| firehol-services(5) | 3.1.7 | firehol-services(5) |
firehol-services - FireHOL services list
AH all amanda any anystateless apcupsd apcupsdnis aptproxy asterisk
cups custom cvspserver
darkstat daytime dcc dcpp dhcp dhcprelay dhcpv6 dict distcc dns
echo emule eserver ESP
finger ftp
gift giftui gkrellmd GRE
h323 heartbeat http httpalt https hylafax
iax iax2 ICMP icmp ICMPV6 icmpv6 icp ident imap imaps ipsecnatt ipv6error ipv6mld ipv6neigh ipv6router irc isakmp
jabber jabberd
l2tp ldap ldaps lpd
microsoft_ds mms msn msnp ms_ds multicast mysql
netbackup netbios_dgm netbios_ns netbios_ssn nfs nis nntp nntps nrpe ntp nut nxserver
openvpn oracle OSPF
ping pop3 pop3s portmap postgres pptp privoxy
radius radiusold radiusoldproxy radiusproxy rdp rndc rsync rtp
samba sane sip smtp smtps snmp snmptrap socks squid ssh stun submission sunrpc swat syslog
telnet tftp time timestamp tomcat
upnp uucp
vmware vmwareauth vmwareweb vnc
webcache webmin whois
xbox xdmcp
server AH accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
For more information see this Archive of the FreeS/WAN documentation (http://web.archive.org/web/20100918134143/http://www.freeswan.org/freeswan_trees/freeswan-1.99/doc/ipsec.html#AH.ipsec) and RFC 2402 (http://www.ietf.org/rfc/rfc2402.txt). [WIKI-AH]: http://en.wikipedia.org/wiki/IPsec#Authentication_Header
server all accept
Service Type:
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Notes
Matches all traffic (all protocols, ports, etc.). Note that to provide “connections in one direction with replies” semantics, the kernel connection tracker is still used: this will therefore still not match packets if they are not understood as part of a connection (e.g. some ICMPv6 packets, requests and replies taking different routes, complex protocols with no helper loaded).
This service may indirectly setup a set of other services, if they require kernel modules to be loaded. The following complex services are activated:
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Links
server any *myname* accept proto 47
Service Type:
Server Ports:
Client Ports:
Notes
Matches all traffic (all protocols, ports, etc), but does not care about kernel modules and does not activate any other service indirectly. In combination with the firehol-params(5) this service can match unusual traffic (e.g. GRE - protocol 47).
Note that you have to supply your own name in addition to “any”.
server anystateless *myname* accept proto 47
Service Type:
Server Ports:
Client Ports:
Notes
Matches all traffic (all protocols, ports, etc), but does not care about kernel modules and does not activate any other service indirectly. In combination with the firehol-params(5) this service can match unusual traffic (e.g. GRE - protocol 47).
This service is identical to “any” but does not care about the state of traffic.
Note that you have to supply your own name in addition to “anystateless”.
server apcupsd accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This service must be defined as “server apcupsd accept” on all machines not directly connected to the UPS (i.e. slaves).
Note that the port defined here is not the default port (6666) used if you download and compile APCUPSD, since the default conflicts with IRC and many distributions (like Debian) have changed this to 6544.
You can define port 6544 in APCUPSD, by changing the value of NETPORT in its configuration file, or overwrite this FireHOL service definition using the procedures described in Adding Services in firehol.conf(5). [HOME-apcupsd]: http://www.apcupsd.com [WIKI-apcupsd]: http://en.wikipedia.org/wiki/Apcupsd
server apcupsdnis accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This service allows the remote WEB interfaces of APCUPSD (http://www.apcupsd.com/), to connect and get information from the server directly connected to the UPS device. [HOME-apcupsdnis]: http://www.apcupsd.com [WIKI-apcupsdnis]: http://en.wikipedia.org/wiki/Apcupsd
server aptproxy accept
Service Type:
Server Ports:
Client Ports:
Links
server asterisk accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This service refers only to the manager interface of asterisk. You should normally enable sip, h323, rtp, etc. at the firewall level, if you enable the relative channel drivers of asterisk. [HOME-asterisk]: http://www.asterisk.org [WIKI-asterisk]: http://en.wikipedia.org/wiki/Asterisk_PBX
server cups accept
Service Type:
Server Ports:
Client Ports:
Links
server custom myimap tcp/143 default accept
Service Type:
Server Ports:
Client Ports:
Notes
The full syntax is:
subcommand custom name svr-proto/ports cli-ports action params
This service is used by FireHOL to allow you create rules for services which do not have a definition.
subcommand, action and params have their usual meanings.
