mirror of
https://github.com/fwbuilder/fwbuilder
synced 2026-03-19 09:47:20 +01:00
198 lines
9.7 KiB
Plaintext
Executable File
198 lines
9.7 KiB
Plaintext
Executable File
# Policy compiler errors and warnings:
|
|
# firewall1:Policy:9: warning: Changing rule direction due to self reference
|
|
# firewall1:Policy:9: warning: Changing rule direction due to self reference
|
|
# firewall1:Policy:10: warning: Changing rule direction due to self reference
|
|
# firewall1:Policy:12: warning: Changing rule direction due to self reference
|
|
#
|
|
# Rule 0 (eth0)
|
|
skip 11 in on eth0 proto icmp from 22.22.22.22 to 22.22.22.22
|
|
skip 10 in on eth0 proto icmp from 22.22.22.22 to 192.168.1.1
|
|
skip 9 in on eth0 proto icmp from 192.168.1.1 to 22.22.22.22
|
|
skip 8 in on eth0 proto icmp from 192.168.1.1 to 192.168.1.1
|
|
skip 7 in on eth0 proto 50 from 22.22.22.22 to 22.22.22.22
|
|
skip 6 in on eth0 proto 50 from 22.22.22.22 to 192.168.1.1
|
|
skip 5 in on eth0 proto 50 from 192.168.1.1 to 22.22.22.22
|
|
skip 4 in on eth0 proto 50 from 192.168.1.1 to 192.168.1.1
|
|
skip 11 out on eth0 proto icmp from 22.22.22.22 to 22.22.22.22
|
|
skip 10 out on eth0 proto icmp from 22.22.22.22 to 192.168.1.1
|
|
skip 9 out on eth0 proto icmp from 192.168.1.1 to 22.22.22.22
|
|
skip 8 out on eth0 proto icmp from 192.168.1.1 to 192.168.1.1
|
|
skip 7 out on eth0 proto 50 from 22.22.22.22 to 22.22.22.22
|
|
skip 6 out on eth0 proto 50 from 22.22.22.22 to 192.168.1.1
|
|
skip 5 out on eth0 proto 50 from 192.168.1.1 to 22.22.22.22
|
|
skip 4 out on eth0 proto 50 from 192.168.1.1 to 192.168.1.1
|
|
block in log quick on eth0 proto icmp from 22.22.22.22 to any
|
|
block in log quick on eth0 proto icmp from 192.168.1.1 to any
|
|
block in log quick on eth0 proto 50 from 22.22.22.22 to any
|
|
block in log quick on eth0 proto 50 from 192.168.1.1 to any
|
|
block out log quick on eth0 proto icmp from 22.22.22.22 to any
|
|
block out log quick on eth0 proto icmp from 192.168.1.1 to any
|
|
block out log quick on eth0 proto 50 from 22.22.22.22 to any
|
|
block out log quick on eth0 proto 50 from 192.168.1.1 to any
|
|
#
|
|
# Rule 1 (eth0)
|
|
skip 11 in on eth0 proto icmp from 192.168.1.10 to 192.168.1.10
|
|
skip 10 in on eth0 proto icmp from 192.168.1.10 to 192.168.1.20
|
|
skip 9 in on eth0 proto icmp from 192.168.1.20 to 192.168.1.10
|
|
skip 8 in on eth0 proto icmp from 192.168.1.20 to 192.168.1.20
|
|
skip 7 in on eth0 proto 50 from 192.168.1.10 to 192.168.1.10
|
|
skip 6 in on eth0 proto 50 from 192.168.1.10 to 192.168.1.20
|
|
skip 5 in on eth0 proto 50 from 192.168.1.20 to 192.168.1.10
|
|
skip 4 in on eth0 proto 50 from 192.168.1.20 to 192.168.1.20
|
|
skip 11 out on eth0 proto icmp from 192.168.1.10 to 192.168.1.10
|
|
skip 10 out on eth0 proto icmp from 192.168.1.10 to 192.168.1.20
|
|
skip 9 out on eth0 proto icmp from 192.168.1.20 to 192.168.1.10
|
|
skip 8 out on eth0 proto icmp from 192.168.1.20 to 192.168.1.20
|
|
skip 7 out on eth0 proto 50 from 192.168.1.10 to 192.168.1.10
|
|
skip 6 out on eth0 proto 50 from 192.168.1.10 to 192.168.1.20
|
|
skip 5 out on eth0 proto 50 from 192.168.1.20 to 192.168.1.10
|
|
skip 4 out on eth0 proto 50 from 192.168.1.20 to 192.168.1.20
|
|
block in quick on eth0 proto icmp from 192.168.1.10 to any
|
|
block in quick on eth0 proto icmp from 192.168.1.20 to any
|
|
block in quick on eth0 proto 50 from 192.168.1.10 to any
