAULT_TTL" )
  91
  92 # Log stealth scans
  93 FIREWALL_LOG_STEALTH_SCANS="true"
  94 FIREWALL_SETTINGS+=( "FIREWALL_LOG_STEALTH_SCANS" )
  95
  96 # Log packets with bad TCP flags
  97 FIREWALL_LOG_BAD_TCP_FLAGS="true"
  98 FIREWALL_SETTINGS+=( "FIREWALL_LOG_BAD_TCP_FLAGS" )
  99
 100 # Log INVALID TCP packets
 101 FIREWALL_LOG_INVALID_TCP="true"
 102 FIREWALL_SETTINGS+=( "FIREWALL_LOG_INVALID_TCP" )
 103
 104 # Log INVALID UDP packets
 105 FIREWALL_LOG_INVALID_UDP="true"
 106 FIREWALL_SETTINGS+=( "FIREWALL_LOG_INVALID_UDP" )
 107
 108 # Log INVALID ICMP packets
 109 FIREWALL_LOG_INVALID_ICMP="true"
 110 FIREWALL_SETTINGS+=( "FIREWALL_LOG_INVALID_ICMP" )
 111
 112 FIREWALL_SUPPORTED_PROTOCOLS="tcp udp icmp igmp esp ah gre"
 113 FIREWALL_PROTOCOLS_SUPPORTING_PORTS="tcp udp"
 114
 115 # Firewall zone settings.
 116 FIREWALL_ZONE_SETTINGS="FRIEND_ZONES MASQUERADE4"
 117
 118 # Default values.
 119 FIREWALL_ZONE_SETTINGS_MASQUERADE4="false"