Ferm.conf syntax fixes
[hcoop/zz_old/debian/hcoop-firewall-config.git] / files / ferm.conf.hcoop
1 # -*- shell-script -*-
2 #
3 # Configuration file for ferm(1).
4 #
5
6 table filter {
7 chain INPUT {
8 policy DROP;
9
10 # connection tracking
11 mod state state INVALID DROP;
12 mod state state (ESTABLISHED RELATED) ACCEPT;
13
14 # allow local packet
15 interface lo ACCEPT;
16
17 # respond to ping
18 proto icmp ACCEPT;
19
20 # allow IPsec
21 proto udp dport 500 ACCEPT;
22 proto (esp ah) ACCEPT;
23
24 proto tcp dport ssh ACCEPT;
25
26 # domtool slave
27 proto tcp dport 1235 ACCEPT;
28
29 proto (tcp udp) dport ( kerberos afs3-callback ) ACCEPT;
30
31 # system ports
32 @include 'service.in.d/';
33 @include 'local_ports_in.conf';
34 @include 'users_tcp_in.conf';
35 }
36 chain OUTPUT {
37 policy DROP;
38
39 # connection tracking
40 #mod state state INVALID DROP;
41 mod state state (ESTABLISHED RELATED) ACCEPT;
42
43 proto tcp dport ssh ACCEPT;
44
45 # connections to domtool dispatcher and slaves (for e.g. QFoo)
46 proto tcp dport 1234 ACCEPT;
47 proto tcp dport 1235 ACCEPT;
48
49 proto (tcp udp) dport ( kerberos afs3-fileserver afs3-callback afs3-prserver afs3-vlserver afs3-volser afs3-errors afs3-bos ) ACCEPT;
50 proto tcp dport kerberos-adm ACCEPT;
51
52 proto (tcp udp) dport ntp ACCEPT;
53 proto (tcp udp) dport domain ACCEPT;
54
55 # root needs port 80 for things like apt-get
56 mod owner uid-owner 0 { proto (tcp) dport (http https) ACCEPT; }
57
58 @include 'service.out.d/';
59 @include 'local_ports_out.conf';
60 @include 'users_tcp_out.conf';
61 }
62 chain FORWARD {
63 policy DROP;
64
65 # connection tracking
66 mod state state INVALID DROP;
67 mod state state (ESTABLISHED RELATED) ACCEPT;
68 }
69 }
70
71 @include 'user_chains.conf';
72
73 # IPv6:
74 #domain ip6 {
75 # table filter {
76 # chain INPUT {
77 # policy ACCEPT;
78 # # ...
79 # }
80 # # ...
81 # }
82 #}