firehol(1)

NAME

firehol - an easy to use but powerful iptables stateful firewall

SYNOPSIS

firehol

sudo -E firehol panic [ IP ]

firehol command [ – conf-arg... ]

firehol CONFIGFILE [start|debug|try] [– conf-arg... ]

DESCRIPTION

Running firehol invokes iptables(8) to manipulate your firewall.

Run without any arguments, firehol will present some help on usage.

When given CONFIGFILE, firehol will use the named file instead of /etc/firehol/firehol.conf as its configuration. If no command is given, firehol assumes try.

It is possible to pass arguments for use by the configuration file separating any conf-arg values from the rest of the arguments with --. The arguments are accessible in the configuration using standard bash(1) syntax e.g. $1, $2, etc.

  PANIC

To block all communication, invoke firehol with the panic command.

FireHOL removes all rules from the running firewall and then DROPs all traffic on all iptables(8) tables (mangle, nat, filter) and pre-defined chains (PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING).

DROPing is not done by changing the default policy to DROP, but by adding one rule per table/chain to drop all traffic. This allows systems which do not reset all the chains to ACCEPT when starting to function correctly.

When activating panic mode, FireHOL checks for the existence of the SSH_CLIENT shell environment variable, which is set by ssh(1). If it finds this, then panic mode will allow the established SSH connection specified in this variable to operate.

    Note

    In order for FireHOL to see the environment variable you must ensure that it is preserved. For sudo(8) use the -E and for su(1) omit the - (minus sign).

If SSH_CLIENT is not set, the IP after the panic argument allows you to give an IP address for which all established connections between the IP address and the host in panic will be allowed to continue.

COMMANDS

start; restart
    Activates the firewall using /etc/firehol/firehol.conf.

    Use of the term restart is allowed for compatibility with common init implementations.

try Activates the firewall, waiting for the user to type the word commit. If this word is not typed within 30 seconds, the previous firewall is restored.

stop
    Stops a running iptables(8) firewall by clearing all of the tables and chains and setting the default policies to ACCEPT. This will allow all traffic to pass unchecked.

condrestart
    Restarts the FireHOL firewall only if it is already active. This is the generally expected behaviour (but opposite to FireHOL prior to 2.0.0-pre4).

status
    Shows the running firewall, using /sbin/iptables -nxvL | less.

save
    Start the firewall and then save it using iptables-save(8) to the location given by FIREHOL_AUTOSAVE. See firehol-defaults.conf(5) for more information.

    The required kernel modules are saved to an executable shell script /var/spool/firehol/last_save_modules.sh, which can be called during boot if a firewall is to be restored.

        Note

        External changes may cause a firewall restored after a reboot to not work as intended where starting the firewall with FireHOL will work.

        This is because as part of starting a firewall, FireHOL checks some changeable values. For instance the current kernel configuration is checked (for client port ranges), and RPC servers are queried (to allow correct functioning of the NFS service).

debug
    Parses the configuration file but instead of activating it, FireHOL shows the generated iptables(8) statements.

explain
    Enters an interactive mode where FireHOL accepts normal configuration commands and presents the generated iptables(8) commands for each of them, together with some reasoning for its purpose.

    Additionally, FireHOL automatically generates a configuration script based on the successful commands given.

    Some extra commands are available in explain mode.

    help
        Present some help

    show
        Present the generated configuration

    quit
        Exit interactive mode and quit

helpme; wizard
    Tries to guess the FireHOL configuration needed for the current machine.

    FireHOL will not stop or alter the running firewall. The configuration file is given in the standard output of firehol, thus firehol helpme > /tmp/firehol.conf will produce the output in /tmp/firehol.conf.

    The generated FireHOL configuration must be edited before use on your systems. You are required to take a number of decisions; the comments in the generated file will instruct you in the choices you must make.

FILES

/etc/firehol/firehol.conf

SEE ALSO

•   firehol.conf(5) - FireHOL configuration

•   firehol-defaults.conf(5) - control variables

•   FireHOL Website (http://firehol.org/)

•   FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•   FireHOL Online Documentation (http://firehol.org/documentation/) og “TRAP AND REJECT - NEW SUSPECT”
ipset sockets src,dst,dst no-counters packets 1
next iptrap trap src 86400
state NEW log “TRAP AND REJECT - BANNED”
ipset suspects src no-counters packets-above 2
next action REJECT

interface any world policy TRAP_AND_REJECT protection bad-packets ...

router wan2lan inface “${wan}" outface "${lan}” policy TRAP_AND_REJECT protection bad-packets ... ~~~~

Since we used the action TRAP_AND_REJECT as an interface policy, it will get all the traffic not accepted, rejected, or dropped by the server and client statements.

For all these packets, the action TRAP_AND_REJECT will first check that they are coming in from wan0, that their src IP is not in UNROUTABLE_IPS list and in the whitelist ipset, that they are NEW connections, and if all these conditions are met, it will log with the tag POLICY TRAP and add the src IP of the packets in the policytrap ipset for 30 seconds.

All traffic not matched by the above, will be just rejected.

  sockets_suspects_trap type actions

The type sockets_suspects_trap will automatically a custom trap using the following template:

    action4 *name* sockets_suspects_trap *SUSPECTS_TIMEOUT* *TRAP_TIMEOUT* *VALID_CONNECTIONS* [*optional params*] next ...

This will:

1.  Create the ipset ${name}_sockets where the matched sockets will be stored for SUSPECTS_TIMEOUT seconds.

2.  Create the ipset ${name}_suspects where the source IPs of the matched sockets will be stored for SUSPECTS_TIMEOUT seconds.

3.  Create the ipset ${name}_trap where the trapped IPs will be stored for TRAP_TIMEOUT seconds. IPs will be added to this ipset only if more than VALID_CONNECTIONS have been matched by this IP.

optional params are FireHOL optional rule parameters (firehol-params(5)) that can be used to limit the match for the first ipset (sockets).

So, to design the same TRAP_AND_REJECT as above, this statement is needed:

    action4 TRAP_AND_REJECT \
        sockets_suspects_trap 3600 86400 2 \
            inface "${wan}" \
            src not "${UNROUTABLE_IPS} ipset:whitelist" \
        next action REJECT

The ipsets that will be created will be named: TRAP_AND_REJECT_sockets, TRAP_AND_REJECT_suspects and TRAP_AND_REJECT_trap.

    Note Always terminate sockets_suspects_trap with a next action DROP or next action REJECT, or the traffic will continue to flow.

SEE ALSO

•   firehol(1) - FireHOL program

•   firehol.conf(5) - FireHOL configuration

•   firehol-actions(5) - optional rule parameters

•   iptables(8) (http://ipset.netfilter.org/iptables.man.html) - administration tool for IPv4 firewalls

•   ip6tables(8) (http://ipset.netfilter.org/ip6tables.man.html) - administration tool for IPv6 firewalls

•   FireHOL Website (http://firehol.org/)

•   FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)

•   FireHOL Online Documentation (http://firehol.org/documentation/)

AUTHORS
FireHOL Team; Original man page by Marc Brockschmidt.