mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-09-11 07:31:25 +02:00
Initial import into v3 branch
This commit is contained in:
Vadim Kurland
@@ -0,0 +1,2 @@
|
||||
*.conf
|
||||
*.fw
|
||||
@@ -0,0 +1,14 @@
|
||||
# this is a comment
|
||||
#
|
||||
; this should be a comment too
|
||||
;
|
||||
|
||||
192.168.1.1
|
||||
192.168.1.2/32
|
||||
192.168.1.3/30
|
||||
192.168.2.128/25
|
||||
192.168.1.200/32 # comment again
|
||||
192.168.1.201/32 # this should work, too
|
||||
|
||||
|
||||
|
||||
Executable
+14
@@ -0,0 +1,14 @@
|
||||
#!/bin/sh
|
||||
|
||||
T=$1
|
||||
N=$2
|
||||
|
||||
if which opendiff > /dev/null; then
|
||||
TOOL="opendiff"
|
||||
else
|
||||
TOOL="tkdiff -b -B "
|
||||
fi
|
||||
|
||||
${TOOL} firewall${N}-${T}.conf.orig firewall${N}-${T}.conf
|
||||
|
||||
|
||||
@@ -0,0 +1,524 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
|
||||
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="2.0.0" id="root">
|
||||
<Library id="syslib000" name="Standard" comment="Standard objects" color="#d4f8ff" ro="True">
|
||||
<AnyNetwork comment="Any Network" id="sysid0" name="Any" address="0.0.0.0" netmask="0.0.0.0"/>
|
||||
<AnyIPService comment="Any IP Service" id="sysid1" name="Any" protocol_num="0"/>
|
||||
<AnyInterval comment="Any Interval" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" id="sysid2" name="Any" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
|
||||
<ObjectGroup id="stdid01" name="Objects">
|
||||
<ObjectGroup id="stdid04" name="Groups">
|
||||
<ObjectGroup id="id3DC75CE8" name="rfc1918-nets">
|
||||
<ObjectRef ref="id3DC75CE5"/>
|
||||
<ObjectRef ref="id3DC75CE6"/>
|
||||
<ObjectRef ref="id3DC75CE7"/>
|
||||
</ObjectGroup>
|
||||
</ObjectGroup>
|
||||
<ObjectGroup id="stdid02" name="Hosts"/>
|
||||
<ObjectGroup id="stdid03" name="Networks">
|
||||
<Network comment="224.0.0.0/4 - This block, formerly known as the Class D address\nspace, is allocated for use in IPv4 multicast address assignments.\nThe IANA guidelines for assignments from this space are described in\n[RFC3171].\n" id="id3DC75CEC" name="all multicasts" address="224.0.0.0" netmask="240.0.0.0"/>
|
||||
<Network comment="169.254.0.0/16 - This is the "link local" block. It is allocated for\ncommunication between hosts on a single link. Hosts obtain these\naddresses by auto-configuration, such as when a DHCP server may not\nbe found.\n" id="id3F4ECE3E" name="link-local" address="169.254.0.0" netmask="255.255.0.0"/>
|
||||
<Network comment="127.0.0.0/8 - This block is assigned for use as the Internet host\nloopback address. A datagram sent by a higher level protocol to an\naddress anywhere within this block should loop back inside the host.\nThis is ordinarily implemented using only 127.0.0.1/32 for loopback,\nbut no addresses within this block should ever appear on any network\nanywhere [RFC1700, page 5].\n" id="id3F4ECE3D" name="loopback-net" address="127.0.0.0" netmask="255.0.0.0"/>
|
||||
<Network comment="10.0.0.0/8 - This block is set aside for use in private networks.\nIts intended use is documented in [RFC1918]. Addresses within this\nblock should not appear on the public Internet." id="id3DC75CE5" name="net-10.0.0.0" address="10.0.0.0" netmask="255.0.0.0"/>
|
||||
<Network comment="172.16.0.0/12 - This block is set aside for use in private networks.\nIts intended use is documented in [RFC1918]. Addresses within this\nblock should not appear on the public Internet.\n" id="id3DC75CE7" name="net-172.16.0.0" address="172.16.0.0" netmask="255.240.0.0"/>
|
||||
<Network comment="192.168.0.0/16 - This block is set aside for use in private networks.\nIts intended use is documented in [RFC1918]. Addresses within this\nblock should not appear on the public Internet.\n" id="id3DC75CE6" name="net-192.168.0.0" address="192.168.0.0" netmask="255.255.0.0"/>
|
||||
<Network comment="192.0.2.0/24 - This block is assigned as "TEST-NET" for use in\ndocumentation and example code. It is often used in conjunction with\ndomain names example.com or example.net in vendor and protocol\ndocumentation. Addresses within this block should not appear on the\npublic Internet.\n" id="id3F4ECE3F" name="test-net" address="192.0.2.0" netmask="255.255.255.0"/>
|
||||
<Network comment="0.0.0.0/8 - Addresses in this block refer to source hosts on "this"\nnetwork. Address 0.0.0.0/32 may be used as a source address for this\nhost on this network; other addresses within 0.0.0.0/8 may be used to\nrefer to specified hosts on this network [RFC1700, page 4]." id="id3F4ECE40" name="this-net" address="0.0.0.0" netmask="255.0.0.0"/>
|
||||
</ObjectGroup>
|
||||
<ObjectGroup id="stdid15" name="Address Ranges">
|
||||
<AddressRange comment="" id="id3F6D115C" name="broadcast" start_address="255.255.255.255" end_address="255.255.255.255"/>
|
||||
<AddressRange comment="" id="id3F6D115D" name="old-broadcast" start_address="0.0.0.0" end_address="0.0.0.0"/>
|
||||
</ObjectGroup>
|
||||
</ObjectGroup>
|
||||
<ServiceGroup id="stdid05" name="Services">
|
||||
<CustomService comment="This service matches all packets which are part of network connections established through the firewall, or \n connections 'related' to those established through the firewall. Term 'established' refers to the state tracking \n mechanism which exists inside iptables and other stateful firewalls and does not mean any particular \n combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it \n belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful \n inspection module made appropriate record in the state table. Usually statefule firewalls keep track of network \n connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' \n describes packet belonging to a separate network connection, related to the session firewall is keeping \n track of. One example is FTP command and FTP data sessions." id="stdid14" name="ESTABLISHED">
|
||||
<CustomServiceCommand platform="Undefined"/>
|
||||
<CustomServiceCommand platform="ipfilter"/>
|
||||
<CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
|
||||
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
|
||||
</CustomService>
|
||||
<ServiceGroup id="stdid10" name="Groups">
|
||||
<ServiceGroup comment="" id="sg-DHCP" name="DHCP">
|
||||
<ServiceRef ref="udp-bootpc"/>
|
||||
<ServiceRef ref="udp-bootps"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="id3F530CC8" name="DNS">
|
||||
<ServiceRef ref="udp-DNS"/>
|
||||
<ServiceRef ref="tcp-DNS"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="id3CB1279B" name="IPSEC">
|
||||
<ServiceRef ref="id3CB12797"/>
|
||||
<ServiceRef ref="ip-IPSEC"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup comment="" id="sg-NETBIOS" name="NETBIOS">
|
||||
<ServiceRef ref="udp-netbios-dgm"/>
|
||||
<ServiceRef ref="udp-netbios-ns"/>
|
||||
<ServiceRef ref="id3E755609"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="id3CB131CC" name="PCAnywhere">
|
||||
<ServiceRef ref="id3CB131CA"/>
|
||||
<ServiceRef ref="id3CB131C8"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup comment="" id="sg-Useful_ICMP" name="Useful_ICMP">
|
||||
<ServiceRef ref="icmp-Time_exceeded"/>
|
||||
<ServiceRef ref="icmp-Time_exceeded_in_transit"/>
|
||||
<ServiceRef ref="icmp-ping_reply"/>
|
||||
<ServiceRef ref="icmp-Unreachables"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="id3B4FEDD9" name="kerberos">
|
||||
<ServiceRef ref="id3B4FEDA5"/>
|
||||
<ServiceRef ref="id3B4FEDA9"/>
|
||||
<ServiceRef ref="id3B4FEDA7"/>
|
||||
<ServiceRef ref="id3B4FEDAB"/>
|
||||
<ServiceRef ref="id3B4FEDA3"/>
|
||||
<ServiceRef ref="id3B4FEE21"/>
|
||||
<ServiceRef ref="id3B4FEE23"/>
|
||||
<ServiceRef ref="id3E7E3EA2"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="id3B4FF35E" name="nfs">
|
||||
<ServiceRef ref="id3B4FEE7A"/>
|
||||
<ServiceRef ref="id3B4FEE78"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="id3B4FEFFA" name="quake">
|
||||
<ServiceRef ref="id3B4FEF7C"/>
|
||||
<ServiceRef ref="id3B4FEF7E"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="id3D703C9A" name="Real Player">
|
||||
<ServiceRef ref="id3D703C99"/>
|
||||
<ServiceRef ref="id3D703C8B"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="id3E7E3E95" name="WinNT">
|
||||
<ServiceRef ref="sg-NETBIOS"/>
|
||||
<ServiceRef ref="id3DC8C8BB"/>
|
||||
<ServiceRef ref="id3E7E3D58"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="id3E7E3E9A" name="Win2000">
|
||||
<ServiceRef ref="id3E7E3E95"/>
|
||||
<ServiceRef ref="udp-DNS"/>
|
||||
<ServiceRef ref="id3DC8C8BC"/>
|
||||
<ServiceRef ref="id3E7E3EA2"/>
|
||||
<ServiceRef ref="id3AECF778"/>
|
||||
<ServiceRef ref="id3D703C90"/>
|
||||
<ServiceRef ref="id3E7E4039"/>
|
||||
<ServiceRef ref="id3E7E403A"/>
|
||||
<ServiceRef ref="id3B4FEDA5"/>
|
||||
<ServiceRef ref="tcp-DNS"/>
|
||||
</ServiceGroup>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="stdid07" name="ICMP">
|
||||
<ICMPService code="-1" comment="" id="icmp-Unreachables" name="all ICMP unreachables" type="3"/>
|
||||
<ICMPService code="-1" comment="" id="id3C20EEB5" name="any ICMP" type="-1"/>
|
||||
<ICMPService code="1" comment="" id="icmp-Host_unreach" name="host_unreach" type="3"/>
|
||||
<ICMPService code="0" comment="" id="icmp-ping_reply" name="ping reply" type="0"/>
|
||||
<ICMPService code="0" comment="" id="icmp-ping_request" name="ping request" type="8"/>
|
||||
<ICMPService code="3" comment="Port unreachable" id="icmp-Port_unreach" name="port unreach" type="3"/>
|
||||
<ICMPService code="0" comment="ICMP messages of this type are needed for traceroute" id="icmp-Time_exceeded" name="time exceeded" type="11"/>
|
||||
<ICMPService code="1" comment="" id="icmp-Time_exceeded_in_transit" name="time exceeded in transit" type="11"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="stdid06" name="IP">
|
||||
<IPService comment="IPSEC Authentication Header Protocol" fragm="False" id="id3CB12797" lsrr="False" name="AH" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False"/>
|
||||
<IPService comment="IPSEC Encapsulating Security Payload Protocol" fragm="False" id="ip-IPSEC" lsrr="False" name="ESP" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False"/>
|
||||
<IPService comment="Route recording packets" fragm="False" id="ip-RR" lsrr="False" name="RR" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False"/>
|
||||
<IPService comment="All sorts of Source Routing Packets" fragm="False" id="ip-SRR" lsrr="True" name="SRR" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False"/>
|
||||
<IPService comment="'Short' fragments" fragm="False" id="ip-IP_Fragments" lsrr="False" name="ip_fragments" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False"/>
|
||||
<IPService comment="IPSEC Simple Key Management for Internet Protocols" fragm="False" id="id3D703C8E" lsrr="False" name="SKIP" protocol_num="57" rr="False" short_fragm="False" ssrr="False" ts="False"/>
|
||||
<IPService comment="Generic Routing Encapsulation\n" fragm="False" id="id3D703C8F" lsrr="False" name="GRE" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False"/>
|
||||
<IPService comment="Virtual Router Redundancy Protocol" fragm="False" id="id3D703C95" lsrr="False" name="vrrp" protocol_num="112" rr="False" short_fragm="False" ssrr="False" ts="False"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="stdid09" name="TCP">
