firehol-defaults.conf(5) | 3.1.7 | firehol-defaults.conf(5) |
firehol-defaults.conf - control variables for FireHOL
Defaults in /etc/firehol/firehol-defaults.conf:
From FireHOL 3 upwards, variables which control FireHOL behaviour are held in a separate file: /etc/firehol/firehol-defaults.conf.
Some variables can also be set in the main firehol.conf file but that is not recommended, since they may be used before the main configuration is processed.
FireHOL also sets some variables before processing the configuration file which you can use as part of your configuration. These are described in firehol.conf(5).
Packets that reach the end of an interface without an action of return or accept are logged. You can control the frequency of this logging by altering FIREHOL_LOG_FREQUENCY.
Example:
DEFAULT_INTERFACE_POLICY="REJECT"
Packets that reach the end of a router without an action of return or accept are logged. You can control the frequency of this logging by altering FIREHOL_LOG_FREQUENCY.
Example:
DEFAULT_ROUTER_POLICY="REJECT"
All packets that reach the end of a chain are logged, regardless of these settings. You can control the frequency of this logging by altering FIREHOL_LOG_FREQUENCY.
Example:
UNMATCHED_INPUT_POLICY="REJECT" UNMATCHED_OUTPUT_POLICY="REJECT" UNMATCHED_FORWARD_POLICY="REJECT"
FireHOL defaults all values to ACCEPT so that your communications continue to work uninterrupted.
If you wish to prevent connections whilst the new firewall is activating, set these values to DROP. This is important to do if you are using all or any to match traffic; connections established during activation will continue even if they would not be allowed once the firewall is established.
Example:
FIREHOL_INPUT_ACTIVATION_POLICY="DROP" FIREHOL_OUTPUT_ACTIVATION_POLICY="DROP" FIREHOL_FORWARD_ACTIVATION_POLICY="DROP"
Acceptable values are LOG (normal syslog) and ULOG (netfilter ulogd). When ULOG is selected, FIREHOL_LOG_LEVEL is ignored.
Example:
FIREHOL_LOG_MODE="ULOG"
To see the available options run: /sbin/iptables -j LOG --help or /sbin/iptables -j ULOG --help
To avoid packet logs appearing on your console you should ensure klogd only logs traffic that is more important than that produced by FireHOL.
Use the following option to choose an iptables(8) log level (alpha or numeric) which is higher than the -c of klogd.
iptables/klogd levels
iptables | klogd | description |
emerg (0) | 0 | system is unusable |
alert (1) | 1 | action must be taken immediately |
crit (2) | 2 | critical conditions |
error (3) | 3 | error conditions |
warning (4) | 4 | warning conditions |
notice (5) | 5 | normal but significant condition |
info (6) | 6 | informational |
debug (7) | 7 | debug-level messages |
Note
The default for klogd is generally to log everything (7 and lower) and the default level for iptables(4) is to log as warning (4).
Example:
FIREHOL_LOG_OPTIONS="--log-level info \
--log-tcp-options --log-ip-options"
To see the available options run: /sbin/iptables -j LOG --help
Example:
FIREHOL_LOG_FREQUENCY="30/minute" FIREHOL_LOG_BURST="2"
To see the available options run: /sbin/iptables -m limit --help
Example:
FIREHOL_LOG_PREFIX="FIREHOL:"
You may be better off using firehol-protection(5) to control matching of INVALID packets and others on a per-interface and per-router basis.
Note
Care must be taken on IPv6 interfaces, since ICMPv6 packets such as Neighbour Discovery are not tracked, meaning they are marked as INVALID.
Example:
FIREHOL_DROP_INVALID="1"
Example:
DEFAULT_CLIENT_PORTS="0:65535"
Example:
FIREHOL_NAT="1"
Example:
FIREHOL_ROUTING="1"
If the variable is not set, a system-specific value is used which was defined at configure-time. If no value was chosen then the save fails.
Example:
FIREHOL_AUTOSAVE="/tmp/firehol-saved-ipv4.txt" FIREHOL_AUTOSAVE6="/tmp/firehol-saved-ipv6.txt"
Example:
FIREHOL_LOAD_KERNEL_MODULES="0"
Warning
If you do not set up appropriate rules, local processes will not be able to communicate with each other which can result in serious breakages.
By default “lo” is trusted and all INPUT and OUTPUT traffic is accepted (forwarding is not included).
Example:
FIREHOL_TRUST_LOOPBACK="0"
In busy environments the iptables(8) connection tracker removes connection tracking list entries as soon as it receives a FIN. This makes the ACK FIN appear as an invalid packet which will normally be logged by FireHOL.
Example:
FIREHOL_DROP_ORPHAN_TCP_ACK_FIN="1"
In busy environments the iptables(8) connection tracker removes connection tracking list entries as soon as it receives a RST. This makes the ACK RST appear as an invalid packet which will normally be logged by FireHOL.
Example:
FIREHOL_DROP_ORPHAN_TCP_ACK_RST="1"
In busy environments the iptables(8) connection tracker removes unneeded connection tracking list entries. This makes ACK packets appear as an invalid packet which will normally be logged by FireHOL.
Example:
FIREHOL_DROP_ORPHAN_TCP_ACK="1"
In busy environments the iptables(8) connection tracker removes unneeded connection tracking list entries. This makes RST packets appear as an invalid packet which will normally be logged by FireHOL.
Example:
FIREHOL_DROP_ORPHAN_TCP_RST="1"
In busy environments the iptables(8) connection tracker removes unneeded connection tracking list entries. This makes ICMP destination unreachable appear as an invalid packet which will normally be logged by FireHOL.
Example:
FIREHOL_DROP_ORPHAN_IPV4_ICMP_TYPE3="1"
A device does not need to be up in order to have firewall rules created for it, so this option should only be used if you have a specific need to wait (e.g. the network must be queried to determine the hosts or ports which will be firewalled).
Example:
WAIT_FOR_IFACE="eth0"
FireHOL Team.
Built 15 Oct 2022 | FireHOL Reference |