From b501269b7ef2d597d48e02b2fe842be3995d78ab Mon Sep 17 00:00:00 2001
From: Vadim Kurland
- Firewall Builder 4.0 allows you to compile single policy or nat rule
+ Firewall Builder 4.0 allows you to compile single policy or NAT rule
and see generated firewall configuration right there in the GUI. To
do this, select any object in the rule you want to process or
highlight its leftmost element where rule number is shown, then
diff --git a/src/gui/Tutorial/getting_started/html/page29.html b/src/gui/Tutorial/getting_started/html/page29.html
index e35f9985d..5713b1e12 100644
--- a/src/gui/Tutorial/getting_started/html/page29.html
+++ b/src/gui/Tutorial/getting_started/html/page29.html
@@ -14,7 +14,7 @@
Now we can compile the policy of the firewall "guardian" and
generate the iptables script. To do so, use toolbar button located
- right above the panel that shows policy and nat rules. This button
+ right above the panel that shows policy and NAT rules. This button
compiles rules of the firewall that is opened at the
moment. Compiler processes Policy, NAT and Routing rules even though
the panel shows only one kind of rules at a time. Another button
diff --git a/src/res/help/en_US/ipcopAdvancedDialog.html b/src/res/help/en_US/ipcopAdvancedDialog.html
index 91efbd1f8..2645463d0 100644
--- a/src/res/help/en_US/ipcopAdvancedDialog.html
+++ b/src/res/help/en_US/ipcopAdvancedDialog.html
@@ -154,11 +154,11 @@ online on the project web site at http://www.
This adds a rule on top of the policy with iptables target TCPMSS
and option --clamp-mss-to-pmtu which automatically clamps MSS value
- to (path_MTU - 40). This iptables rule is added only if ip
- forwarding is turned on in the host settings dialog. since ip
+ to (path_MTU - 40). This iptables rule is added only if IP
+ forwarding is turned on in the host settings dialog. since IP
forwarding for ipv4 and ipv6 can be configured separately, rules
with target TCPMSS for iptables and ip6tables are also added
- separately if corresponding ip forwarding setting is
+ separately if corresponding IP forwarding setting is
enabled. Finally, this target is only available in ip6tables
starting with version 1.3.8 and compiler will not add it to the
generated script if version is set to less than "1.4.x" in the
@@ -258,7 +258,7 @@ online on the project web site at http://www.
here. Prolog section is added at the beginning of the script, before
generated iptables commands. Note that generated iptables script is
just a shell script, so commands you place in the Prolog and Epilog
- sections should be valid bourne shell commands.
+ sections should be valid Bourne shell commands.
diff --git a/src/res/help/en_US/iptAdvancedDialog.html b/src/res/help/en_US/iptAdvancedDialog.html
index 1b1afe0f0..33d3aecb5 100644
--- a/src/res/help/en_US/iptAdvancedDialog.html
+++ b/src/res/help/en_US/iptAdvancedDialog.html
@@ -224,11 +224,11 @@ online on the project web site at http://www.
This adds a rule on top of the policy with iptables target TCPMSS
and option --clamp-mss-to-pmtu which automatically clamps MSS value
- to (path_MTU - 40). This iptables rule is added only if ip
- forwarding is turned on in the host settings dialog. since ip
+ to (path_MTU - 40). This iptables rule is added only if IP
+ forwarding is turned on in the host settings dialog. since IP
forwarding for ipv4 and ipv6 can be configured separately, rules
with target TCPMSS for iptables and ip6tables are also added
- separately if corresponding ip forwarding setting is
+ separately if corresponding IP forwarding setting is
enabled. Finally, this target is only available in ip6tables
starting with version 1.3.8 and compiler will not add it to the
generated script if version is set to less than "1.4.x" in the
@@ -269,7 +269,7 @@ online on the project web site at http://www.
established.
@@ -352,7 +352,7 @@ online on the project web site at http://www.
here. Prolog section is added at the beginning of the script, before
generated iptables commands. Note that generated iptables script is
just a shell script, so commands you place in the Prolog and Epilog
- sections should be valid bourne shell commands.
+ sections should be valid Bourne shell commands.
- This option makes compiler add commands to configure ip addresses of
+ This option makes compiler add commands to configure IP addresses of
the interfaces of the firewall according to the "Address" objects
added to interfaces in the Firewall Builder GUI.