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="ipchains used to use this range of port numbers for masquerading. " dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="False" id="tcp-ALL_TCP_Masqueraded" name="ALL TCP Masqueraded" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="65095" src_range_start="61000" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="5190" dst_range_start="5190" fin_flag="False" fin_flag_mask="False" id="id3D703C94" name="AOL" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="False" id="tcp-All_TCP" name="All TCP" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="1494" dst_range_start="1494" fin_flag="False" fin_flag_mask="False" id="id3CB131C4" name="Citrix-ICA" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="Entrust CA Administration Service" dst_range_end="709" dst_range_start="709" fin_flag="False" fin_flag_mask="False" id="id3D703C91" name="Entrust-Admin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="Entrust CA Key Management Service" dst_range_end="710" dst_range_start="710" fin_flag="False" fin_flag_mask="False" id="id3D703C92" name="Entrust-KeyMgmt" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="1720" dst_range_start="1720" fin_flag="False" fin_flag_mask="False" id="id3AEDBEAC" name="H323" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3268" dst_range_start="3268" fin_flag="False" fin_flag_mask="False" id="id3E7E4039" name="LDAP GC" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3269" dst_range_start="3269" fin_flag="False" fin_flag_mask="False" id="id3E7E403A" name="LDAP GC SSL" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="Open Windows" dst_range_end="2000" dst_range_start="2000" fin_flag="False" fin_flag_mask="False" id="id3D703C83" name="OpenWindows" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="data channel for PCAnywhere v7.52 and later " dst_range_end="5631" dst_range_start="5631" fin_flag="False" fin_flag_mask="False" id="id3CB131C8" name="PCAnywhere-data" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="RealNetworks PNA Protocol" dst_range_end="7070" dst_range_start="7070" fin_flag="False" fin_flag_mask="False" id="id3D703C8B" name="Real-Audio" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="2998" dst_range_start="2998" fin_flag="False" fin_flag_mask="False" id="id3D703C93" name="RealSecure" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="SMB over TCP (without NETBIOS)\n" dst_range_end="445" dst_range_start="445" fin_flag="False" fin_flag_mask="False" id="id3DC8C8BC" name="SMB" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="49" dst_range_start="49" fin_flag="False" fin_flag_mask="False" id="id3D703C8D" name="TACACSplus" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="TCP high ports" dst_range_end="65535" dst_range_start="1024" fin_flag="False" fin_flag_mask="False" id="id3D703C84" name="TCP high ports" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="42" dst_range_start="42" fin_flag="False" fin_flag_mask="False" id="id3E7E3D58" name="WINS replication" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="X Window System" dst_range_end="6063" dst_range_start="6000" fin_flag="False" fin_flag_mask="False" id="id3D703C82" name="X11" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="113" dst_range_start="113" fin_flag="False" fin_flag_mask="False" id="tcp-Auth" name="auth" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="13" dst_range_start="13" fin_flag="False" fin_flag_mask="False" id="id3AEDBE6E" name="daytime" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="53" dst_range_start="53" fin_flag="False" fin_flag_mask="False" id="tcp-DNS" name="domain" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="2105" dst_range_start="2105" fin_flag="False" fin_flag_mask="False" id="id3B4FEDA3" name="eklogin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="79" dst_range_start="79" fin_flag="False" fin_flag_mask="False" id="id3AECF774" name="finger" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="21" dst_range_start="21" fin_flag="False" fin_flag_mask="False" id="tcp-FTP" name="ftp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="FTP data channel.\n Note: FTP protocol does not really require server to use source port 20 for the data channel, \n but many ftp server implementations do so." dst_range_end="65535" dst_range_start="1024" fin_flag="False" fin_flag_mask="False" id="tcp-FTP_data" name="ftp data" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="20" src_range_start="20" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="FTP data channel for passive mode transfers\n" dst_range_end="20" dst_range_start="20" fin_flag="False" fin_flag_mask="False" id="id3E7553BC" name="ftp data passive" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="80" dst_range_start="80" fin_flag="False" fin_flag_mask="False" id="tcp-HTTP" name="http" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="443" dst_range_start="443" fin_flag="False" fin_flag_mask="False" id="id3B4FED69" name="https" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="143" dst_range_start="143" fin_flag="False" fin_flag_mask="False" id="id3AECF776" name="imap" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="993" dst_range_start="993" fin_flag="False" fin_flag_mask="False" id="id3B4FED9F" name="imaps" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="6667" dst_range_start="6667" fin_flag="False" fin_flag_mask="False" id="id3B4FF13C" name="irc" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="88" dst_range_start="88" fin_flag="False" fin_flag_mask="False" id="id3E7E3EA2" name="kerberos" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="543" dst_range_start="543" fin_flag="False" fin_flag_mask="False" id="id3B4FEE21" name="klogin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="544" dst_range_start="544" fin_flag="False" fin_flag_mask="False" id="id3B4FEE23" name="ksh" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="389" dst_range_start="389" fin_flag="False" fin_flag_mask="False" id="id3AECF778" name="ldap" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="Lightweight Directory Access Protocol over TLS/SSL" dst_range_end="636" dst_range_start="636" fin_flag="False" fin_flag_mask="False" id="id3D703C90" name="ldaps" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="98" dst_range_start="98" fin_flag="False" fin_flag_mask="False" id="id3B4FF000" name="linuxconf" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="98" dst_range_start="98" fin_flag="False" fin_flag_mask="False" id="id3AED0D6D" name="linuxconf" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="515" dst_range_start="515" fin_flag="False" fin_flag_mask="False" id="id3D703C97" name="lpr" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="135" dst_range_start="135" fin_flag="False" fin_flag_mask="False" id="id3DC8C8BB" name="microsoft-rpc" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="Microsoft SQL Server" dst_range_end="1433" dst_range_start="1433" fin_flag="False" fin_flag_mask="False" id="id3D703C98" name="ms-sql" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3306" dst_range_start="3306" fin_flag="False" fin_flag_mask="False" id="id3B4FEEEE" name="mysql" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="139" dst_range_start="139" fin_flag="False" fin_flag_mask="False" id="id3E755609" name="netbios-ssn" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="2049" dst_range_start="2049" fin_flag="False" fin_flag_mask="False" id="id3B4FEE7A" name="nfs" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="119" dst_range_start="119" fin_flag="False" fin_flag_mask="False" id="tcp-NNTP" name="nntp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="NNTP over SSL" dst_range_end="563" dst_range_start="563" fin_flag="False" fin_flag_mask="False" id="id3E7553BB" name="nntps" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="110" dst_range_start="110" fin_flag="False" fin_flag_mask="False" id="id3B4FEE1D" name="pop3" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="POP-3 over SSL" dst_range_end="995" dst_range_start="995" fin_flag="False" fin_flag_mask="False" id="id3E7553BA" name="pop3s" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="5432" dst_range_start="5432" fin_flag="False" fin_flag_mask="False" id="id3B4FF0EA" name="postgres" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="515" dst_range_start="515" fin_flag="False" fin_flag_mask="False" id="id3AECF782" name="printer" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="26000" dst_range_start="26000" fin_flag="False" fin_flag_mask="False" id="id3B4FEF7C" name="quake" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="512" dst_range_start="512" fin_flag="False" fin_flag_mask="False" id="id3AECF77A" name="rexec" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="513" dst_range_start="513" fin_flag="False" fin_flag_mask="False" id="id3AECF77C" name="rlogin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="514" dst_range_start="514" fin_flag="False" fin_flag_mask="False" id="id3AECF77E" name="rshell" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="Real Time Streaming Protocol" dst_range_end="554" dst_range_start="554" fin_flag="False" fin_flag_mask="False" id="id3D703C99" name="rtsp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="4321" dst_range_start="4321" fin_flag="False" fin_flag_mask="False" id="id3B4FEF34" name="rwhois" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="5510" dst_range_start="5510" fin_flag="False" fin_flag_mask="False" id="id3D703C89" name="securidprop" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="25" dst_range_start="25" fin_flag="False" fin_flag_mask="False" id="tcp-SMTP" name="smtp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="465" dst_range_start="465" fin_flag="False" fin_flag_mask="False" id="id3B4FF04C" name="smtps" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="1080" dst_range_start="1080" fin_flag="False" fin_flag_mask="False" id="id3B4FEE76" name="socks" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="1521" dst_range_start="1521" fin_flag="False" fin_flag_mask="False" id="id3D703C87" name="sqlnet1" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3128" dst_range_start="3128" fin_flag="False" fin_flag_mask="False" id="id3B4FF09A" name="squid" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="22" dst_range_start="22" fin_flag="False" fin_flag_mask="False" id="tcp-SSH" name="ssh" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="111" dst_range_start="111" fin_flag="False" fin_flag_mask="False" id="id3AEDBE00" name="sunrpc" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="True" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="True" id="tcp-TCP-SYN" name="tcp-syn" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="23" dst_range_start="23" fin_flag="False" fin_flag_mask="False" id="tcp-Telnet" name="telnet" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="540" dst_range_start="540" fin_flag="False" fin_flag_mask="False" id="tcp-uucp" name="uucp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="Windows Terminal Services" dst_range_end="3389" dst_range_start="3389" fin_flag="False" fin_flag_mask="False" id="id3CB131C6" name="winterm" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="7100" dst_range_start="7100" fin_flag="False" fin_flag_mask="False" id="id3B4FF1B8" name="xfs" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="True" ack_flag_mask="True" comment="" dst_range_end="0" dst_range_start="0" fin_flag="True" fin_flag_mask="True" id="id3C685B2B" name="xmas scan" psh_flag="True" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="True" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="stdid08" name="UDP">
|
||||
