-
Notifications
You must be signed in to change notification settings - Fork 4
/
uif.conf.5
239 lines (235 loc) · 8.92 KB
/
uif.conf.5
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
.TH uif.conf 5 "Apr 19th, 2022" "Version 1.99.0" "Configuration File for UIF"
.SH NAME
uif.conf \- default configuration file for the Universal Internet Firewall
.SH DESCRIPTION
\fI/etc/uif/uif.conf\fR
is the default configuration file for
.BR uif (8).
This file may contain several sections and comments. Each
section begins with the section name and the left curly brace and ends with
the right curly brace in a single line. A comment starts with a hash mark (#)
at the beginning of a line. Blank lines are silently ignored.
.PP
The following sections are valid: \fIinclude\fR, \fIinclude4\fR, \fIinclude6\fR,
\fIsysconfig\fR, \fIservice\fR, \fInetwork\fR, \fIinterface\fR, \Imarker\fR, \fIfilter\fR,
\fInat\fR, \fIinput\fR, \fIoutput\fR, \fIforward\fR, \fImasquerade\fR and \fIstateless\fR.
.PP
The sections
\fIservice\fR, \fInetwork\fR, \fImarker\fR and \fIinterface\fR
have all a very similar syntax.
Each line starts with an identifier followed by one or more blanks and one
or more section specific entries or defined identifiers separated by blanks.
A valid identifier is case sensitive and consists of letters, digits,
underscores and hyphens.
.PP
If two or more identifiers in one section are equal, the corresponding
entries are merged to the first identifier. Hence, it's not possible to
overwrite previously defined identifiers. As a result the order of the
section entries is irrelevant and it's possible to define a section more
than once.
.SS include section
Include other configuration files. Each line in this section, enclosed in
quotation marks ("), must be a valid filename or a valid file globbing
pattern (it is ok, if no files match this pattern). The contents of this
file / these files are added to the actual configuration and each file
should contain at least one section (a comment only file is not really
useful...).
.SS include4 section
Include other configuration files but ONLY in IPv4 mode (WITHOUT \-6 switch to uif).
Otherwise equivalent to the include section above.
.SS include6 section
Include other configuration files but ONLY in IPv6 mode (WITH \-6 switch to uif).
Otherwise equivalent to the include section above.
.SS sysconfig section
Set some global settings. Each line in this section starts with one of the
following identifiers followed by one or more blanks and the desired value:
\fILogLevel\fR, \fILogPrefix\fR, \fILogLimit\fR, \fILogBurst\fR, \fILimit\fR, \fIBurst\fR
or \fIAccountPrefix\fR.
If there are multiple definitions of one entry the last definition is stored.
.TP
\fILogLevel\fR
A valid default log priority (see
.BR syslog.conf (5)).
.TP
\fILogPrefix\fR
The default log prefix. Each netfilter (or iptables) log message starts with this prefix.
.TP
\fILogLimit\fR
The default limit value for log messages (see
.BR nft (8)
or
.BR iptables (8)).
.TP
\fILogBurst\fR
The default burst value for log messages (see
.BR nft (8)
or
.BR iptables (8)).
.TP
\fILimit\fR
The default limit value (see
.BR nft (8)
or
.BR iptables (8)).
.TP
\fIBurst\fR
The default burst value (see
.BR nft (8)
or
.BR iptables (8)).
.TP
\fIAccountPrefix\fR
The default prefix for accounting chains.
.PP
.SS service section
This section defines all needed services. A service
description starts with the
protocol (see
.BR protocols (5))
followed by parameters in parenthesis. Most
protocols don't need any parameters. The only exceptions are tcp, udp and
icmp. The tcp and udp parameters define the source and destionation
port(\-range). The source and destination ports are separated by a slash (/)
and port ranges are separated by a colon (eg. tcp(123:333/99): tcp protocol,
source port range 123\-333, destination port 99). Empty source or destination
ports are expanded to 1:65535. The icmp protocol parameter must be a valid
icmp type (see iptables \-p icmp \-\-help).
.SS network section
This section defines all needed networks and hosts. A network description
starts with a valid IPv4 address (dotted quad), a valid IPv6 address
(colon syntax, square brackets not needed), an optional netmask in cidr
notation (number of bits) or an optional MAC\-address (with a prefixed
equal sign (=). Some valid entries are: 127.0.0.1, 127.0.0.0/8, ::1, fd00:1:2:3::/64,
and 192.168.0.1=00:00:00:00:00:FF.
.SS interface section
This section defines all needed (physical and bridged) interfaces (eg. eth0, lo, ppp0).
.SS marker section
This section defines all needed numerical (decimal) values for packet
marking purposes.