|
|
block in quick on eth0 proto 50 from 192.168.1.20 to any
|
|
block out quick on eth0 proto icmp from 192.168.1.10 to any
|
|
block out quick on eth0 proto icmp from 192.168.1.20 to any
|
|
block out quick on eth0 proto 50 from 192.168.1.10 to any
|
|
block out quick on eth0 proto 50 from 192.168.1.20 to any
|
|
#
|
|
# Rule 2 (eth1)
|
|
# Anti-spoofing rule
|
|
block in log quick on eth1 from 22.22.22.22 to any
|
|
block in log quick on eth1 from 22.22.23.23 to any
|
|
block in log quick on eth1 from 192.168.1.1 to any
|
|
block in log quick on eth1 from 192.168.2.1 to any
|
|
block in log quick on eth1 from 192.168.1.0/24 to any
|
|
#
|
|
# Rule 3 (eth1)
|
|
# Anti-spoofing rule
|
|
skip 1 out on eth1 from 192.168.1.0/24 to any
|
|
block out log quick on eth1 from any to any
|
|
#
|
|
# Rule 4 (lo)
|
|
pass in quick on lo proto icmp from any to any keep state
|
|
pass in quick on lo proto tcp from any to any keep state
|
|
pass in quick on lo proto udp from any to any keep state
|
|
pass in quick on lo from any to any
|
|
pass out quick on lo proto icmp from any to any keep state
|
|
pass out quick on lo proto tcp from any to any keep state
|
|
pass out quick on lo proto udp from any to any keep state
|
|
pass out quick on lo from any to any
|
|
#
|
|
# Rule 5 (global)
|
|
block in log quick proto tcp from any to any flags S/UAPRSF
|
|
block out log quick proto tcp from any to any flags S/UAPRSF
|
|
#
|
|
# Rule 7 (global)
|
|
# hostF has the same IP address as firewal.
|
|
pass in log quick proto icmp from any to 192.168.1.1 icmp-type 8 code 0 keep state
|
|
pass out log quick proto icmp from any to 192.168.1.1 icmp-type 8 code 0 keep state
|
|
#
|
|
# Rule 8 (global)
|
|
# testing negation in the policy rule
|
|
skip 2 in proto icmp from 192.168.1.10 to any icmp-type 3
|
|
skip 1 in proto icmp from 192.168.1.20 to any icmp-type 3
|
|
skip 2 out proto icmp from 192.168.1.10 to any icmp-type 3
|
|
skip 1 out proto icmp from 192.168.1.20 to any icmp-type 3
|
|
block in log quick proto icmp from any to any icmp-type 3
|
|
block out log quick proto icmp from any to any icmp-type 3
|
|
#
|
|
# Rule 9 (global)
|
|
# firewall1:Policy:9: warning: Changing rule direction due to self reference
|
|
|
|
skip 11 in proto icmp from 192.168.1.10 to 22.22.22.22 icmp-type 3
|
|
skip 10 in proto icmp from 192.168.1.10 to 22.22.23.23 icmp-type 3
|
|
skip 9 in proto icmp from 192.168.1.10 to 192.168.1.1 icmp-type 3
|
|
skip 8 in proto icmp from 192.168.1.10 to 192.168.2.1 icmp-type 3
|
|
skip 7 in proto icmp from 192.168.1.20 to 22.22.22.22 icmp-type 3
|
|
skip 6 in proto icmp from 192.168.1.20 to 22.22.23.23 icmp-type 3
|
|
skip 5 in proto icmp from 192.168.1.20 to 192.168.1.1 icmp-type 3
|
|
skip 4 in proto icmp from 192.168.1.20 to 192.168.2.1 icmp-type 3
|
|
block in log quick proto icmp from any to 22.22.22.22 icmp-type 3
|
|
block in log quick proto icmp from any to 22.22.23.23 icmp-type 3
|
|
block in log quick proto icmp from any to 192.168.1.1 icmp-type 3
|
|
block in log quick proto icmp from any to 192.168.2.1 icmp-type 3
|
|
#
|
|
# Rule 10 (global)
|
|
# firewall1:Policy:10: warning: Changing rule direction due to self reference
|
|
|
|
skip 5 out from 22.22.22.22 to 192.168.1.0/24
|
|
skip 4 out from 22.22.23.23 to 192.168.1.0/24
|
|
skip 3 out from 192.168.1.1 to 192.168.1.0/24
|
|
skip 2 out from 192.168.2.1 to 192.168.1.0/24