<UDPService comment="ipchains used to use this port range for masqueraded packets" dst_range_end="0" dst_range_start="0" id="udp-ALL_UDP_Masqueraded" name="ALL UDP Masqueraded" src_range_end="65095" src_range_start="61000"/>
|
||||
<UDPService comment="" dst_range_end="0" dst_range_start="0" id="udp-All_UDP" name="All UDP" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="4000" dst_range_start="4000" id="id3D703C96" name="ICQ" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="500" dst_range_start="500" id="id3CB129D2" name="IKE" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="status channel for PCAnywhere v7.52 and later" dst_range_end="5632" dst_range_start="5632" id="id3CB131CA" name="PCAnywhere-status" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="routing protocol RIP" dst_range_end="520" dst_range_start="520" id="id3AED0D6B" name="RIP" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="1645" dst_range_start="1645" id="id3D703C8C" name="Radius" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="65535" dst_range_start="1024" id="id3D703C85" name="UDP high ports" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="513" dst_range_start="513" id="id3D703C86" name="Who" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="7009" dst_range_start="7000" id="id3B4FEDA1" name="afs" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="68" dst_range_start="68" id="udp-bootpc" name="bootpc" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="67" dst_range_start="67" id="udp-bootps" name="bootps" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="13" dst_range_start="13" id="id3AEDBE70" name="daytime" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="53" dst_range_start="53" id="udp-DNS" name="domain" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="VocalTec Internet Phone" dst_range_end="22555" dst_range_start="22555" id="id3D703C8A" name="interphone" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="88" dst_range_start="88" id="id3B4FEDA5" name="kerberos" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="750" dst_range_start="749" id="id3B4FEDA9" name="kerberos-adm" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="464" dst_range_start="464" id="id3B4FEDA7" name="kpasswd" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="4444" dst_range_start="4444" id="id3B4FEDAB" name="krb524" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="135" dst_range_start="135" id="id3F865B0D" name="microsoft-rpc" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="138" dst_range_start="138" id="udp-netbios-dgm" name="netbios-dgm" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="137" dst_range_start="137" id="udp-netbios-ns" name="netbios-ns" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="139" dst_range_start="139" id="udp-netbios-ssn" name="netbios-ssn" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="2049" dst_range_start="2049" id="id3B4FEE78" name="nfs" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="123" dst_range_start="123" id="udp-ntp" name="ntp" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="26000" dst_range_start="26000" id="id3B4FEF7E" name="quake" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="1024" dst_range_start="1024" id="id3D703C88" name="secureid-udp" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="161" dst_range_start="161" id="udp-SNMP" name="snmp" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="162" dst_range_start="162" id="id3AED0D69" name="snmp-trap" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="111" dst_range_start="111" id="id3AEDBE19" name="sunrpc" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="514" dst_range_start="514" id="id3AECF780" name="syslog" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="69" dst_range_start="69" id="id3AED0D67" name="tftp" src_range_end="0" src_range_start="0"/>
|
||||
<UDPService comment="" dst_range_end="33524" dst_range_start="33434" id="id3AED0D8C" name="traceroute" src_range_end="0" src_range_start="0"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="stdid13" name="Custom">
|
||||
<CustomService comment="works in iptables and requires patch-o-matic.\nFor more information look for patch-o-matic on http://www.netfilter.org/" id="id3B64EEA8" name="rpc">
|
||||
<CustomServiceCommand platform="Undefined"/>
|
||||
<CustomServiceCommand platform="ipf"/>
|
||||
<CustomServiceCommand platform="ipfilter"/>
|
||||
<CustomServiceCommand platform="ipfw"/>
|
||||
<CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
|
||||
<CustomServiceCommand platform="pf"/>
|
||||
<CustomServiceCommand platform="pix"/>
|
||||
<CustomServiceCommand platform="unknown"/>
|
||||
</CustomService>
|
||||
<CustomService comment="IRC connection tracker, supports DCC.\nWorks on iptables and requires patch-o-matic.\nFor more information look for patch-o-matic on http://www.netfilter.org/\n" id="id3B64EF4E" name="irc-conn">
|
||||
<CustomServiceCommand platform="Undefined"/>
|
||||
<CustomServiceCommand platform="ipf"/>
|
||||
<CustomServiceCommand platform="ipfilter"/>
|
||||
<CustomServiceCommand platform="ipfw"/>
|
||||
<CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
|
||||
<CustomServiceCommand platform="pf"/>
|
||||
<CustomServiceCommand platform="pix"/>
|
||||
<CustomServiceCommand platform="unknown"/>
|
||||
</CustomService>
|
||||
<CustomService comment="Port scan detector, works only on iptables and requires patch-o-matic \nFor more information look for patch-o-matic on http://www.netfilter.org/" id="id3B64EF50" name="psd">
|
||||
<CustomServiceCommand platform="Undefined"/>
|
||||
<CustomServiceCommand platform="ipf"/>
|
||||
<CustomServiceCommand platform="ipfilter"/>
|
||||
<CustomServiceCommand platform="ipfw"/>
|
||||
<CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
|
||||
<CustomServiceCommand platform="pf"/>
|
||||
<CustomServiceCommand platform="pix"/>
|
||||
<CustomServiceCommand platform="unknown"/>
|
||||
</CustomService>
|
||||
<CustomService comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.\nFor more information look for patch-o-matic on http://www.netfilter.org/" id="id3B64EF52" name="string">
|
||||
<CustomServiceCommand platform="Undefined"/>
|
||||
<CustomServiceCommand platform="ipf"/>
|
||||
<CustomServiceCommand platform="ipfilter"/>
|
||||
<CustomServiceCommand platform="ipfw"/>
|
||||
<CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
|
||||
<CustomServiceCommand platform="pf"/>
|
||||
<CustomServiceCommand platform="pix"/>
|
||||
<CustomServiceCommand platform="unknown"/>
|
||||
</CustomService>
|
||||
<CustomService comment="Talk protocol support. Works in iptables and requires patch-o-matic.\nFor more information look for patch-o-matic on http://www.netfilter.org/" id="id3B64EF54" name="talk">
|
||||
<CustomServiceCommand platform="Undefined"/>
|
||||
<CustomServiceCommand platform="ipf"/>
|
||||
<CustomServiceCommand platform="ipfilter"/>
|
||||
<CustomServiceCommand platform="ipfw"/>
|
||||
<CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
|
||||
<CustomServiceCommand platform="pf"/>
|
||||
<CustomServiceCommand platform="pix"/>
|
||||
<CustomServiceCommand platform="unknown"/>
|
||||
</CustomService>
|
||||
</ServiceGroup>
|
||||
</ServiceGroup>
|
||||
<ObjectGroup id="stdid12" name="Firewalls"/>
|
||||
<IntervalGroup id="stdid11" name="Time">
|
||||
<Interval comment="any day, 9:00am through 5:00pm" from_day="-1" from_hour="9" from_minute="0" from_month="-1" from_weekday="1" from_year="-1" id="int-workhours" name="workhours" to_day="-1" to_hour="17" to_minute="0" to_month="-1" to_weekday="5" to_year="-1"/>
|
||||
<Interval comment="weekends: Saturday 0:00 through Sunday 23:59 " from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="7" from_year="-1" id="int-weekends" name="weekends" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="1" to_year="-1"/>
|
||||
<Interval comment="any day 6:00pm - 12:00am" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" id="int-afterhours" name="afterhours" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1"/>
|
||||
<Interval comment="" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" id="id3C63479C" name="Sat" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1"/>
|
||||
<Interval comment="" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" id="id3C63479E" name="Sun" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1"/>
|
||||
</IntervalGroup>
|
||||
</Library>
|
||||
<Library id="syslib001" name="User" comment="User defined objects" color="#d2ffd0">
|
||||
<ObjectGroup id="stdid01_1" name="Objects">
|
||||
<ObjectGroup id="stdid16_1" name="Addresses"/>
|
||||
<ObjectGroup id="stdid04_1" name="Groups"/>
|
||||
<ObjectGroup id="stdid02_1" name="Hosts"/>
|
||||
<ObjectGroup id="stdid03_1" name="Networks">
|
||||
<Network comment="" id="id3F9A1BC7" name="net A" address="192.168.0.0" netmask="255.255.255.0"/>
|
||||
<Network comment="" id="id3F9A1BC8" name="net B" address="192.168.1.0" netmask="255.255.255.0"/>
|
||||
<Network comment="" id="id3F9A1BC9" name="net C" address="192.168.2.0" netmask="255.255.255.0"/>
|
||||
</ObjectGroup>
|
||||
<ObjectGroup id="stdid15_1" name="Address Ranges">
|
||||
<AddressRange comment="" id="id3F9A1BCA" name="range A" start_address="192.168.0.10" end_address="192.168.0.250"/>
|
||||
<AddressRange comment="" id="id3F9A1BCB" name="range B" start_address="192.168.1.10" end_address="192.168.1.250"/>
|
||||
<AddressRange comment="" id="id3F9A1BCC" name="range C" start_address="192.168.2.10" end_address="192.168.2.250"/>
|
||||
<AddressRange comment="" id="id3F9AF27F" name="mini range A" start_address="192.168.0.10" end_address="192.168.0.12"/>
|
||||
<AddressRange comment="" id="id3F9AF280" name="mini range B" start_address="192.168.1.10" end_address="192.168.1.12"/>
|
||||
<AddressRange comment="" id="id3F9AF281" name="mini range C" start_address="192.168.2.10" end_address="192.168.2.12"/>
|
||||
</ObjectGroup>
|
||||
</ObjectGroup>
|
||||
<ServiceGroup id="stdid05_1" name="Services">
|
||||
<ServiceGroup id="stdid10_1" name="Groups"/>
|
||||
<ServiceGroup id="stdid07_1" name="ICMP"/>
|
||||
<ServiceGroup id="stdid06_1" name="IP"/>
|
||||
<ServiceGroup id="stdid09_1" name="TCP"/>
|
||||
<ServiceGroup id="stdid08_1" name="UDP"/>
|
||||
<ServiceGroup id="stdid13_1" name="Custom"/>
|
||||
</ServiceGroup>
|
||||
<ObjectGroup id="stdid12_1" name="Firewalls">
|
||||
<Firewall comment="" host_OS="freebsd" id="id3F9A1BD2" name="test" platform="ipf">
|
||||
<NAT id="id3F9A1BD6"/>
|
||||
<Policy id="id3F9A1BD5">
|
||||
<PolicyRule action="Accept" comment="" disabled="False" id="id3F9A1CE7" log="False" position="0">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9A1BC7"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9A1BC8"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Deny" disabled="False" id="id3F9AF2C0" log="True" position="1">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9AF27F"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9AF280"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-SMTP"/>
|
||||
<ServiceRef ref="tcp-NNTP"/>