A name must be supplied along with server ports in the form proto/range and client ports which takes only a range.
To define services with the built-in extension mechanism to avoid the need for custom services, see Adding Services in firehol.conf(5).
server cvspserver accept
Service Type:
Server Ports:
Client Ports:
Links
server darkstat accept
Service Type:
Server Ports:
Client Ports:
Links
server daytime accept
Service Type:
Server Ports:
Client Ports:
Links
server dcc accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
See also this DCC FAQ (http://www.rhyolite.com/dcc/FAQ.html#firewall-ports). [WIKI-dcc]: http://en.wikipedia.org/wiki/Distributed_Checksum_Clearinghouse
server dcpp accept
Service Type:
Server Ports:
Client Ports:
Links
server dhcp accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
The dhcp service is implemented as stateless rules.
DHCP clients broadcast to the network (src 0.0.0.0 dst 255.255.255.255) to find a DHCP server. If the DHCP service was stateful the iptables connection tracker would not match the packets and deny to send the reply.
Note that this change does not affect the security of either DHCP servers or clients, since only the specific ports are allowed (there is no random port at either the server or the client side).
Note also that the “server dhcp accept” or “client dhcp accept” commands should placed within interfaces that do not have src and / or dst defined (because of the initial broadcast).
You can overcome this problem by placing the DHCP service on a separate interface, without a src or dst but with a policy return. Place this interface before the one that defines the rest of the services.
For example:
interface eth0 dhcp
policy return
server dhcp accept
interface eth0 lan src "$mylan" dst "$myip"
client all accept
For example: interface eth0 dhcp policy return server dhcp accept interface eth0 lan src “$mylan" dst "$myip” client all accept
This service implicitly sets its client or server to ipv4 mode. [WIKI-dhcp]: http://en.wikipedia.org/wiki/Dhcp
server dhcprelay accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
From RFC 1812 section 9.1.2:
In many cases, BOOTP clients and their associated BOOTP server(s) do not reside on the same IP (sub)network. In such cases, a third-party agent is required to transfer BOOTP messages between clients and servers. Such an agent was originally referred to as a BOOTP forwarding agent. However, to avoid confusion with the IP forwarding function of a router, the name BOOTP relay agent has been adopted instead.
For more information about DHCP Relay see section 9.1.2 of RFC 1812 (http://www.ietf.org/rfc/rfc1812.txt) and section 4 of RFC 1542 (http://www.ietf.org/rfc/rfc1542.txt) [WIKI-dhcprelay]: http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#DHCP_relaying
server dhcpv6 accept
client dhcpv6 accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
The dhcp service is implemented as stateless rules. It cannot be stateful as the connection tracker will not match a unicast reply to a broadcast request. Further, if you wish to add src/dst rule parameters, you must account for both the broadcast and link-local network prefixes.
Clients broadcast from a link-local address to the multicast address ff02::1:2 on UDP port 547 to find a server. The server sends a unicast reply back to the client which listens on UDP port 546.
For a FireHOL interface, creating a client will allow sending to port 547 and receiving on port 546. Creating a server allows sending to port 546 and receiving on port 547.
Unlike DHCP for IPv4, the source ports to be used are not defined in DHCPv6 - see section 5.2 of RFC3315 (http://www.ietf.org/rfc/rfc3315.txt). Some servers are known to make use of this to send from arbitrary ports, so FireHOL does not assume a source port.