- If this option is on, generated script will clear ip addresses and
+ If this option is on, generated script will clear IP addresses and
bring down interfaces of the firewall that have not been configured
in the fwbuilder GUI. This can be used to ensure that the
configuration of the firewall machine is perfectly synchronized with
objects defined in fwbuilder. This function does nothing to
interfaces configured in fwbuilder, regardless of their type
- ("regular", "dynamic" or "unnumbered"). Be caureful using this
+ ("regular", "dynamic" or "unnumbered"). Be careful using this
option, especially in the early stages of building fwbuilder objects
- for the new firewall. If you forget to add an inetrface that is
+ for the new firewall. If you forget to add an interface that is
supposed to pass traffic to fwbuilder configuration, generated
script will shut it down when this option is turned on. However when
configuration has been debugged and is known to be correct, it may
@@ -563,7 +563,7 @@ online on the project web site at http://www.
When this option is on, generated script will use vconfig commands
- to configure vlan inetrfaces defined in the fwbuilder GUI. The
+ to configure vlan interfaces defined in the fwbuilder GUI. The
script tries to do this incrementally, that is, it compares
requested set of vlans with existing vlan interfaces on the machine,
then it creates those that are missing and deletes those that are not
diff --git a/src/res/help/en_US/linux24AdvancedDialog.html b/src/res/help/en_US/linux24AdvancedDialog.html
index 3644c93e0..219a631b0 100644
--- a/src/res/help/en_US/linux24AdvancedDialog.html
+++ b/src/res/help/en_US/linux24AdvancedDialog.html
@@ -163,7 +163,7 @@ IPv6 related kernel settings are documented here:
syncookies seriously violate TCP protocol, do not allow
to use TCP extensions, can result in serious degradation
- of some services (f.e. SMTP relaying), visible not by you,
+ of some services (e.g. SMTP relaying), visible not by you,
but your clients and relays, contacting you. While you see
synflood warnings in logs not being really flooded, your server
is seriously misconfigured.
diff --git a/src/res/help/en_US/pfAdvancedDialog.html b/src/res/help/en_US/pfAdvancedDialog.html
index 1db9e6196..abf041ca0 100644
--- a/src/res/help/en_US/pfAdvancedDialog.html
+++ b/src/res/help/en_US/pfAdvancedDialog.html
@@ -111,7 +111,7 @@ online http://www
For PF 4.x this option adds "flags any" parameters to rules that
match TCP services. PF 4.x by default behaves as if "flags S/SA"
- parameter was added to all rules matching tcp services. Adding
+ parameter was added to all rules matching TCP services. Adding
"flags any" makes rule match not only TCP packets with SYN flag set
and ACK flag cleared, which is the packet that initiates the
session, but also packets with any other combination of flags,
@@ -121,14 +121,14 @@ online http://www
for PF 3.x the behavior of the policy compiler is opposite: when
this option is not set, it adds "flags S/SA" to all rules that match
- any tcp services; if this option is set, "flags" parameter is not
+ any TCP services; if this option is set, "flags" parameter is not
added to these rules at all, which makes them match TCP packets with
any combination of flags.
- This adds "modulate state" parameter to rules that match any tcp
+ This adds "modulate state" parameter to rules that match any TCP
services. Quoting man pf.conf(5), section STATE MODULATION:
- This option makes compiler add commands to configure ip addresses of
+ This option makes compiler add commands to configure IP addresses of
the interfaces of the firewall according to the "Address" objects
added to interfaces in the Firewall Builder GUI.
diff --git a/src/res/help/en_US/pf_rule_options.html b/src/res/help/en_US/pf_rule_options.html
index a8b96f08b..b09db4276 100644
--- a/src/res/help/en_US/pf_rule_options.html
+++ b/src/res/help/en_US/pf_rule_options.html
@@ -20,7 +20,7 @@
In PF 4.x, "flags S/SA keep state" is the default. Compiler will omit
-these flags while generating code for stateful rules matching tcp
+these flags while generating code for stateful rules matching TCP
services. However, according to the PF FAQ, care should be taken while
dealing with states and interface enc0. To avoid leaking unencrypted
traffic out, the FAQ recommends setting 'keep state' explicitly in all
diff --git a/src/res/help/en_US/release_notes_4.0.0.html b/src/res/help/en_US/release_notes_4.0.0.html
index 1a2ebd4f4..f771aa679 100644
--- a/src/res/help/en_US/release_notes_4.0.0.html
+++ b/src/res/help/en_US/release_notes_4.0.0.html
@@ -108,7 +108,7 @@
- Now you can change ip addresses of interfaces of the new firewall
+ Now you can change IP addresses of interfaces of the new firewall
created from a template. Templates come preconfigured with some
IP addresses which probably do not match addresses used on your
networks. When you create new firewall object from a template, the
@@ -296,7 +296,7 @@
or Policy rule set. Top rule set is used to generate iptables rules
in the built-in chains INPUT/OUTPUT/FORWARD or the rules in the main
PF configuration file (not anchors). If the firewall object has
- other not-top Poluicy and NAT rule sets but no top rule set, packets
+ other not-top Policy and NAT rule sets but no top rule set, packets
will never reach any rules. However there are legitimate cases when
administrator may want to use fwbuilder to only generate iptables
commands for a custom chain or configuration for a custom PF anchor,
@@ -673,7 +673,7 @@ rule sets of this object rather than in the actual firewalls.