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" disabled="False" id="id3F9A1BF6" log="False" position="2">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9A1BCA"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9A1BCB"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" disabled="False" id="id3F9A1BEC" log="False" position="3">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9A1BCA"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9A1BCC"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" disabled="False" id="id3F9A1C2E" log="False" position="4">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9A1BCB"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9A1BCC"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" disabled="False" id="id3F9A1C96" log="False" position="5">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9A1BC7"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9A1BC8"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Deny" disabled="False" id="id3F9A1C3A" log="True" position="6">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
</Policy>
|
||||
<Interface dyn="False" id="id3F9A1BD9" label="" name="eth0" network_zone="sysid0" security_level="0" unnum="False">
|
||||
<IPv4 address="192.0.2.1" id="id3F9A1BDB" name="test:eth0(ip)" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id3F9A1BDA"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id3F9A1BDC" label="" name="eth1" network_zone="sysid0" security_level="100" unnum="False">
|
||||
<IPv4 address="192.168.0.1" id="id3F9A1BDE" name="test:eth1(ip)" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id3F9A1BDD"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id3F9A1BDF" label="" name="eth2" network_zone="sysid0" security_level="100" unnum="False">
|
||||
<IPv4 address="192.168.1.1" id="id3F9A1BE1" name="test:eth2(ip)" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id3F9A1BE0"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id3F9A1BE2" label="" name="eth3" network_zone="sysid0" security_level="100" unnum="False">
|
||||
<IPv4 address="192.168.2.1" id="id3F9A1BE4" name="test:eth3(ip)" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id3F9A1BE3"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id3F9A1BE5" label="" name="lo" network_zone="sysid0" security_level="100" unnum="False">
|
||||
<IPv4 address="127.0.0.1" id="id3F9A1BE7" name="test:lo(ip)" netmask="255.0.0.0"/>
|
||||
<InterfacePolicy id="id3F9A1BE6"/>
|
||||
</Interface>
|
||||
<Management address="127.0.0.1">
|
||||
<SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="True" identity="" port="9999"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<FirewallOptions>
|
||||
<Option name="accept_established">True</Option>
|
||||
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
||||
<Option name="action_on_reject">ICMP host prohibited</Option>
|
||||
<Option name="bridging_fw">False</Option>
|
||||
<Option name="check_shading">False</Option>
|
||||
<Option name="clamp_mss_to_mtu">False</Option>
|
||||
<Option name="cmdline"/>
|
||||
<Option name="compiler"/>
|
||||
<Option name="debug">False</Option>
|
||||
<Option name="eliminate_duplicates">False</Option>
|
||||
<Option name="firewall_dir">/etc</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
||||
<Option name="freebsd_path_ipf"/>
|
||||
<Option name="freebsd_path_ipnat"/>
|
||||
<Option name="freebsd_path_sysctl"/>
|
||||
<Option name="ignore_empty_groups">False</Option>
|
||||
<Option name="in_out_code">True</Option>
|
||||
<Option name="ipf_log_body">False</Option>
|
||||
<Option name="ipf_log_facility"/>
|
||||
<Option name="ipf_log_level"/>
|
||||
<Option name="ipf_log_or_block">False</Option>
|
||||
<Option name="ipf_nat_ftp_proxy">False</Option>
|
||||
<Option name="ipf_nat_h323_proxy">False</Option>
|
||||
<Option name="ipf_nat_ipsec_proxy">False</Option>
|
||||
<Option name="ipf_nat_raudio_proxy">False</Option>
|
||||
<Option name="ipf_nat_rcmd_proxy">False</Option>
|
||||
<Option name="ipf_return_icmp_as_dest">False</Option>
|
||||
<Option name="limit_suffix"/>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="linux24_ip_forward">1</Option>
|
||||
<Option name="linux24_path_ip"/>
|
||||
<Option name="linux24_path_iptables"/>
|
||||
<Option name="linux24_path_logger"/>
|
||||
<Option name="linux24_path_lsmod"/>
|
||||
<Option name="linux24_path_modprobe"/>
|
||||
<Option name="linux24_tcp_fin_timeout">30</Option>
|
||||
<Option name="linux24_tcp_keepalive_interval">1800</Option>
|
||||
<Option name="load_modules">True</Option>
|
||||
<Option name="local_nat">False</Option>
|
||||
<Option name="log_all">False</Option>
|
||||
<Option name="log_all_dropped">False</Option>
|
||||
<Option name="log_ip_opt">False</Option>
|
||||
<Option name="log_level">info</Option>
|
||||
<Option name="log_prefix">RULE %N -- %A </Option>
|
||||
<Option name="log_tcp_opt">False</Option>
|
||||
<Option name="log_tcp_seq">False</Option>
|
||||
<Option name="loopback_interface">lo</Option>
|
||||
<Option name="manage_virtual_addr">True</Option>
|
||||
<Option name="pass_all_out">False</Option>
|
||||
<Option name="snmp_contact"/>
|
||||
<Option name="snmp_description"/>
|
||||
<Option name="snmp_location"/>
|
||||
<Option name="ulog_cprange">0</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
<Option name="ulog_qthreshold">1</Option>
|
||||
<Option name="use_ULOG">False</Option>
|
||||
<Option name="use_numeric_log_levels">False</Option>
|
||||
<Option name="verify_interfaces">True</Option>
|
||||
</FirewallOptions>
|
||||
</Firewall>
|
||||
</ObjectGroup>
|
||||
<IntervalGroup id="stdid11_1" name="Time"/>
|
||||
</Library>
|
||||
</FWObjectDatabase>
|
||||
File diff suppressed because it is too large
Load Diff
Executable
+19
@@ -0,0 +1,19 @@
|
||||
#!/usr/bin/perl
|
||||
|
||||
$XMLFILE=@ARGV[0];
|
||||
|
||||
$DIFFCMD="diff -C 1 -b -B -c -I \"# Generated\" -I 'Activating ' -I '# Firewall Builder fwb_ipf v' ";
|
||||
|
||||
|
||||
while (<>) {
|
||||
$str=$_;
|
||||
while ( $str=~ /<Firewall / ) {
|
||||
$str=~ /<Firewall [^>]+name="([^"]*).*$"/;
|
||||
$fw=$1;
|
||||
printf "$DIFFCMD %s.fw.orig %s.fw\n",$fw,$fw;
|
||||
printf "$DIFFCMD %s-ipf.conf.orig %s-ipf.conf\n",$fw,$fw;
|
||||
printf "$DIFFCMD %s-nat.conf.orig %s-nat.conf\n",$fw,$fw;
|
||||
$str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//;
|
||||
}
|
||||
}
|
||||
|
||||
Executable
+17
@@ -0,0 +1,17 @@
|
||||
#!/bin/sh
|
||||
|
||||
for f in *.fw; do
|
||||
j=${f}.orig
|
||||
mv $f $j
|
||||
done
|
||||
|
||||
for f in *-ipf.conf; do
|
||||
j=${f}.orig
|
||||
mv $f $j
|
||||
done
|
||||
|
||||
for f in *-nat.conf; do
|
||||
j=${f}.orig
|
||||
mv $f $j
|
||||
done
|
||||
|
||||
Executable
+16
@@ -0,0 +1,16 @@
|
||||
#!/usr/bin/perl
|
||||
|
||||
$XMLFILE=@ARGV[0];
|
||||
|
||||
|
||||
while (<>) {
|
||||
$str=$_;
|
||||
while ( $str=~ /<Firewall / ) {
|
||||
$str=~ /<Firewall [^>]+name="([^"]*).*$"/;
|
||||
$fw=$1;
|
||||
printf "fwb_ipf -v -f $XMLFILE $fw\n";
|
||||
$str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
*.fw
|
||||
Executable
+15
@@ -0,0 +1,15 @@
|
||||
#!/bin/sh
|
||||
|
||||
N=$1
|
||||
|
||||
if which opendiff > /dev/null 2>&1; then
|
||||
TOOL="opendiff"
|
||||
elif which tkdiff > /dev/null 2>&1; then
|
||||
TOOL="tkdiff -b -B "
|
||||
else
|
||||
TOOL="diff -b -B "
|
||||
fi
|
||||
|
||||
${TOOL} firewall${N}.fw.orig firewall${N}.fw
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Executable
+15
@@ -0,0 +1,15 @@
|
||||
#!/usr/bin/perl
|
||||
|
||||
$XMLFILE=@ARGV[0];
|
||||
|
||||
$DIFFCMD="diff -C 1 -b -B -c -I \"# Generated\" -I 'Activating ' -I '# Firewall Builder fwb_ipfw v' ";
|
||||
|
||||
while (<>) {
|
||||
$str=$_;
|
||||
while ( $str=~ /<Firewall / ) {
|
||||
$str=~ /<Firewall [^>]+name="([^"]*).*$"/;
|
||||
$fw=$1;
|
||||
printf "$DIFFCMD %s.fw.orig %s.fw\n",$fw,$fw;
|
||||
$str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//;
|
||||
}
|
||||
}
|
||||
Executable
+8
@@ -0,0 +1,8 @@
|
||||
#!/bin/sh
|
||||
|
||||
for f in *.fw; do
|
||||
j=${f}.orig
|
||||
mv $f $j
|
||||
done
|
||||
|
||||
|
||||
Executable
+16
@@ -0,0 +1,16 @@
|
||||
#!/usr/bin/perl
|
||||
|
||||
$XMLFILE=@ARGV[0];
|
||||
|
||||
|
||||
while (<>) {
|
||||
$str=$_;
|
||||
while ( $str=~ /<Firewall / ) {
|
||||
$str=~ /<Firewall [^>]+name="([^"]*).*$"/;
|
||||
$fw=$1;
|
||||
printf "fwb_ipfw -v -f $XMLFILE $fw\n";
|
||||
$str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
*.fw
|
||||
@@ -0,0 +1,14 @@
|
||||
# this is a comment
|
||||
#
|
||||
; this should be a comment too
|
||||
;
|
||||
|
||||
192.168.1.1
|
||||
192.168.1.2/32
|
||||
192.168.1.3/30
|
||||
192.168.2.128/25
|
||||
192.168.1.200/32 # comment again
|
||||
192.168.1.201/32 # this should work, too
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,60 @@
|
||||
#
|
||||
# use this table to test run-time AddressTable object
|
||||
# (this is just a small collection of addresses that sent spam to me
|
||||
# on Nov 20 2005)
|
||||
#
|
||||
; this is a comment, too
|
||||
; empty lines are allowed and should be skipped by the script
|
||||
|
||||
151.8.224.178 # this is also a comment
|
||||
168.156.76.20
|
||||
193.207.126.36
|
||||
195.136.186.35
|
||||
196.15.136.15
|
||||
201.10.180.138
|
||||
201.17.93.16
|
||||
201.36.156.121
|
||||
202.103.25.253
|
||||
202.96.112.93
|
||||
203.162.3.209
|
||||
203.209.124.144
|
||||
210.106.193.237
|
||||
210.222.114.102
|
||||
211.144.143.143
|
||||
211.172.218.237
|
||||
211.250.16.132
|
||||
212.100.212.100
|
||||
212.21.241.31
|
||||
218.104.138.146
|
||||
218.18.72.252
|
||||
218.39.114.122
|
||||
218.55.115.43
|
||||
219.132.104.160
|
||||
220.71.17.86
|
||||
220.81.50.105
|
||||
220.91.99.46
|
||||
221.14.249.242
|
||||
221.166.177.135
|
||||
221.198.33.38
|
||||
221.202.160.233
|
||||
221.205.54.125
|
||||
221.217.44.248
|
||||
222.100.212.223
|
||||
222.121.118.144
|
||||
222.174.113.2
|
||||
58.231.13.78
|
||||
58.33.181.83
|
||||
58.53.82.190
|
||||
61.150.47.112
|
||||
61.184.14.102
|
||||
64.106.85.186
|
||||
70.228.60.100
|
||||
80.243.72.149
|
||||
80.249.77.34
|
||||
80.51.236.6
|
||||
81.196.74.125
|
||||
81.2.36.254
|
||||
82.117.221.205
|
||||
82.143.196.17
|
||||
82.77.37.174
|
||||
84.90.8.198
|
||||
Executable
+18
@@ -0,0 +1,18 @@
|
||||
#!/usr/bin/perl
|
||||
|
||||
$XMLFILE=@ARGV[0];
|
||||
|
||||
if (-x "/usr/bin/opendiff") { $TOOL="opendiff"; }
|
||||
else { $TOOL="tkdiff -b -B "; }
|
||||
|
||||
|
||||
|
||||
while (<>) {
|
||||
$str=$_;
|
||||
while ( $str=~ /<Firewall / ) {
|
||||
$str=~ /<Firewall [^>]+name="([^"]*).*$"/;
|
||||
$fw=$1;
|
||||
printf "$TOOL %s.fw.orig %s.fw\n",$fw,$fw;
|
||||
$str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//;
|
||||
}
|
||||
}
|
||||
Executable
+15
@@ -0,0 +1,15 @@
|
||||
#!/bin/sh
|
||||
|
||||
N=$1
|
||||
|
||||
if which opendiff > /dev/null 2>&1; then
|
||||
TOOL="opendiff"
|
||||
elif which tkdiff > /dev/null 2>&1; then
|
||||
TOOL="tkdiff -b -B "
|
||||
else
|
||||
TOOL="diff -b -B "
|
||||
fi
|
||||
|
||||
${TOOL} firewall${N}.fw.orig firewall${N}.fw
|
||||
|
||||
|
||||
@@ -0,0 +1,3 @@
|
||||
# this is an empty address table file
|
||||
# it has no addresses
|
||||
|
||||
@@ -0,0 +1,200 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
|
||||
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="2.0.6" id="root">
|
||||
<Library color="#d2ffd0" comment="User defined objects" id="syslib001" name="User">
|
||||
<ObjectGroup id="stdid01_1" name="Objects">
|
||||
<ObjectGroup id="stdid16_1" name="Addresses"/>
|
||||
<ObjectGroup id="stdid04_1" name="Groups"/>
|
||||
<ObjectGroup id="stdid02_1" name="Hosts"/>
|
||||
<ObjectGroup id="stdid03_1" name="Networks">
|
||||
<Network comment="" id="id3F9A1BC7" name="net A" address="192.168.0.0" netmask="255.255.255.0"/>
|
||||
<Network comment="" id="id3F9A1BC8" name="net B" address="192.168.1.0" netmask="255.255.255.0"/>
|
||||
<Network comment="" id="id3F9A1BC9" name="net C" address="192.168.2.0" netmask="255.255.255.0"/>
|
||||
</ObjectGroup>
|
||||
<ObjectGroup id="stdid15_1" name="Address Ranges">