.SS filter, nat, input, output, forward, masquerade and stateless sections
Due to better partitioning of the packetfilter, rules can be split into
these sections. Internally they are equivalent and contain all
rules. As an exception to all other sections the order of entries in
these sections is important.
.PP
The default policy for the chains INPUT, OUTPUT and FORWARD is DROP (see
.BR nft (8)
or
.BR iptables (8))
and it's not possible to change this.
.PP
Each line in in this section begins with
\fIin\fR, \fIout\fR, \fIfw\fR, \fInat\fR, \fImasq\fR, \fIslin\fR, \fIslout\fR
or \fI slfw\fR,
followed by '+', '\-' or a mark identifier enclosed in curly braces (or, in
case of fw followed by '>'). The identifiers
\fIin\fR, \fIout\fR and \fIfw\fR
define rules for incoming, outgoing and forwarded
IP\-packets. Each packet with an INVALID state (see
.BR nft (8)
or
.BR iptables (8))
is matched by
\fIslin\fR, \fIslout\fR and \fIslfw\fR.
The lines starting with
\fInat\fR and \fImasq\fR
define rules to modify the source
or destination address or the destination port.
.PP
\fBNote:\fR The identifiers nat and masq are non-operational in IPv6
mode. They simply get ignored as NAT and Masquerading are not supported by
the IPv6 protocol.
.PP
The plus and minus signs specify the type of the rule: '+' accepts matching
packets and '\-' drops them. As a special case the identifier out and fw
accept the greater than (>) sign to modify the MSS depending on the PMTU
(see
.BR iptables (8)).
.PP
A very basic ruleset may look like this:
.I out+
.PP
This allows every outgoing traffic and rejects all incoming connections
(because of the default policy).
.PP
To be more specific, each line may contain several parameters. Each
parameter starts with a single character followed by an equal sign (=) and
one or more previously defined identifiers (in the corresponding sections)
separated by commas. The following parameters are valid:
.TP
\fIs\fR
The source address or network. Append "(4)" or "(6)" to the network name to make this rule apply to IPv4 or IPv6 only.
.TP
\fId\fR
The destination address or network. Append "(4)" or "(6)" to the network name to make this rule apply to IPv4 or IPv6 only.
.TP
\fIi\fR
The input interface.
.TP
\fIo\fR
The output interface.
.TP
\fIpi\fR
The physical input interface (only useful when used with bridged interfaces, not supported with nft as deprecated there).
.TP
\fIpo\fR
The physical output interface (only useful when used with bridged interfaces, not supported with nft as deprecated there).
.TP
\fIp\fR
The service description (protocol).
.TP
\fIm\fR
The mark field associated with a packet.
.TP
\fIS\fR
The the new source address in nat rules. Supported in IPv4 mode only. Ignored in IPv6 mode.
.TP
\fID\fR
The the new destination address in nat rules. Supported in IPv4 mode only. Ignored in IPv6 mode.
.TP
\fIP\fR
The the new service description in nat rules. This is only valid with tcp or
udp packets.
.TP
\fIf\fR
This parameter sets some 'flags'. A flag definition starts with the flag
identifier and optional parameters in parenthesis. Valid flags are:
.PP
.I log
\- Logs matching packages to syslog. The given parameter is included in the log
entry. The number of logged packets and the loglevel can be set in the
sysconfig section.
.PP
.I reject
\- Only valid in DROP rules. This is used to send back an error packet in
response to the matched packet. The default behaviour is a packet with set
RST flag on tcp connections and a destination\-unreachable icmp packet in
every other case. Valid parameters are listed in
.BR iptables(8)
in the REJECT section.
.PP
.I account
\- Create an accounting chain for all matching packages and possible responses.
The optional parameter is a part of the name of the chain.
.PP
.I limit
\- Limits the number of matching packets. The default values are set in the
sysconfig section. Other values can be defined with the optional parameter.
The first entry sets a new limit and the second parameter (separated by a
comma (,)) sets the burst value (see Limit and Burst in sysconfig section).
.PP
It's possible to invert the identifier of one of following parameters \- if it
expands to ecactly one object \- by prepending a exclamation mark (!):
\fIs\fR, \fId\fR, \fIi\fR, \fIo\fR, \fIp\fR
(eg.: s=!local p=!http).
.SH FILES
Configuration files are located in /etc/uif. There is a sample configuration
in /usr/share/doc/uif/uif.conf.tmpl.gz.
.SH SEE ALSO
nft(8)
iptables(8)
uif(8)
.SH AUTHOR
This manual page was written by Jörg Platte <[email protected]> and
Cajus Pollmeier <[email protected]>, and has been adjusted for nft
support by Mike Gabriel <[email protected]>.