This service implicitly sets its client or server to ipv6 mode. [WIKI-dhcpv6]: https://en.wikipedia.org/wiki/DHCPv6
server dict accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
See RFC2229 (http://www.ietf.org/rfc/rfc2229.txt). [WIKI-dict]: http://en.wikipedia.org/wiki/DICT
server distcc accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
For distcc security, please check the distcc security design (http://distcc.googlecode.com/svn/trunk/doc/web/security.html). [HOME-distcc]: https://code.google.com/p/distcc/ [WIKI-distcc]: http://en.wikipedia.org/wiki/Distcc
server dns accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
On very busy DNS servers you may see a few dropped DNS packets in your logs. This is normal. The iptables connection tracker will timeout the session and lose unmatched DNS packets that arrive too late to be useful. [WIKI-dns]: http://en.wikipedia.org/wiki/Domain_Name_System
server echo accept
Service Type:
Server Ports:
Client Ports:
Links
client emule accept src 192.0.2.1
Service Type:
Server Ports:
Client Ports:
Links
Notes
According to eMule Port Definitions (http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show_topic&topic_id=122), FireHOL defines:
Use the FireHOL firehol-client(5) command to match the eMule client.
Please note that the eMule client is an HTTP client also. [HOME-emule]: http://www.emule-project.com
server eserver accept
Service Type:
Server Ports:
Client Ports:
Links
server ESP accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
For more information see this Archive of the FreeS/WAN documentation (http://web.archive.org/web/20100918134143/http://www.freeswan.org/freeswan_trees/freeswan-1.99/doc/ipsec.html#ESP.ipsec) RFC 2406 (http://www.ietf.org/rfc/rfc2406.txt). [WIKI-ESP]: http://en.wikipedia.org/wiki/IPsec#Encapsulating_Security_Payload
server finger accept
Service Type:
Server Ports:
Client Ports:
Links
server ftp accept
Service Type:
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Links
Notes
The FTP service matches both active and passive FTP connections. [WIKI-ftp]: http://en.wikipedia.org/wiki/Ftp
server gift accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
The gift FireHOL service supports:
The above ports are the defaults given for the corresponding giFT modules.
To allow access to the user interface ports of giFT, use the giftui. [HOME-gift]: http://gift.sourceforge.net [WIKI-gift]: http://en.wikipedia.org/wiki/GiFT
server giftui accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This service refers only to the user interface ports offered by giFT. To allow gift accept P2P requests, use the gift. [HOME-giftui]: http://gift.sourceforge.net [WIKI-giftui]: http://en.wikipedia.org/wiki/GiFT
server gkrellmd accept
Service Type:
Server Ports:
Client Ports:
Links
server GRE accept
Service Type:
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Links
Notes
Protocol No 47.
For more information see RFC RFC 2784 (http://www.ietf.org/rfc/rfc2784.txt). [WIKI-GRE]: http://en.wikipedia.org/wiki/Generic_Routing_Encapsulation
server h323 accept
Service Type:
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Links
server heartbeat accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This FireHOL service has been designed such a way that it will allow multiple heartbeat clusters on the same LAN. [HOME-heartbeat]: http://www.linux-ha.org/
server http accept
Service Type:
Server Ports:
Client Ports:
Links
server httpalt accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This port is commonly used by web servers, web proxies and caches where the standard http port is not available or can or should not be used. [WIKI-httpalt]: http://en.wikipedia.org/wiki/Http
server https accept
Service Type:
Server Ports:
Client Ports:
Links
server hylafax accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This service allows incoming requests to server port tcp/4559 and outgoing from server port tcp/4558.
The correct operation of this service has not been verified.
USE THIS WITH CARE. A HYLAFAX CLIENT MAY OPEN ALL TCP UNPRIVILEGED PORTS TO ANYONE (from port tcp/4558). [HOME-hylafax]: http://www.hylafax.org/ [WIKI-hylafax]: http://en.wikipedia.org/wiki/Hylafax
server iax accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This service refers to IAX version 1. There is also iax2. [HOME-iax]: http://www.asterisk.org [WIKI-iax]: http://en.wikipedia.org/wiki/Iax
server iax2 accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This service refers to IAX version 2. There is also iax. [HOME-iax2]: http://www.asterisk.org [WIKI-iax2]: http://en.wikipedia.org/wiki/Iax
server ICMP accept
Service Type:
Server Ports:
Client Ports:
Links
server ICMPV6 accept
Service Type:
Server Ports:
Client Ports:
Links
server icp accept
Service Type:
Server Ports:
Client Ports:
Links
server ident reject with tcp-reset
Service Type:
Server Ports:
Client Ports:
Links
server imap accept
Service Type:
Server Ports:
Client Ports:
Links
server imaps accept
Service Type:
Server Ports:
Client Ports:
Links
Server Ports:
Client Ports:
Links
server ipv6error accept
Service Type:
Server Ports:
Client Ports:
Notes
This service is not needed from 3.0.0. It will do nothing but issue a warning from 3.1.0; it will be removed in 4.0.0.