|
||||
<AddressRange comment="" id="id3F9A1BCA" name="range A" start_address="192.168.0.10" end_address="192.168.0.250"/>
|
||||
<AddressRange comment="" id="id3F9A1BCB" name="range B" start_address="192.168.1.10" end_address="192.168.1.250"/>
|
||||
<AddressRange comment="" id="id3F9A1BCC" name="range C" start_address="192.168.2.10" end_address="192.168.2.250"/>
|
||||
</ObjectGroup>
|
||||
</ObjectGroup>
|
||||
<ServiceGroup id="stdid05_1" name="Services">
|
||||
<ServiceGroup id="stdid10_1" name="Groups"/>
|
||||
<ServiceGroup id="stdid07_1" name="ICMP"/>
|
||||
<ServiceGroup id="stdid06_1" name="IP"/>
|
||||
<ServiceGroup id="stdid09_1" name="TCP"/>
|
||||
<ServiceGroup id="stdid08_1" name="UDP"/>
|
||||
<ServiceGroup id="stdid13_1" name="Custom"/>
|
||||
</ServiceGroup>
|
||||
<ObjectGroup id="stdid12_1" name="Firewalls">
|
||||
<Firewall comment="" host_OS="linux24" id="id3F9A1BD2" name="test" platform="iptables">
|
||||
<NAT id="id3F9A1BD6"/>
|
||||
<Policy id="id3F9A1BD5">
|
||||
<PolicyRule action="Accept" comment="" disabled="False" id="id3F9A1CE7" log="False" position="0">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9A1BC7"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9A1BC8"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" disabled="False" id="id3F9A1BF6" log="False" position="1">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9A1BCA"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9A1BCB"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" disabled="False" id="id3F9A1BEC" log="False" position="2">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9A1BCA"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9A1BCC"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" disabled="False" id="id3F9A1C2E" log="False" position="3">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9A1BCB"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9A1BCC"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" disabled="False" id="id3F9A1C96" log="False" position="4">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id3F9A1BC7"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id3F9A1BC8"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Deny" disabled="False" id="id3F9A1C3A" log="True" position="5">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions/>
|
||||
</PolicyRule>
|
||||
</Policy>
|
||||
<Interface dyn="False" id="id3F9A1BD9" label="" name="eth0" network_zone="sysid0" security_level="0" unnum="False">
|
||||
<IPv4 address="192.0.2.1" id="id3F9A1BDB" name="test:eth0(ip)" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id3F9A1BDA"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id3F9A1BDC" label="" name="eth1" network_zone="sysid0" security_level="100" unnum="False">
|
||||
<IPv4 address="192.168.0.1" id="id3F9A1BDE" name="test:eth1(ip)" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id3F9A1BDD"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id3F9A1BDF" label="" name="eth2" network_zone="sysid0" security_level="100" unnum="False">
|
||||
<IPv4 address="192.168.1.1" id="id3F9A1BE1" name="test:eth2(ip)" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id3F9A1BE0"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id3F9A1BE2" label="" name="eth3" network_zone="sysid0" security_level="100" unnum="False">
|
||||
<IPv4 address="192.168.2.1" id="id3F9A1BE4" name="test:eth3(ip)" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id3F9A1BE3"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id3F9A1BE5" label="" name="lo" network_zone="sysid0" security_level="100" unnum="False">
|
||||
<IPv4 address="127.0.0.1" id="id3F9A1BE7" name="test:lo(ip)" netmask="255.0.0.0"/>
|
||||
<InterfacePolicy id="id3F9A1BE6"/>
|
||||
</Interface>
|
||||
<Management address="127.0.0.1">
|
||||
<SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="True" identity="" port="9999"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<FirewallOptions>
|
||||
<Option name="accept_established">True</Option>
|
||||
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
||||
<Option name="action_on_reject">ICMP admin prohibited</Option>
|
||||
<Option name="bridging_fw">False</Option>
|
||||
<Option name="check_shading">False</Option>
|
||||
<Option name="clamp_mss_to_mtu">False</Option>
|
||||
<Option name="cmdline"/>
|
||||
<Option name="compiler"/>
|
||||
<Option name="debug">False</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
||||
<Option name="ignore_empty_groups">False</Option>
|
||||
<Option name="limit_suffix"/>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="linux24_ip_forward">1</Option>
|
||||
<Option name="linux24_path_ip"/>
|
||||
<Option name="linux24_path_iptables"/>
|
||||
<Option name="linux24_path_logger"/>
|
||||
<Option name="linux24_path_lsmod"/>
|
||||
<Option name="linux24_path_modprobe"/>
|
||||
<Option name="linux24_tcp_fin_timeout">30</Option>
|
||||
<Option name="linux24_tcp_keepalive_interval">1800</Option>
|
||||
<Option name="load_modules">True</Option>
|
||||
<Option name="local_nat">False</Option>
|
||||
<Option name="log_all">False</Option>
|
||||
<Option name="log_all_dropped">False</Option>
|
||||
<Option name="log_ip_opt">False</Option>
|
||||
<Option name="log_level">info</Option>
|
||||
<Option name="log_prefix">RULE %N -- %A </Option>
|
||||
<Option name="log_tcp_opt">False</Option>
|
||||
<Option name="log_tcp_seq">False</Option>
|
||||
<Option name="loopback_interface">lo</Option>
|
||||
<Option name="manage_virtual_addr">True</Option>
|
||||
<Option name="snmp_contact"/>
|
||||
<Option name="snmp_description"/>
|
||||
<Option name="snmp_location"/>
|
||||
<Option name="ulog_cprange">0</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
<Option name="ulog_qthreshold">1</Option>
|
||||
<Option name="use_ULOG">False</Option>
|
||||
<Option name="use_numeric_log_levels">False</Option>
|
||||
<Option name="verify_interfaces">True</Option>
|
||||
</FirewallOptions>
|
||||
</Firewall>
|
||||
</ObjectGroup>
|
||||
<IntervalGroup id="stdid11_1" name="Time"/>
|
||||
</Library>
|
||||
<Library color="#d4f8ff" comment="Standard objects" id="syslib000" name="Standard" ro="True">
|
||||
<AnyIPService comment="Any IP Service" id="sysid1" name="Any" protocol_num="0"/>
|
||||
<AnyInterval comment="Any Interval" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" id="sysid2" name="Any" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
|
||||
<AnyNetwork comment="Any Network" id="sysid0" name="Any" address="0.0.0.0" netmask="0.0.0.0"/>
|
||||
</Library>
|
||||
</FWObjectDatabase>
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,1207 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
|
||||
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="2.0.3" lastModified="1095039616" id="root">
|
||||
<Library color="#d2ffd0" id="id413EEA4C" name="User">
|
||||
<ObjectGroup id="id413EEA4D" name="Objects">
|
||||
<ObjectGroup id="id413EEA4E" name="Addresses"/>
|
||||
<ObjectGroup id="id413EEA4F" name="Groups"/>
|
||||
<ObjectGroup id="id413EEA50" name="Hosts">
|
||||
<Host comment="" id="id413EEA6D" name="Inside Host 1">
|
||||
<Interface dyn="False" id="id413EEA6F" label="" name="eth0" security_level="0" unnum="False">
|
||||
<IPv4 address="10.0.1.1" comment="" id="id413EEA71" name="Inside Host 1:eth0:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEA70"/>
|
||||
</Interface>
|
||||
<Management address="0.0.0.0">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<HostOptions>
|
||||
<Option name="use_mac_addr_filter">False</Option>
|
||||
</HostOptions>
|
||||
</Host>
|
||||
<Host comment="" id="id413EEA7C" name="Inside Host 2">
|
||||
<Interface dyn="False" id="id413EEA7F" label="" name="eth0" security_level="0" unnum="False">
|
||||
<IPv4 address="10.0.1.2" comment="" id="id413EEA81" name="Inside Host 2:eth0:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEA80"/>
|
||||
</Interface>
|
||||
<Management address="0.0.0.0">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<HostOptions>
|
||||
<Option name="use_mac_addr_filter">False</Option>
|
||||
</HostOptions>
|
||||
</Host>
|
||||
<Host comment="" id="id413EEA8C" name="Inside Host 3">
|
||||
<Interface dyn="False" id="id413EEA8F" label="" name="eth0" security_level="0" unnum="False">
|
||||
<IPv4 address="10.0.1.3" comment="" id="id413EEA91" name="Inside Host 3:eth0:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEA90"/>
|
||||
</Interface>
|
||||
<Management address="0.0.0.0">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<HostOptions>
|
||||
<Option name="use_mac_addr_filter">False</Option>
|
||||
</HostOptions>
|
||||
</Host>
|
||||
<Host comment="" id="id413EEA94" name="Inside Host 4">
|
||||
<Interface dyn="False" id="id413EEA97" label="" name="eth0" security_level="0" unnum="False">
|
||||
<IPv4 address="10.0.1.4" comment="" id="id413EEA99" name="Inside Host 4:eth0:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEA98"/>
|
||||
</Interface>
|
||||
<Management address="0.0.0.0">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<HostOptions>
|
||||
<Option name="use_mac_addr_filter">False</Option>
|
||||
</HostOptions>
|
||||
</Host>
|
||||
<Host comment="" id="id413EEAA4" name="Outside Host 1">
|
||||
<Interface dyn="False" id="id413EEAA7" label="" name="eth0" security_level="0" unnum="False">
|
||||
<IPv4 address="10.0.0.1" comment="" id="id413EEAA9" name="Outside Host 1:eth0:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEAA8"/>
|
||||
</Interface>
|
||||
<Management address="0.0.0.0">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<HostOptions>
|
||||
<Option name="use_mac_addr_filter">False</Option>
|
||||
</HostOptions>
|
||||
</Host>
|
||||
<Host comment="" id="id413EEAB4" name="Outside Host 3">
|
||||
<Interface dyn="False" id="id413EEAB7" label="" name="eth0" security_level="0" unnum="False">
|
||||
<IPv4 address="10.0.0.3" comment="" id="id413EEAB9" name="Outside Host 3:eth0:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEAB8"/>
|
||||
</Interface>
|
||||
<Management address="0.0.0.0">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<HostOptions>
|
||||
<Option name="use_mac_addr_filter">False</Option>
|
||||
</HostOptions>
|
||||
</Host>
|
||||
<Host comment="" id="id413EEABC" name="Outside Host 4">
|
||||
<Interface dyn="False" id="id413EEABF" label="" name="eth0" security_level="0" unnum="False">
|
||||
<IPv4 address="10.0.0.4" comment="" id="id413EEAC1" name="Outside Host 4:eth0:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEAC0"/>
|
||||
</Interface>
|
||||
<Management address="0.0.0.0">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<HostOptions>
|
||||
<Option name="use_mac_addr_filter">False</Option>
|
||||
</HostOptions>
|
||||
</Host>
|
||||
<Host comment="" id="id413EEAC4" name="Outside Host 2">
|
||||
<Interface dyn="False" id="id413EEAC7" label="" name="eth0" security_level="0" unnum="False">
|
||||
<IPv4 address="10.0.0.2" comment="" id="id413EEAC9" name="Outside Host 2:eth0:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEAC8"/>
|
||||
</Interface>
|
||||
<Management address="0.0.0.0">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<HostOptions>
|
||||
<Option name="use_mac_addr_filter">False</Option>
|
||||
</HostOptions>
|
||||
</Host>
|
||||
</ObjectGroup>
|
||||
<ObjectGroup id="id413EEA51" name="Networks">
|
||||
<Network comment="" id="id413EEACC" name="Test Network 1" address="10.0.3.0" netmask="255.255.255.0"/>
|
||||
<Network comment="DMZ net - using NAT" id="id4145F2F8" name="dmz_net" address="192.168.2.0" netmask="255.255.255.0"/>