When an interface with dynamic address is used in a policy or
- NAT rule, compiler generates shell script to read its ip addresses
+ NAT rule, compiler generates shell script to read its IP addresses
at the time of execution, assigns them to temporary shell variables
and uses them in rules. In previous versions (fwbuilder v2 and v3)
only the first IPv4 address of an interface was used. V4 uses all
@@ -729,7 +729,7 @@ rule sets of this object rather than in the actual firewalls.
loaded or there are no tables. This return code means the firewall
is not running or not configured. It also supports additional
actions "interfaces" and "test_interfaces". Action "interfaces" only
- runs commands that manage ip addresses of interfaces, as well as
+ runs commands that manage IP addresses of interfaces, as well as
configure vlan, bridge and bonding interfaces. Action
"test_interfaces" runs the same commands in the test mode when it
prints commands that would be executed but does not actually execute
@@ -817,7 +817,7 @@ rule sets of this object rather than in the actual firewalls.
/etc/init.d/fwbuilder.fw stop
An option in the "Compiler" tab of the firewall object in fwbuilder
- GUI alows you to make the firewall block all traffic when stopped
+ GUI allows you to make the firewall block all traffic when stopped
but still permit ssh connections from preconfigured address of the
management machine.
This version of Firewall Builder introduces direct support for
DD-WRT. There are two options: you can use nvram to install
- generated firewall policy or you can use jffs (journaling flash file
- system) on the device and store generated script there. Two host OS
+ generated firewall policy or you can use jffs (Journaling Flash File
+ System) on the device and store generated script there. Two host OS
settings are provided: "DD-WRT (nvram)"
and "DD-WRT (jffs)".
Added support for the object-group statement in generated IOS
- configuration. This helps reduce size of the geenrated access lists
+ configuration. This helps reduce size of the generated access lists
when the router should match long lists of IP addresses or
ports. Both "network" and "service" object-groups are supported.
This feature is controlled by a checkbox in the "Advanced" settings
diff --git a/src/res/help/en_US/summary.html b/src/res/help/en_US/summary.html
index faefb58e9..8d59fcc89 100644
--- a/src/res/help/en_US/summary.html
+++ b/src/res/help/en_US/summary.html
@@ -122,8 +122,8 @@
Firewall Builder can generate scripts that set
- up interfaces, ip
- addresses, snmp, ntp
+ up interfaces, IP
+ addresses, SNMP, NTP
and logging parameters and other aspects of the
general configuration of the firewall machine.
-
@@ -1037,7 +1037,7 @@ rule sets of this object rather than in the actual firewalls.
Install the rule for ssh access from the manageemnt workstation
+
Install the rule for ssh access from the management workstation
when the firewall is stopped
Insert prolog script ...
@@ -525,7 +525,7 @@ online on the project web site at http://www.
Configure interfaces of the firewall machine
Clear ip addresses and bring down interfaces not configured in fwbuilder
+Clear IP addresses and bring down interfaces not configured in fwbuilder
Configure VLAN interfaces
Modulate state for all stateful rules
Much of the security derived from TCP is attributable to how well
@@ -576,7 +576,7 @@ online http://www
here. Prolog section is added at the beginning of the script, before
generated iptables commands. Note that generated iptables script is
just a shell script, so commands you place in the Prolog and Epilog
- sections should be valid bourne shell commands.
+ sections should be valid Bourne shell commands.
@@ -625,7 +625,7 @@ online http://www
Configure interfaces of the firewall machine
We have lots of documentation online. Start with Firewall Builder - Users Guide (available in pdf - and html formats). Users + Users Guide (available in pdf + and html formats). Users Guide explains the program in details and includes large "CookBook" section that presents typical problems of firewall rules design and demonstrates how they can be solved with Firewall Builder. There is - also FAQ, - Installation + also FAQ, + Installation Guide and - Release + Release Notes for each version.