The linux connection tracker ensures that ICMPv6 errors are marked as RELATED. Since 3.0.0, these are automatially accepted by FireHOL, making a separate command redundant.
client ipv6mld accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
IPv6 uses Multicast Listener Discovery to discover multicast listeners and what they are listening for.
In practice all IPv6 nodes are multicast listeners since multicast is used in the neighbour discovery protocol which replaces ARP in IPv4.
These rules are stateless since reports can happen automatically as well as on query.
Unless muticast snooping is disabled across the network, MLD should be enabled for any clients:
client ipv6mld accept
MLD should also be enabled as a server on any hosts acting as a router:
server ipv6mld accept
The rules should generally not be used to pass packets across a firewall (e.g. in a router definition) unless the firewall is for a bridge.
This service implicitly sets its client or server to ipv6 mode. [WIKI-ipv6mld]: https://en.wikipedia.org/wiki/Multicast_Listener_Discovery
client ipv6neigh accept
server ipv6neigh accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
IPv6 uses the Neighbour Discovery Protocol to do automatic configuration of routes and to replace ARP. To allow this functionality the network neighbour and router solicitation/advertisement messages should be enabled on each interface.
These rules are stateless since advertisement can happen automatically as well as on solicitation.
Neighbour discovery (incoming) should always be enabled:
server ipv6neigh accept
Neighbour advertisement (outgoing) should always be enabled:
client ipv6neigh accept
The rules should not be used to pass packets across a firewall (e.g. in a router definition) unless the firewall is for a bridge.
This service implicitly sets its client or server to ipv6 mode. [WIKI-ipv6neigh]: https://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol
client ipv6router accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
IPv6 uses the Neighbour Discovery Protocol to do automatic configuration of routes and to replace ARP. To allow this functionality the network neighbour and router solicitation/advertisement messages should be enabled on each interface.
These rules are stateless since advertisement can happen automatically as well as on solicitation.
Router discovery (incoming) should always be enabled:
client ipv6router accept
Router advertisement (outgoing) should be enabled on a host that routes:
server ipv6router accept
The rules should not be used to pass packets across a firewall (e.g. in a router definition) unless the firewall is for a bridge.
This service implicitly sets its client or server to ipv6 mode. [WIKI-ipv6router]: https://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol
server irc accept
Service Type:
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Links
server isakmp accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
For more information see the Archive of the FreeS/WAN documentation (http://web.archive.org/web/20100918134143/http://www.freeswan.org/freeswan_trees/freeswan-1.99/doc/ipsec.html#IKE.ipsec) [WIKI-isakmp]: http://en.wikipedia.org/wiki/ISAKMP
server jabber accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
Allows clear and SSL client-to-server connections. [WIKI-jabber]: http://en.wikipedia.org/wiki/Jabber
server jabberd accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
Allows clear and SSL client-to-server and server-to-server connections.
Use this service for a jabberd server. In all other cases, use the jabber. [WIKI-jabberd]: http://en.wikipedia.org/wiki/Jabber
Server Ports:
Client Ports:
Links
server ldap accept
Service Type:
Server Ports:
Client Ports:
Links
server ldaps accept
Service Type:
Server Ports:
Client Ports:
Links
server lpd accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
LPD is documented in RFC 1179 (http://www.ietf.org/rfc/rfc1179.txt).
Since many operating systems incorrectly use the non-default client ports for LPD access, this definition allows any client port to access the service (in addition to the RFC defined 721 to 731 inclusive). [WIKI-lpd]: http://en.wikipedia.org/wiki/Line_Printer_Daemon_protocol
server microsoft_ds accept
Service Type:
Server Ports:
Client Ports:
Notes
Direct Hosted (i.e. NETBIOS-less SMB)
This is another NETBIOS Session Service with minor differences with netbios_ssn. It is supported only by Windows 2000 and Windows XP and it offers the advantage of being independent of WINS for name resolution.