|
||||
<Network comment="" id="id4145F2F7" name="Internal_net" address="192.168.1.0" netmask="255.255.255.0"/>
|
||||
</ObjectGroup>
|
||||
<ObjectGroup id="id413EEA52" name="Address Ranges"/>
|
||||
</ObjectGroup>
|
||||
<ServiceGroup id="id413EEA53" name="Services">
|
||||
<ServiceGroup id="id413EEA54" name="Groups"/>
|
||||
<ServiceGroup id="id413EEA55" name="ICMP"/>
|
||||
<ServiceGroup id="id413EEA56" name="IP"/>
|
||||
<ServiceGroup id="id413EEA57" name="TCP"/>
|
||||
<ServiceGroup id="id413EEA58" name="UDP"/>
|
||||
<ServiceGroup id="id413EEA59" name="Custom"/>
|
||||
</ServiceGroup>
|
||||
<ObjectGroup id="id413EEA5A" name="Firewalls">
|
||||
<Firewall comment="" host_OS="linux24" id="id413EEA5C" name="optitest" platform="iptables" version="1.2.9">
|
||||
<NAT id="id413EEA60"/>
|
||||
<Policy id="id413EEA5F">
|
||||
<PolicyRule action="Accept" comment="Test 0 : Don't Optimize 1 src" disabled="False" id="id413EEF55" log="False" position="0">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 1 : Don't Optimize 1 dst" disabled="False" id="id413EEF0A" log="False" position="1">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 2 : Don't Optimize 1 service" disabled="False" id="id413EEEFF" log="False" position="2">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 3 : Don't Optimize 1 src & 1 dst" disabled="False" id="id413EEF80" log="False" position="3">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 4 : Don't Optimize 1 src & 1 service" disabled="False" id="id413EEFE0" log="False" position="4">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 5 : Don't Optimize 1 dst & 1 service" disabled="False" id="id413EEFB4" log="False" position="5">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 6 : Don't Optimize 1 src, 1 dst & 1 service" disabled="False" id="id413EF013" log="False" position="6">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 7 : Optimize : src, dst, svc\nTime should appear on the src rules in the FORWARD table\n+Logging\n" disabled="False" id="id413FD6F5" log="True" position="7">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
<ServiceRef ref="id4127EA73"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="id413EEACD"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#C0BA44</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 7 : Optimize on service - dsts -> user chain" disabled="False" id="id413EF03D" log="False" position="8">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
<ObjectRef ref="id413EEAB4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#8BC065</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 8 : Optimize on service - srcs -> user chain" disabled="False" id="id413EF062" log="False" position="9">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
<ObjectRef ref="id413EEA8C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#8BC065</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Reject" comment="Test 9 : Optimize on service - srcs -> user chain\n Dst to stay on rule in FORWARD table\n\n+ options TCP RST Reject Test" disabled="False" id="id413EF08B" log="False" position="10">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
<ObjectRef ref="id413EEA8C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="action_on_reject">TCP RST</Option>
|
||||
<Option name="color">#8BC065</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="limit_burst">0</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="log_level"></Option>
|
||||
<Option name="log_prefix"></Option>
|
||||
<Option name="stateless">False</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 10 : Optimize on src & dst, services -> user chain\n+ Logging " disabled="False" id="id413F033B" log="True" position="11">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
<ServiceRef ref="id4127EA73"/>
|
||||
<ServiceRef ref="id3C20EEB5"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#8BC065</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 11 : Special case - with multiport we shouldn't\noptimize here as all services are TCP and we have <15\nof them\n\nNOT OPTIMUM - We've split before multiport which re-merges multiple services of the same type\nSOLUTION ?" disabled="False" id="id413F0486" log="False" position="12">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#C86E6E</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 12 : Optimize : src, dst, svc\n+ options limit test\n+ logging" disabled="False" id="id413EEACF" log="True" position="13">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
<ObjectRef ref="id413EEAB4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
<ServiceRef ref="id3C20EEB5"/>
|
||||
<ServiceRef ref="id4127EA73"/>
|
||||
<ServiceRef ref="id3CB12797"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="action_on_reject"></Option>
|
||||
<Option name="color">#8BC065</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="limit_burst">4</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">8</Option>
|
||||
<Option name="log_level"></Option>
|
||||
<Option name="log_prefix"></Option>
|
||||
<Option name="stateless">False</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 13 : Optimize : src, dst, svc\nTime should appear on the src rules in the FORWARD table\n+Logging\n\nNOT OPTIMUM : Time appears in Logging\nSOLUTION : Patch logging not to include time?" disabled="False" id="id413EEDC5" log="True" position="14">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
<ObjectRef ref="id413EEAB4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
<ServiceRef ref="id3C20EEB5"/>
|
||||
<ServiceRef ref="id4127EA73"/>
|
||||
<ServiceRef ref="id3CB12797"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="id413EEACD"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#C0BA44</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 14 : Optimize : src, dst, svc\nTime should appear on the service rules\nsince we there are two of them and we don't optimize\nfor time (yet!)\n+ Logging\n\nNOT OPTIMUM : Time appears in Logging\nSOLUTION : Patch logging not to include time?" disabled="False" id="id413EEE2D" log="False" position="15">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
<ObjectRef ref="id413EEAB4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
<ServiceRef ref="id3C20EEB5"/>
|
||||
<ServiceRef ref="id4127EA73"/>
|
||||
<ServiceRef ref="id3CB12797"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="id413EEACD"/>
|
||||
<IntervalRef ref="id413EEACE"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#C0BA44</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Reject" comment="Test 15 : Don't optimize if we have limit options" disabled="False" id="id413F065C" log="False" position="16">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="action_on_reject">TCP RST</Option>
|
||||
<Option name="color">#7694C0</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="limit_burst">4</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">8</Option>
|
||||
<Option name="log_level"></Option>
|
||||
<Option name="log_prefix"></Option>
|
||||
<Option name="stateless">False</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Deny" comment="Test 16 : Check INPUT/OUPUT with FW part of rule" disabled="False" id="id413F0C67" log="True" position="17">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEA5C"/>
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#8BC065</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
</Policy>
|
||||
<Interface dyn="False" id="id413EEA61" label="Outside" name="eth0" security_level="0" unnum="False">
|
||||
<IPv4 address="10.0.0.254" comment="" id="id413EEA63" name="optitest:eth0:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEA62">
|
||||
<PolicyRule action="Accept" comment="Test 1 : Don't Optimize 1 dst" direction="Both" disabled="False" id="id4145343B" log="False" position="0">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 2 : Don't Optimize 1 service" direction="Both" disabled="False" id="id41453449" log="False" position="1">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 3 : Don't Optimize 1 src & 1 dst" direction="Both" disabled="False" id="id41453457" log="False" position="2">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 4 : Don't Optimize 1 src & 1 service" direction="Both" disabled="False" id="id41453465" log="False" position="3">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 5 : Don't Optimize 1 dst & 1 service" direction="Both" disabled="False" id="id41453473" log="False" position="4">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 6 : Don't Optimize 1 src, 1 dst & 1 service" direction="Both" disabled="False" id="id41453481" log="False" position="5">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 7 : Optimize : src, dst, svc\nTime should appear on the src rules in the FORWARD table\n+Logging\n" direction="Both" disabled="False" id="id4145348F" log="True" position="6">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
<ServiceRef ref="id4127EA73"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="id413EEACD"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#C0BA44</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 7 : Optimize on service - dsts -> user chain" direction="Both" disabled="False" id="id414534A0" log="False" position="7">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
<ObjectRef ref="id413EEAB4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#8BC065</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 8 : Optimize on service - srcs -> user chain" direction="Both" disabled="False" id="id414534B0" log="False" position="8">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
<ObjectRef ref="id413EEA8C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#8BC065</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Reject" comment="Test 9 : Optimize on service - srcs -> user chain\n Dst to stay on rule in FORWARD table\n\n+ options TCP RST Reject Test" direction="Both" disabled="False" id="id414534C0" log="False" position="9">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
<ObjectRef ref="id413EEA8C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="action_on_reject">TCP RST</Option>
|
||||
<Option name="color">#8BC065</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="limit_burst">0</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="log_level"></Option>
|
||||
<Option name="log_prefix"></Option>
|
||||
<Option name="stateless">False</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 10 : Optimize on src & dst, services -> user chain\n+ Logging " direction="Both" disabled="False" id="id414534D0" log="True" position="10">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
<ServiceRef ref="id4127EA73"/>
|
||||
<ServiceRef ref="id3C20EEB5"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#8BC065</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 11 : Special case - with multiport we shouldn't\noptimize here as all services are TCP and we have <15\nof them\n\nNOT OPTIMUM - We've split before multiport which re-merges multiple services of the same type\nSOLUTION ?" direction="Both" disabled="False" id="id414534E0" log="False" position="11">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#C86E6E</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 12 : Optimize : src, dst, svc\n+ options limit test\n+ logging" direction="Both" disabled="False" id="id414534EF" log="True" position="12">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
