From 66fe74f95f4da254fc1162c591a40012c17aab07 Mon Sep 17 00:00:00 2001 From: Michael Tremer Date: Sun, 30 Sep 2018 21:16:10 +0200 Subject: [PATCH] man: Convert firewall-settings to asciidoc Signed-off-by: Michael Tremer --- man/firewall-settings.txt | 97 +++++++++++++ man/firewall-settings.xml | 284 -------------------------------------- 2 files changed, 97 insertions(+), 284 deletions(-) create mode 100644 man/firewall-settings.txt delete mode 100644 man/firewall-settings.xml diff --git a/man/firewall-settings.txt b/man/firewall-settings.txt new file mode 100644 index 00000000..20038e39 --- /dev/null +++ b/man/firewall-settings.txt @@ -0,0 +1,97 @@ +firewall-settings(8) +==================== + +NAME +---- +firewall-settings - Global firewall settings + +SYNOPSIS +-------- +[verse] +'firewall settings' +'firewall settings' KEY=VALUE ... + +DESCRIPTION +----------- +This command is used to set global firewall settings. +Please have a look at the individual man pages for more options. + +COMMANDS +-------- +If no argument is given, the configuration will be dumped to the console. + +You may set a new value by adding the variable name and the new value to +the command line. + +SETTINGS +-------- +=== CONNTRACK_MAX_CONNECTIONS = 16384 +Limits the max. number of simultaneous connections. + +Modify this if you want to handle a larger number of concurrent +connections. Every connection will use approx. 16 kBytes of memory. + +=== CONNTRACK_UDP_TIMEOUT = 60 +Defines the timeout (in seconds) the kernel will wait until +a half-assured UDP connection is fully established. + +=== FIREWALL_ACCEPT_ICMP_REDIRECTS = [true|false] +Enable if you want to accept ICMP redirect messages. + +=== FIREWALL_CLAMP_PATH_MTU = [true|false] +If Path MTU Discovery does not work well, enable this option. + +It sets the MSS value of a packet so that the remote site would +never send a packet bigger than the MSS value. + +No ICMP packets are needed to make this work, so use this on +networks with broken ICMP filtering. + +=== FIREWALL_DEFAULT_TTL = 64 +Here you can change the default TTL used for sending packets. + +The given value must be between 10 and 255. +Don't mess with this unless you know what you are doing. + +=== FIREWALL_LOG_BAD_TCP_FLAGS = [true|false] +Enable this to log TCP packets with bad flags or options. + +=== FIREWALL_LOG_INVALID_ICMP = [true|false] +Enable this to log INVALID ICMP packets. + +=== FIREWALL_LOG_INVALID_TCP = [true|false] +Enable this to log INVALID TCP packets. + +=== FIREWALL_LOG_INVALID_UDP = [true|false] +Enable this to log INVALID UDP packets. + +=== FIREWALL_LOG_MARTIANS = [true|false] +Enable this to log packets with impossible addresses. + +=== FIREWALL_LOG_STEALTH_SCANS = [true|false] +Enable this to log all stealth scans. + +=== FIREWALL_PMTU_DISCOVERY = [true|false] +Enables Path MTU Discovery. + +=== FIREWALL_RP_FILTER = [true|false] +Enable to drop connection from non-routable IPs, +e.g. prevent source routing. + +=== FIREWALL_SYN_COOKIES = [true|false] +Enable for SYN-flood protection. + +=== FIREWALL_USE_ECN = [true|false] +Enables the ECN (Explicit Congestion Notification) TCP flag. + +Some routers on the Internet still do not support ECN properly. +When this setting is disabled, ECN is only advertised +when asked for. + +AUTHORS +------- +Michael Tremer + +SEE ALSO +-------- +link:firewall[8] diff --git a/man/firewall-settings.xml b/man/firewall-settings.xml deleted file mode 100644 index 7357f4cb..00000000 --- a/man/firewall-settings.xml +++ /dev/null @@ -1,284 +0,0 @@ - - - - - - firewall-settings - network - - - - Developer - Michael - Tremer - michael.tremer@ipfire.org - - - - - - firewall-settings - 8 - - - - firewall-settings - Firewall Configuration Control Program - - - - - firewall-settings - - - - firewall-settings KEY=VALUE - - - - - Description - - - The firewall-settings command may be used to set - global firewall settingsuration options. - - - Please have a look at the individual man pages for more options. - - - - - Commands - - - If no additional argument is given, running the command will - dump a list of all settingsuration variables and their current values. - - - - You may set a new value by adding the variable name and the new - value to the command line. - - - - - Variables - - - - - CONNTRACK_MAX_CONNECTIONS = 16384 - - - - - Limits the max. number of simultaneous connections. - - - Modify this if you want to handle a larger number of concurrent - connections. Every connection will use approx. 16 kBytes of memory. - - - - - - - CONNTRACK_UDP_TIMEOUT = 60 - - - - - Defines the timeout (in seconds) the kernel will wait until - a half-assured UDP connection is fully established. - - - - - - - FIREWALL_ACCEPT_ICMP_REDIRECTS = [true|false] - - - - - Enable if you want to accept ICMP redirect messages. - - - - - - - FIREWALL_CLAMP_PATH_MTU = [true|false] - - - - - If Path MTU Discovery does not work well, enable this option. - It sets the MSS value of a packet so that the remote site would - never send a packet bigger than the MSS value. - - - No ICMP packets are needed to make this work, so use this on - networks with broken ICMP filtering. - - - - - - - FIREWALL_DEFAULT_TTL = 64 - - - - - Here you can change the default TTL used for sending packets. - - - The given value must be between 10 and 255. - Don't mess with this unless you know what you are doing. - - - - - - - FIREWALL_LOG_BAD_TCP_FLAGS = [true|false] - - - - - Enable this to log TCP packets with bad flags or options. - - - - - - - FIREWALL_LOG_INVALID_ICMP = [true|false] - - - - - Enable this to log INVALID ICMP packets. - - - - - - - FIREWALL_LOG_INVALID_TCP = [true|false] - - - - - Enable this to log INVALID TCP packets. - - - - - - - FIREWALL_LOG_INVALID_UDP = [true|false] - - - - - Enable this to log INVALID UDP packets. - - - - - - - FIREWALL_LOG_MARTIANS = [true|false] - - - - - Enable this to log packets with impossible addresses. - - - - - - - FIREWALL_LOG_STEALTH_SCANS = [true|false] - - - - - Enable this to log all stealth scans. - - - - - - - FIREWALL_PMTU_DISCOVERY = [true|false] - - - - - Enables Path MTU Discovery. - - - - - - - FIREWALL_RP_FILTER = [true|false] - - - - - Enable to drop connection from non-routable IPs, - e.g. prevent source routing. - - - - - - - FIREWALL_SYN_COOKIES = [true|false] - - - - - Enable for SYN-flood protection. - - - - - - - FIREWALL_USE_ECN = [true|false] - - - - - Enables the ECN (Explicit Congestion Notification) TCP flag. - - - Some routers on the Internet still do not support ECN properly, - so this is not enabled by default. - When this setting is disabled, ECN is only advertised - when asked for. - - - - - - - - See Also - - - - firewall - 8 - - - - -- 2.39.2