It seems that samba supports transparently this protocol on the netbios_ssn ports, so that either direct hosted or traditional SMB can be served simultaneously.
Please refer to the netbios_ssn for more information.
server mms accept
Service Type:
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Links
Notes
Microsoft’s proprietary network streaming protocol used to transfer unicast data in Windows Media Services (previously called NetShow Services). [WIKI-mms]: http://en.wikipedia.org/wiki/Microsoft_Media_Server
server msn accept
Service Type:
Server Ports:
Client Ports:
server msnp accept
Service Type:
Server Ports:
Client Ports:
server multicast reject with proto-unreach
Service Type:
Server Ports:
Client Ports:
Links
Notes
The multicast service matches all packets sent to the $MULTICAST_IPS addresses using IGMP or UDP. For IPv4 that means 224.0.0.0/4 and for IPv6 FF00::/16. [WIKI-multicast]: http://en.wikipedia.org/wiki/Multicast
server mysql accept
Service Type:
Server Ports:
Client Ports:
Links
server netbackup accept
client netbackup accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
To use this service you must define it as both client and server in NetBackup clients and NetBackup servers. [WIKI-netbackup]: http://en.wikipedia.org/wiki/Netbackup
server netbios_dgm accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
See also the samba.
Keep in mind that this service broadcasts (to the broadcast address of your LAN) UDP packets. If you place this service within an interface that has a dst parameter, remember to include (in the dst parameter) the broadcast address of your LAN too. [WIKI-netbios_dgm]: http://en.wikipedia.org/wiki/Netbios#Datagram_distribution_service
server netbios_ns accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
See also the samba. [WIKI-netbios_ns]: http://en.wikipedia.org/wiki/Netbios#Name_service
server netbios_ssn accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
See also the samba.
Please keep in mind that newer NETBIOS clients prefer to use port 445 (microsoft_ds) for the NETBIOS session service, and when this is not available they fall back to port 139 (netbios_ssn). Versions of samba above 3.x bind automatically to ports 139 and 445.
If you have an older samba version and your policy on an interface or router is DROP, clients trying to access port 445 will have to timeout before falling back to port 139. This timeout can be up to several minutes.
To overcome this problem you can explicitly REJECT the microsoft_ds with a tcp-reset message:
server microsoft_ds reject with tcp-reset [WIKI-netbios_ssn]: http://en.wikipedia.org/wiki/Netbios#Session_service
client nfs accept dst 192.0.2.1
Service Type:
Server Ports:
Client Ports:
Links
Notes
The NFS service queries the RPC service on the NFS server host to find out the ports nfsd, mountd, lockd and rquotad are listening. Then, according to these ports it sets up rules on all the supported protocols (as reported by RPC) in order the clients to be able to reach the server.
For this reason, the NFS service requires that:
Since NFS queries the remote RPC server, it is required to also be allowed to do so, by allowing the portmap too. Take care that this is allowed by the running firewall when FireHOL tries to query the RPC server. So you might have to setup NFS in two steps: First add the portmap service and activate the firewall, then add the NFS service and restart the firewall.
To avoid this you can setup your NFS server to listen on pre-defined ports, as documented in NFS Howto (http://nfs.sourceforge.net/nfs-howto/ar01s06.html#nfs_firewalls). If you do this then you will have to define the the ports using the procedure described in Adding Services in firehol.conf(5).
client nis accept dst 192.0.2.1
Service Type:
Server Ports:
Client Ports:
Links
Notes
The nis service queries the RPC service on the nis server host to find out the ports ypserv and yppasswdd are listening. Then, according to these ports it sets up rules on all the supported protocols (as reported by RPC) in order the clients to be able to reach the server.
For this reason, the nis service requires that:
Since nis queries the remote RPC server, it is required to also be allowed to do so, by allowing the portmap too. Take care that this is allowed by the running firewall when FireHOL tries to query the RPC server. So you might have to setup nis in two steps: First add the portmap service and activate the firewall, then add the nis service and restart the firewall.