<ObjectRef ref="id413EEAB4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
<ServiceRef ref="id3C20EEB5"/>
|
||||
<ServiceRef ref="id4127EA73"/>
|
||||
<ServiceRef ref="id3CB12797"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="action_on_reject"></Option>
|
||||
<Option name="color">#8BC065</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="limit_burst">4</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">8</Option>
|
||||
<Option name="log_level"></Option>
|
||||
<Option name="log_prefix"></Option>
|
||||
<Option name="stateless">False</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 13 : Optimize : src, dst, svc\nTime should appear on the src rules in the FORWARD table\n+Logging\n\nNOT OPTIMUM : Time appears in Logging\nSOLUTION : Patch logging not to include time?" direction="Both" disabled="False" id="id41453502" log="True" position="13">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
<ObjectRef ref="id413EEAB4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
<ServiceRef ref="id3C20EEB5"/>
|
||||
<ServiceRef ref="id4127EA73"/>
|
||||
<ServiceRef ref="id3CB12797"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="id413EEACD"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#C0BA44</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 14 : Optimize : src, dst, svc\nTime should appear on the service rules\nsince we there are two of them and we don't optimize\nfor time (yet!)\n+ Logging\n\nNOT OPTIMUM : Time appears in Logging\nSOLUTION : Patch logging not to include time?" direction="Both" disabled="False" id="id41453516" log="False" position="14">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
<ObjectRef ref="id413EEA7C"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
<ObjectRef ref="id413EEAB4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
<ServiceRef ref="id3C20EEB5"/>
|
||||
<ServiceRef ref="id4127EA73"/>
|
||||
<ServiceRef ref="id3CB12797"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="id413EEACD"/>
|
||||
<IntervalRef ref="id413EEACE"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#C0BA44</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Reject" comment="Test 15 : Don't optimize if we have limit options" direction="Both" disabled="False" id="id4145352B" log="False" position="15">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEAC4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="action_on_reject">TCP RST</Option>
|
||||
<Option name="color">#7694C0</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="limit_burst">4</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">8</Option>
|
||||
<Option name="log_level"></Option>
|
||||
<Option name="log_prefix"></Option>
|
||||
<Option name="stateless">False</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Deny" comment="Test 16 : Check INPUT/OUPUT with FW part of rule" direction="Both" disabled="False" id="id41453539" log="True" position="16">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="id413EEA5C"/>
|
||||
<ObjectRef ref="id413EEAA4"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#8BC065</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Accept" comment="Test 0 : Don't Optimize 1 src" direction="Both" disabled="False" id="id4145342D" log="False" position="17">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id413EEA6D"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="sysid1"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="color">#7694C0</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
</InterfacePolicy>
|
||||
</Interface>
|
||||
<Interface comment="" dyn="False" id="id413EEA64" label="Inside" mgmt="True" name="eth1" security_level="100" unnum="False">
|
||||
<IPv4 address="10.0.1.254" comment="" id="id413EEA66" name="optitest:eth1:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEA65"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id413EEA67" label="DMZ" name="eth2" security_level="100" unnum="False">
|
||||
<IPv4 address="10.0.2.254" comment="" id="id413EEA69" name="optitest:eth2:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id413EEA68"/>
|
||||
</Interface>
|
||||
<Management address="10.0.1.254">
|
||||
<SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="False" identity="" port="-1"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<FirewallOptions>
|
||||
<Option name="accept_established">True</Option>
|
||||
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
||||
<Option name="action_on_reject"></Option>
|
||||
<Option name="activationCmd"></Option>
|
||||
<Option name="admUser"></Option>
|
||||
<Option name="altAddress"></Option>
|
||||
<Option name="bridging_fw">False</Option>
|
||||
<Option name="check_shading">False</Option>
|
||||
<Option name="clamp_mss_to_mtu">False</Option>
|
||||
<Option name="cmdline"></Option>
|
||||
<Option name="compiler"></Option>
|
||||
<Option name="configure_interfaces">False</Option>
|
||||
<Option name="debug">False</Option>
|
||||
<Option name="eliminate_duplicates">true</Option>
|
||||
<Option name="firewall_dir">/etc</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="freebsd_ip_forward">1</Option>
|
||||
<Option name="ignore_empty_groups">False</Option>
|
||||
<Option name="in_out_code">true</Option>
|
||||
<Option name="limit_suffix">/second</Option>
|
||||
<Option name="limit_value">5</Option>
|
||||
<Option name="linux24_accept_redirects"></Option>
|
||||
<Option name="linux24_accept_source_route"></Option>
|
||||
<Option name="linux24_icmp_echo_ignore_all"></Option>
|
||||
<Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
|
||||
<Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
|
||||
<Option name="linux24_ip_dynaddr"></Option>
|
||||
<Option name="linux24_ip_forward">1</Option>
|
||||
<Option name="linux24_log_martians"></Option>
|
||||
<Option name="linux24_path_ip"></Option>
|
||||
<Option name="linux24_path_iptables"></Option>
|
||||
<Option name="linux24_path_logger"></Option>
|
||||
<Option name="linux24_path_lsmod"></Option>
|
||||
<Option name="linux24_path_modprobe"></Option>
|
||||
<Option name="linux24_rp_filter"></Option>
|
||||
<Option name="linux24_tcp_ecn"></Option>
|
||||
<Option name="linux24_tcp_fack"></Option>
|
||||
<Option name="linux24_tcp_fin_timeout">0</Option>
|
||||
<Option name="linux24_tcp_keepalive_interval">0</Option>
|
||||
<Option name="linux24_tcp_sack"></Option>
|
||||
<Option name="linux24_tcp_syncookies"></Option>
|
||||
<Option name="linux24_tcp_timestamps"></Option>
|
||||
<Option name="linux24_tcp_window_scaling"></Option>
|
||||
<Option name="load_modules">False</Option>
|
||||
<Option name="local_nat">False</Option>
|
||||
<Option name="log_all">False</Option>
|
||||
<Option name="log_ip_opt">False</Option>
|
||||
<Option name="log_level">info</Option>
|
||||
<Option name="log_prefix">RULE %N -- %A </Option>
|
||||
<Option name="log_tcp_opt">False</Option>
|
||||
<Option name="log_tcp_seq">False</Option>
|
||||
<Option name="loopback_interface">lo0</Option>
|
||||
<Option name="macosx_ip_forward">1</Option>
|
||||
<Option name="manage_virtual_addr">False</Option>
|
||||
<Option name="mgmt_addr"></Option>
|
||||
<Option name="mgmt_ssh">False</Option>
|
||||
<Option name="openbsd_ip_forward">1</Option>
|
||||
<Option name="pass_all_out">false</Option>
|
||||
<Option name="pf_limit_frags">5000</Option>
|
||||
<Option name="pf_limit_states">10000</Option>
|
||||
<Option name="pf_scrub_maxmss">1460</Option>
|
||||
<Option name="pf_timeout_frag">30</Option>
|
||||
<Option name="pf_timeout_interval">10</Option>
|
||||
<Option name="pix_add_clear_statements">true</Option>
|
||||
<Option name="pix_assume_fw_part_of_any">true</Option>
|
||||
<Option name="pix_default_logint">300</Option>
|
||||
<Option name="pix_emblem_log_format">false</Option>
|
||||
<Option name="pix_emulate_out_acl">true</Option>
|
||||
<Option name="pix_floodguard">true</Option>
|
||||
<Option name="pix_include_comments">true</Option>
|
||||
<Option name="pix_route_dnat_supported">true</Option>
|
||||
<Option name="pix_rule_syslog_settings">false</Option>
|
||||
<Option name="pix_security_fragguard_supported">true</Option>
|
||||
<Option name="pix_syslog_device_id_supported">false</Option>
|
||||
<Option name="pix_use_acl_remarks">true</Option>
|
||||
<Option name="prompt1">$ </Option>
|
||||
<Option name="prompt2"> # </Option>
|
||||
<Option name="solaris_ip_forward">1</Option>
|
||||
<Option name="ulog_cprange">0</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
<Option name="ulog_qthreshold">1</Option>
|
||||
<Option name="use_ULOG">False</Option>
|
||||
<Option name="use_numeric_log_levels">False</Option>
|
||||
<Option name="verify_interfaces">False</Option>
|
||||
</FirewallOptions>
|
||||
</Firewall>
|
||||
<Firewall comment="testing rules with action-on-reject "TCP reset"\n" host_OS="linux24" id="id4145F25F" name="firewall99" platform="iptables" version="">
|
||||
<NAT id="id4145F2E2"/>
|
||||
<Policy id="id4145F264">
|
||||
<PolicyRule action="Reject" disabled="False" id="id4145F2B5" log="False" position="0">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id4145F2F7"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="action_on_reject">TCP RST</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="limit_burst">0</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="log_level"></Option>
|
||||
<Option name="log_prefix"></Option>
|
||||
<Option name="stateless">False</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Reject" comment="" disabled="False" id="id4145F2BF" log="False" position="1">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id4145F2F7"/>
|
||||
<ObjectRef ref="id4145F2F8"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="action_on_reject">TCP RST</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="limit_burst">0</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="log_level"></Option>
|
||||
<Option name="log_prefix"></Option>
|
||||
<Option name="stateless">False</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Reject" comment="" disabled="False" id="id4145F2CA" log="False" position="2">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id4145F2F7"/>
|
||||
<ObjectRef ref="id4145F2F8"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="tcp-HTTP"/>
|
||||
<ServiceRef ref="icmp-Unreachables"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="action_on_reject">TCP RST</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="limit_burst">0</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="log_level"></Option>
|
||||
<Option name="log_prefix"></Option>
|
||||
<Option name="stateless">False</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
<PolicyRule action="Reject" comment="" disabled="False" id="id4145F2D6" log="False" position="3">
|
||||
<Src neg="False">
|
||||
<ObjectRef ref="id4145F2F7"/>
|
||||
<ObjectRef ref="id4145F2F8"/>
|
||||
</Src>
|
||||
<Dst neg="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
</Dst>
|
||||
<Srv neg="False">
|
||||
<ServiceRef ref="icmp-Unreachables"/>
|
||||
<ServiceRef ref="tcp-FTP"/>
|
||||
</Srv>
|
||||
<When neg="False">
|
||||
<IntervalRef ref="sysid2"/>
|
||||
</When>
|
||||
<PolicyRuleOptions>
|
||||
<Option name="action_on_reject">TCP RST</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">False</Option>
|
||||
<Option name="limit_burst">0</Option>
|
||||
<Option name="limit_suffix"></Option>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="log_level"></Option>
|
||||
<Option name="log_prefix"></Option>
|
||||
<Option name="stateless">False</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
