files/ferm.conf.hcoop

   1 # -*- shell-script -*-
   2 #
   3 #  Configuration file for ferm(1).
   4 #
   5
   6 table filter {
   7     chain INPUT {
   8         policy DROP;
   9
  10         # connection tracking
  11         mod state state INVALID DROP;
  12         mod state state (ESTABLISHED RELATED) ACCEPT;
  13
  14         # allow local packet
  15         interface lo ACCEPT;
  16
  17         # respond to ping
  18         proto icmp ACCEPT;
  19
  20         # allow IPsec
  21         proto udp dport 500 ACCEPT;
  22         proto (esp ah) ACCEPT;
  23
  24         proto tcp dport ssh ACCEPT;
  25
  26         # domtool slave
  27         proto tcp dport 1235 ACCEPT;
  28
  29         proto (tcp udp) dport ( kerberos afs3-callback ) ACCEPT;
  30
  31         # system ports
  32         @include 'service.in.d/';
  33         @include 'local_ports_in.conf';
  34         @include 'users_tcp_in.conf'
  35     }
  36     chain OUTPUT {
  37         policy DROP;
  38
  39         # connection tracking
  40         #mod state state INVALID DROP;
  41         mod state state (ESTABLISHED RELATED) ACCEPT;
  42
  43         proto tcp dport ssh ACCEPT;
  44
  45         # connections to domtool dispatcher and slaves (for e.g. QFoo)
  46         proto tcp dport 1234 ACCEPT;
  47         proto tcp dport 1235 ACCEPT;
  48
  49         proto (tcp udp) dport ( kerberos afs3-fileserver afs3-callback afs3-prserver afs3-vlserver afs3-volser afs3-errors afs3-bos ) ACCEPT;
  50         proto tcp dport kerberos-adm ACCEPT;
  51
  52         proto (tcp udp) dport ntp ACCEPT;
  53         proto (tcp udp) dport domain ACCEPT;
  54
  55         # root needs port 80 for things like apt-get
  56         mod owner uid-owner 0 { proto (tcp) dport (http https) ACCEPT; }
  57
  58         @include 'service.out.d/';
  59         @include 'local_ports_out.conf';
  60         @include 'users_tcp_out.conf'
  61     }
  62     chain FORWARD {
  63         policy DROP;
  64
  65         # connection tracking
  66         mod state state INVALID DROP;
  67         mod state state (ESTABLISHED RELATED) ACCEPT;
  68     }
  69 }
  70
  71 @include 'user_chains.conf'
  72
  73 # IPv6:
  74 #domain ip6 {
  75 #    table filter {
  76 #        chain INPUT {
  77 #            policy ACCEPT;
  78 #            # ...
  79 #        }
  80 #        # ...
  81 #    }
  82 #}