This service was added to FireHOL by Carlos Rodrigues (http://sourceforge.net/p/firehol/feature-requests/20/). His comments regarding this implementation, are:
These rules work for client access only!
Pushing changes to slave servers won’t work if these rules are active somewhere between the master and its slaves, because it is impossible to predict the ports where yppush will be listening on each push.
Pulling changes directly on the slaves will work, and could be improved performance-wise if these rules are modified to open fypxfrd. This wasn’t done because it doesn’t make that much sense since pushing changes on the master server is the most common, and recommended, way to replicate maps. [WIKI-nis]: http://en.wikipedia.org/wiki/Network_Information_Service
server nntp accept
Service Type:
Server Ports:
Client Ports:
Links
server nntps accept
Service Type:
Server Ports:
Client Ports:
Links
Server Ports:
Client Ports:
Links
server ntp accept
Service Type:
Server Ports:
Client Ports:
Links
server nut accept
Service Type:
Server Ports:
Client Ports:
Links
server nxserver accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
Default ports used by NX server for connections without encryption.
Note that nxserver also needs the ssh to be enabled.
This information has been extracted from this The TCP ports used by nxserver are 4000 + DISPLAY_BASE to 4000 + DISPLAY_BASE + DISPLAY_LIMIT. DISPLAY_BASE and DISPLAY_LIMIT are set in /usr/NX/etc/node.conf and the defaults are DISPLAY_BASE=1000 and DISPLAY_LIMIT=200.
For encrypted nxserver sessions, only ssh is needed. [WIKI-nxserver]: http://en.wikipedia.org/wiki/NX_Server
Server Ports:
Client Ports:
Links
server oracle accept
Service Type:
Server Ports:
Client Ports:
Links
server OSPF accept
Service Type:
Server Ports:
Client Ports:
Links
server ping accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This services matches requests of protocol ICMP and type echo-request (TYPE=8) and their replies of type echo-reply (TYPE=0).
The ping service is stateful. [WIKI-ping]: http://en.wikipedia.org/wiki/Ping
server pop3 accept
Service Type:
Server Ports:
Client Ports:
Links
server pop3s accept
Service Type:
Server Ports:
Client Ports:
Links
server portmap accept
Service Type:
Server Ports:
Client Ports:
Links
server postgres accept
Service Type:
Server Ports:
Client Ports:
Links
server pptp accept
Service Type:
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Links
server privoxy accept
Service Type:
Server Ports:
Client Ports:
Links
server radius accept
Service Type:
Server Ports:
Client Ports:
Links
server radiusold accept
Service Type:
Server Ports:
Client Ports:
Links
server radiusoldproxy accept
Service Type:
Server Ports:
Client Ports:
Links
server radiusproxy accept
Service Type:
Server Ports:
Client Ports:
Links
server rdp accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
Remote Desktop Protocol is also known also as Terminal Services. [WIKI-rdp]: http://en.wikipedia.org/wiki/Remote_Desktop_Protocol
server rndc accept
Service Type:
Server Ports:
Client Ports:
Links
server rsync accept
Service Type:
Server Ports:
Client Ports:
Links
server rtp accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
RTP ports are generally all the UDP ports. This definition narrows down RTP ports to UDP 10000 to 20000. [WIKI-rtp]: http://en.wikipedia.org/wiki/Real-time_Transport_Protocol
server samba accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
The samba service automatically sets all the rules for netbios_ns, netbios_dgm, netbios_ssn and microsoft_ds.
Please refer to the notes of the above services for more information.
NETBIOS initiates based on the broadcast address of an interface (request goes to broadcast address) but the server responds from its own IP address. This makes the “server samba accept” statement drop the server reply, because of the way the iptables connection tracker works.
This service definition includes a hack, that allows a Linux samba server to respond correctly in such situations, by allowing new outgoing connections from the well known netbios_ns port to the clients high ports.