</PolicyRuleOptions>
|
||||
</PolicyRule>
|
||||
</Policy>
|
||||
<Interface comment="" dyn="False" id="id4145F2E3" label="" mgmt="True" name="eth0" security_level="100" unnum="False">
|
||||
<IPv4 address="192.168.1.1" id="id4145F2E7" name="firewall99:eth0:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id4145F2E6"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id4145F2E8" name="eth1" security_level="0" unnum="False">
|
||||
<IPv4 address="22.22.22.22" id="id4145F2EC" name="firewall99:eth1:ip" netmask="255.255.255.0"/>
|
||||
<InterfacePolicy id="id4145F2EB"/>
|
||||
</Interface>
|
||||
<Interface dyn="False" id="id4145F2ED" name="lo" security_level="100" unnum="False">
|
||||
<IPv4 address="127.0.0.1" id="id4145F2F1" name="firewall99:lo:ip" netmask="255.0.0.0"/>
|
||||
<InterfacePolicy id="id4145F2F0"/>
|
||||
</Interface>
|
||||
<Management address="192.168.1.1">
|
||||
<SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
|
||||
<FWBDManagement enabled="True" identity="" port="9999"/>
|
||||
<PolicyInstallScript arguments="" command="" enabled="False"/>
|
||||
</Management>
|
||||
<FirewallOptions>
|
||||
<Option name="accept_established">True</Option>
|
||||
<Option name="accept_new_tcp_with_no_syn">True</Option>
|
||||
<Option name="action_on_reject">ICMP net unreachable</Option>
|
||||
<Option name="bridging_fw">False</Option>
|
||||
<Option name="check_shading">False</Option>
|
||||
<Option name="clamp_mss_to_mtu">False</Option>
|
||||
<Option name="cmdline"></Option>
|
||||
<Option name="compiler"></Option>
|
||||
<Option name="configure_interfaces">True</Option>
|
||||
<Option name="debug">False</Option>
|
||||
<Option name="dyn_addr">False</Option>
|
||||
<Option name="firewall_is_part_of_any">True</Option>
|
||||
<Option name="firewall_is_part_of_any_and_networks">True</Option>
|
||||
<Option name="ignore_empty_groups">False</Option>
|
||||
<Option name="inst_cmdline"></Option>
|
||||
<Option name="inst_script"></Option>
|
||||
<Option name="install_script"></Option>
|
||||
<Option name="limit_suffix">/day</Option>
|
||||
<Option name="limit_value">0</Option>
|
||||
<Option name="linux24_ip_forward">0</Option>
|
||||
<Option name="linux24_path_ip"></Option>
|
||||
<Option name="linux24_path_iptables"></Option>
|
||||
<Option name="linux24_path_logger"></Option>
|
||||
<Option name="linux24_path_lsmod"></Option>
|
||||
<Option name="linux24_path_modprobe"></Option>
|
||||
<Option name="linux24_tcp_fin_timeout">30</Option>
|
||||
<Option name="linux24_tcp_keepalive_interval">1800</Option>
|
||||
<Option name="load_modules">False</Option>
|
||||
<Option name="local_nat">False</Option>
|
||||
<Option name="log_all">False</Option>
|
||||
<Option name="log_all_dropped">False</Option>
|
||||
<Option name="log_ip_opt">False</Option>
|
||||
<Option name="log_level">debug</Option>
|
||||
<Option name="log_limit_suffix">/second</Option>
|
||||
<Option name="log_limit_value">0</Option>
|
||||
<Option name="log_prefix">RULE %N -- %A %I</Option>
|
||||
<Option name="log_tcp_opt">False</Option>
|
||||
<Option name="log_tcp_seq">False</Option>
|
||||
<Option name="manage_virtual_addr">True</Option>
|
||||
<Option name="no_iochains_for_any">False</Option>
|
||||
<Option name="no_optimisation">False</Option>
|
||||
<Option name="platform">iptables</Option>
|
||||
<Option name="proxy_arp">False</Option>
|
||||
<Option name="script_env_path">/bin:/usr/bin:/sbin:/usr/sbin</Option>
|
||||
<Option name="snmp_contact"></Option>
|
||||
<Option name="snmp_description"></Option>
|
||||
<Option name="snmp_location"></Option>
|
||||
<Option name="ulog_cprange">0</Option>
|
||||
<Option name="ulog_nlgroup">1</Option>
|
||||
<Option name="ulog_qthreshold">1</Option>
|
||||
<Option name="use_ULOG">False</Option>
|
||||
<Option name="use_ip_tool">False</Option>
|
||||
<Option name="use_numeric_log_levels">False</Option>
|
||||
<Option name="verify_interfaces">False</Option>
|
||||
</FirewallOptions>
|
||||
</Firewall>
|
||||
</ObjectGroup>
|
||||
<IntervalGroup id="id413EEA5B" name="Time">
|
||||
<Interval comment="" from_day="28" from_hour="0" from_minute="0" from_month="2" from_weekday="-1" from_year="2935093" id="id413EEACD" name="Mornings Only" to_day="28" to_hour="11" to_minute="59" to_month="2" to_weekday="-1" to_year="2935093"/>
|
||||
<Interval comment="" from_day="28" from_hour="12" from_minute="0" from_month="2" from_weekday="-1" from_year="2935093" id="id413EEACE" name="Afternoons Only" to_day="28" to_hour="23" to_minute="59" to_month="2" to_weekday="-1" to_year="2935093"/>
|
||||
</IntervalGroup>
|
||||
</Library>
|
||||
<Library id="sysid99" name="Deleted Objects" ro="False">
|
||||
<ObjectRef ref="sysid0"/>
|
||||
<Library color="#FFFFFF" comment="" id="id4145F24F" name="tmp" ro="False">
|
||||
<ObjectGroup id="id4145F250" name="Objects">
|
||||
<ObjectGroup id="id4145F251" name="Addresses"/>
|
||||
<ObjectGroup id="id4145F252" name="Groups"/>
|
||||
<ObjectGroup id="id4145F253" name="Hosts"/>
|
||||
<ObjectGroup id="id4145F254" name="Networks"/>
|
||||
<ObjectGroup id="id4145F255" name="Address Ranges"/>
|
||||
</ObjectGroup>
|
||||
<ServiceGroup id="id4145F256" name="Services">
|
||||
<ServiceGroup id="id4145F257" name="Groups"/>
|
||||
<ServiceGroup id="id4145F258" name="ICMP"/>
|
||||
<ServiceGroup id="id4145F259" name="IP"/>
|
||||
<ServiceGroup id="id4145F25A" name="TCP"/>
|
||||
<ServiceGroup id="id4145F25B" name="UDP"/>
|
||||
<ServiceGroup id="id4145F25C" name="Custom"/>
|
||||
</ServiceGroup>
|
||||
<ObjectGroup id="id4145F25D" name="Firewalls"/>
|
||||
<IntervalGroup id="id4145F25E" name="Time"/>
|
||||
</Library>
|
||||
</Library>
|
||||
<Library color="#d4f8ff" comment="Standard objects" id="syslib000" name="Standard" ro="True">
|
||||
<AnyNetwork comment="Any Network" id="sysid0" name="Any" address="0.0.0.0" netmask="0.0.0.0"/>
|
||||
<AnyIPService comment="Any IP Service" id="sysid1" name="Any" protocol_num="0"/>
|
||||
<AnyInterval comment="Any Interval" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" id="sysid2" name="Any" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
|
||||
<ServiceGroup id="stdid05" name="Services">
|
||||
<ServiceGroup id="stdid09" name="TCP">
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="80" dst_range_start="80" fin_flag="False" fin_flag_mask="False" id="tcp-HTTP" name="http" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
<TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="21" dst_range_start="21" fin_flag="False" fin_flag_mask="False" id="tcp-FTP" name="ftp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="stdid08" name="UDP">
|
||||
<UDPService comment="" dst_range_end="873" dst_range_start="873" id="id4127EA73" name="rsync" src_range_end="0" src_range_start="0"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="stdid07" name="ICMP">
|
||||
<ICMPService code="-1" comment="" id="id3C20EEB5" name="any ICMP" type="-1"/>
|
||||
<ICMPService code="-1" comment="" id="icmp-Unreachables" name="all ICMP unreachables" type="3"/>
|
||||
</ServiceGroup>
|
||||
<ServiceGroup id="stdid06" name="IP">
|
||||
<IPService comment="IPSEC Authentication Header Protocol" fragm="False" id="id3CB12797" lsrr="False" name="AH" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False"/>
|
||||
</ServiceGroup>
|
||||
</ServiceGroup>
|
||||
</Library>
|
||||
</FWObjectDatabase>
|
||||
Executable
+15
@@ -0,0 +1,15 @@
|
||||
#!/usr/bin/perl
|
||||
|
||||
$XMLFILE=@ARGV[0];
|
||||
|
||||
$DIFFCMD="diff -C 1 -c -b -B -I \"# Generated\" -I 'Activating ' -I '# Firewall Builder fwb_ipt v' -I 'Can not find file' ";
|
||||
|
||||
while (<>) {
|
||||
$str=$_;
|
||||
while ( $str=~ /<Firewall / ) {
|
||||
$str=~ /<Firewall [^>]+name="([^"]*).*$"/;
|
||||
$fw=$1;
|
||||
printf "$DIFFCMD %s.fw.orig %s.fw\n",$fw,$fw;
|
||||
$str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//;
|
||||
}
|
||||
}
|
||||
Executable
+8
@@ -0,0 +1,8 @@
|
||||
#!/bin/sh
|
||||
|
||||
for f in *.fw; do
|
||||
j=${f}.orig
|
||||
mv $f $j
|
||||
done
|
||||
|
||||
|
||||
Executable
+16
@@ -0,0 +1,16 @@
|
||||
#!/usr/bin/perl
|
||||
|
||||
$XMLFILE=@ARGV[0];
|
||||
|
||||
|
||||
while (<>) {
|
||||
$str=$_;
|
||||
while ( $str=~ /<Firewall / ) {
|
||||
$str=~ /<Firewall [^>]+name="([^"]*).*$"/;
|
||||
$fw=$1;
|
||||
printf "fwb_ipt -v -f $XMLFILE $fw\n";
|
||||
$str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -0,0 +1,2 @@
|
||||
*.conf
|
||||
*.fw
|
||||
@@ -0,0 +1,14 @@
|
||||
# this is a comment
|
||||
#
|
||||
; this should be a comment too
|
||||
;
|
||||
|
||||
192.168.1.1
|
||||
192.168.1.2/32
|
||||
192.168.1.3/30
|
||||
192.168.2.128/25
|
||||
192.168.1.200/32 # comment again
|
||||
192.168.1.201/32 # this should work, too
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
#
|
||||
# use this table to test run-time AddressTable object
|
||||
# (this is just a small collection of addresses that sent spam to me
|
||||
# on Nov 20 2005)
|
||||
#
|
||||
151.8.224.178
|
||||
168.156.76.20
|
||||
193.207.126.36
|
||||
195.136.186.35
|
||||
196.15.136.15
|
||||
201.10.180.138
|
||||
201.17.93.16
|
||||
201.36.156.121
|
||||
202.103.25.253
|
||||
202.96.112.93
|
||||
203.162.3.209
|
||||
203.209.124.144
|
||||
210.106.193.237
|
||||
210.222.114.102
|
||||
211.144.143.143
|
||||
211.172.218.237
|
||||
211.250.16.132
|
||||
212.100.212.100
|
||||
212.21.241.31
|
||||
218.104.138.146
|
||||
218.18.72.252
|
||||
218.39.114.122
|
||||
218.55.115.43
|
||||
219.132.104.160
|
||||
220.71.17.86
|
||||
220.81.50.105
|
||||
220.91.99.46
|
||||
221.14.249.242
|
||||
221.166.177.135
|
||||
221.198.33.38
|
||||
221.202.160.233
|
||||
221.205.54.125
|
||||
221.217.44.248
|
||||
222.100.212.223
|
||||
222.121.118.144
|
||||
222.174.113.2
|
||||
58.231.13.78
|
||||
58.33.181.83
|
||||
58.53.82.190
|
||||
61.150.47.112
|
||||
61.184.14.102
|
||||
64.106.85.186
|
||||
70.228.60.100
|
||||
80.243.72.149
|
||||
80.249.77.34
|
||||
80.51.236.6
|
||||
81.196.74.125
|
||||
81.2.36.254
|
||||
82.117.221.205
|
||||
82.143.196.17
|
||||
82.77.37.174
|
||||
84.90.8.198
|
||||
Executable
+13
@@ -0,0 +1,13 @@
|
||||
#!/bin/sh
|
||||
|
||||
N=$1
|
||||
|
||||
if which opendiff > /dev/null; then
|
||||
TOOL="opendiff"
|
||||
else
|
||||
TOOL="tkdiff -b -B "
|
||||
fi
|
||||
|
||||
${TOOL} firewall${N}.conf.orig firewall${N}.conf
|
||||
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Executable
+18
@@ -0,0 +1,18 @@
|
||||
#!/usr/bin/perl
|
||||
|
||||
$XMLFILE=@ARGV[0];
|
||||
|
||||
$DIFFCMD="diff -C 1 -b -B -c -I \"# Generated\" -I 'Activating ' -I '# Firewall Builder fwb_pf v'";
|
||||
|
||||
|
||||
while (<>) {
|
||||
$str=$_;
|
||||
while ( $str=~ /<Firewall / ) {
|
||||
$str=~ /<Firewall [^>]+name="([^"]*).*$"/;
|
||||
$fw=$1;
|
||||
printf "$DIFFCMD %s.fw.orig %s.fw\n",$fw,$fw;
|
||||
printf "$DIFFCMD %s.conf.orig %s.conf\n",$fw,$fw;
|
||||
$str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//;
|
||||
}
|
||||
}
|
||||
|
||||
Executable
+13
@@ -0,0 +1,13 @@
|
||||
#!/bin/sh
|
||||
|
||||
for f in *.fw; do
|
||||
j=${f}.orig
|
||||
mv $f $j
|
||||
done
|
||||
|
||||
for f in *.conf; do
|
||||
j=${f}.orig
|
||||
mv $f $j
|
||||
done
|
||||
|
||||
|
||||
Executable
+16
@@ -0,0 +1,16 @@
|
||||
#!/usr/bin/perl
|
||||
|
||||
$XMLFILE=@ARGV[0];
|
||||
|
||||
|
||||
while (<>) {
|
||||
$str=$_;
|
||||
while ( $str=~ /<Firewall / ) {
|
||||
$str=~ /<Firewall [^>]+name="([^"]*).*$"/;
|
||||
$fw=$1;
|
||||
printf "fwb_pf -v -f $XMLFILE $fw\n";
|
||||
$str=~ s/^.*<Firewall [^>]+name="$fw"[^>]+>//;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user