|
|
skip 1 in from 192.168.2.0/24 to 192.168.1.0/24
|
|
skip 1 out from 192.168.2.0/24 to 192.168.1.0/24
|
|
block in log quick from any to 192.168.1.0/24
|
|
block out log quick from any to 192.168.1.0/24
|
|
#
|
|
# Rule 11 (global)
|
|
skip 5 in from 192.168.1.0/24 to 192.168.1.10
|
|
skip 4 in from 192.168.1.0/24 to 192.168.1.20
|
|
skip 3 in from 192.168.2.0/24 to 192.168.1.10
|
|
skip 2 in from 192.168.2.0/24 to 192.168.1.20
|
|
skip 5 out from 192.168.1.0/24 to 192.168.1.10
|
|
skip 4 out from 192.168.1.0/24 to 192.168.1.20
|
|
skip 3 out from 192.168.2.0/24 to 192.168.1.10
|
|
skip 2 out from 192.168.2.0/24 to 192.168.1.20
|
|
block in log quick from 192.168.1.0/24 to any
|
|
block in log quick from 192.168.2.0/24 to any
|
|
block out log quick from 192.168.1.0/24 to any
|
|
block out log quick from 192.168.2.0/24 to any
|
|
#
|
|
# Rule 12 (global)
|
|
# firewall1:Policy:12: warning: Changing rule direction due to self reference
|
|
|
|
skip 4 in from any to 22.22.22.22
|
|
skip 3 in from any to 22.22.23.23
|
|
skip 2 in from any to 192.168.1.1
|
|
skip 1 in from any to 192.168.2.1
|
|
block in quick from any to any
|
|
block out quick from any to any
|
|
#
|
|
# Rule 15 (global)
|
|
skip 11 in proto icmp from 22.22.22.22 to 22.22.22.22
|
|
skip 10 in proto icmp from 22.22.22.22 to 192.168.1.1
|
|
skip 9 in proto icmp from 192.168.1.1 to 22.22.22.22
|
|
skip 8 in proto icmp from 192.168.1.1 to 192.168.1.1
|
|
skip 7 in proto 50 from 22.22.22.22 to 22.22.22.22
|
|
skip 6 in proto 50 from 22.22.22.22 to 192.168.1.1
|
|
skip 5 in proto 50 from 192.168.1.1 to 22.22.22.22
|
|
skip 4 in proto 50 from 192.168.1.1 to 192.168.1.1
|
|
skip 11 out proto icmp from 22.22.22.22 to 22.22.22.22
|
|
skip 10 out proto icmp from 22.22.22.22 to 192.168.1.1
|
|
skip 9 out proto icmp from 192.168.1.1 to 22.22.22.22
|
|
skip 8 out proto icmp from 192.168.1.1 to 192.168.1.1
|
|
skip 7 out proto 50 from 22.22.22.22 to 22.22.22.22
|
|
skip 6 out proto 50 from 22.22.22.22 to 192.168.1.1
|
|
skip 5 out proto 50 from 192.168.1.1 to 22.22.22.22
|
|
skip 4 out proto 50 from 192.168.1.1 to 192.168.1.1
|
|
block in log quick proto icmp from 22.22.22.22 to any
|
|
block in log quick proto icmp from 192.168.1.1 to any
|
|
block in log quick proto 50 from 22.22.22.22 to any
|
|
block in log quick proto 50 from 192.168.1.1 to any
|
|
block out log quick proto icmp from 22.22.22.22 to any
|
|
block out log quick proto icmp from 192.168.1.1 to any
|
|
block out log quick proto 50 from 22.22.22.22 to any
|
|
block out log quick proto 50 from 192.168.1.1 to any
|
|
#
|
|
# Rule 16 (global)
|
|
# 'masquerading' rule
|
|
pass in quick proto icmp from 192.168.1.0/24 to any keep state
|
|
pass in quick proto tcp from 192.168.1.0/24 to any keep state
|
|
pass in quick proto udp from 192.168.1.0/24 to any keep state
|
|
pass in quick from 192.168.1.0/24 to any
|
|
pass out quick proto icmp from 192.168.1.0/24 to any keep state
|
|
pass out quick proto tcp from 192.168.1.0/24 to any keep state
|
|
pass out quick proto udp from 192.168.1.0/24 to any keep state
|
|
pass out quick from 192.168.1.0/24 to any
|
|
#
|
|
# Rule 17 (global)
|
|
# 'catch all' rule
|
|
block in log quick from any to any
|
|
block out log quick from any to any
|
|
#
|
|
# Rule fallback rule
|
|
# fallback rule
|
|
block in quick from any to any
|
|
block out quick from any to any
|