However, for clients and routers this hack is not applied because it would open all unprivileged ports to the samba server. The only solution to overcome the problem in such cases (routers or clients) is to build a trust relationship between the samba servers and clients. [HOME-samba]: http://www.samba.org/ [WIKI-samba]: http://en.wikipedia.org/wiki/Samba_(software)
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Links
server sip accept
Service Type:
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Links
Notes
SIP (http://www.voip-info.org/wiki/view/SIP) is an IETF standard protocol (RFC 2543) for initiating interactive user sessions involving multimedia elements such as video, voice, chat, gaming, etc. SIP works in the application layer of the OSI communications model. [WIKI-sip]: http://en.wikipedia.org/wiki/Session_Initiation_Protocol
server smtp accept
Service Type:
Server Ports:
Client Ports:
Links
server smtps accept
Service Type:
Server Ports:
Client Ports:
Links
server snmp accept
Service Type:
Server Ports:
Client Ports:
Links
server snmptrap accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
An SNMP trap is a notification from an agent to a manager. [WIKI-snmptrap]: http://en.wikipedia.org/wiki/Simple_Network_Management_Protocol#Trap
server socks accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
See also RFC 1928 (http://www.ietf.org/rfc/rfc1928.txt). [WIKI-socks]: http://en.wikipedia.org/wiki/SOCKS
server squid accept
Service Type:
Server Ports:
Client Ports:
Links
server ssh accept
Service Type:
Server Ports:
Client Ports:
Links
server stun accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
STUN (http://www.voip-info.org/wiki/view/STUN) is a protocol for assisting devices behind a NAT firewall or router with their packet routing. [WIKI-stun]: http://en.wikipedia.org/wiki/STUN
server submission accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
Submission is essentially normal SMTP with an SSL/TLS negotiation. [WIKI-submission]: http://en.wikipedia.org/wiki/Simple_Mail_Transfer_Protocol
server swat accept
Service Type:
Server Ports:
Client Ports:
Links
server syslog accept
Service Type:
Server Ports:
Client Ports:
Links
server telnet accept
Service Type:
Server Ports:
Client Ports:
Links
server tftp accept
Service Type:
Server Ports:
Client Ports:
Netfilter Modules
Netfilter NAT Modules
Links
server time accept
Service Type:
Server Ports:
Client Ports:
Links
server timestamp accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
This services matches requests of protocol ICMP and type timestamp-request (TYPE=13) and their replies of type timestamp-reply (TYPE=14).
The timestamp service is stateful. [WIKI-timestamp]: http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Timestamp
server upnp accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
For a Linux implementation see: Linux IGD (http://linux-igd.sourceforge.net/). [HOME-upnp]: http://upnp.sourceforge.net/ [WIKI-upnp]: http://en.wikipedia.org/wiki/Universal_Plug_and_Play
server uucp accept
Service Type:
Server Ports:
Client Ports:
Links
server vmware accept
Service Type:
Server Ports:
Client Ports:
Notes
Used from VMWare 1 and up. See the VMWare KnowledgeBase (http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1012382).
server vmwareauth accept
Service Type:
Server Ports:
Client Ports:
Notes
Used from VMWare 1 and up. See the VMWare KnowledgeBase (http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1012382).
server vmwareweb accept
Service Type:
Server Ports:
Client Ports:
Notes
Used from VMWare 2 and up. See VMWare Server 2.0 release notes (http://www.vmware.com/support/server2/doc/releasenotes_vmserver2.html) and the VMWare KnowledgeBase (http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1012382).
server vnc accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
VNC is a graphical desktop sharing protocol. [WIKI-vnc]: http://en.wikipedia.org/wiki/Virtual_Network_Computing
server webmin accept
Service Type:
Server Ports:
Client Ports:
Links
server whois accept
Service Type:
Server Ports:
Client Ports:
Links
client xbox accept
Service Type:
Server Ports:
Client Ports:
Notes
Definition for the Xbox live service.
See program source for contributor details.
server xdmcp accept
Service Type:
Server Ports:
Client Ports:
Links
Notes
See Gnome Display Manager (http://www.jirka.org/gdm-documentation/x70.html) for a discussion about XDMCP and firewalls (Gnome Display Manager is a replacement for XDM). [WIKI-xdmcp]: http://en.wikipedia.org/wiki/X_display_manager_(program_type)#X_Display_Manager_Control_Protocol
FireHOL Team.
| Built 28 Feb 2021 | FireHOL Reference |