Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

modularize default config #4

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

modularize default config #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 0 additions & 42 deletions debian/ferm.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,47 +2,5 @@
#
# Configuration file for ferm(1).
#
domain (ip ip6) {
table filter {
chain INPUT {
policy DROP;

# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;

# allow local packet
interface lo ACCEPT;

# respond to ping
proto icmp ACCEPT;

# allow IPsec
proto udp dport 500 ACCEPT;
@if @eq($DOMAIN, ip) {
proto (esp ah) ACCEPT;
} @else {
proto (esp) ACCEPT;
}

# allow SSH connections
proto tcp dport ssh ACCEPT;
}
chain OUTPUT {
policy ACCEPT;

# connection tracking
#mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
}
chain FORWARD {
policy DROP;

# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
}
}
}

@include ferm.d/;
18 changes: 18 additions & 0 deletions debian/ferm.d/10-policy
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
# -*- shell-script -*-
#
# Configuration file for ferm(1).
#
domain (ip ip6) {
table filter {
chain INPUT {
policy DROP;
}
chain OUTPUT {
policy ACCEPT;
}
chain FORWARD {
policy DROP;
}
}
}

24 changes: 24 additions & 0 deletions debian/ferm.d/20-conntrack
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# -*- shell-script -*-
#
# Configuration file for ferm(1).
#
domain (ip ip6) {
table filter {
chain INPUT {
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
}
chain OUTPUT {
# connection tracking
#mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
}
chain FORWARD {
# connection tracking
mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;
}
}
}

12 changes: 12 additions & 0 deletions debian/ferm.d/30-local
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
# -*- shell-script -*-
#
# Configuration file for ferm(1).
#
domain (ip ip6) {
table filter {
chain INPUT {
# allow local packet
interface lo ACCEPT;
}
}
}
12 changes: 12 additions & 0 deletions debian/ferm.d/40-ping
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
# -*- shell-script -*-
#
# Configuration file for ferm(1).
#
domain (ip ip6) {
table filter {
chain INPUT {
# respond to ping
proto icmp ACCEPT;
}
}
}
17 changes: 17 additions & 0 deletions debian/ferm.d/50-ipsec
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
# -*- shell-script -*-
#
# Configuration file for ferm(1).
#
domain (ip ip6) {
table filter {
chain INPUT {
# allow IPsec
proto udp dport 500 ACCEPT;
@if @eq($DOMAIN, ip) {
proto (esp ah) ACCEPT;
} @else {
proto (esp) ACCEPT;
}
}
}
}
12 changes: 12 additions & 0 deletions debian/ferm.d/60-ssh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
# -*- shell-script -*-
#
# Configuration file for ferm(1).
#
domain (ip ip6) {
table filter {
chain INPUT {
# allow SSH connections
proto tcp dport ssh ACCEPT;
}
}
}
1 change: 1 addition & 0 deletions debian/ferm.install
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
debian/ferm.conf etc/ferm
debian/ferm.d etc/ferm
examples usr/share/doc/ferm
src/ferm usr/sbin
src/import-ferm usr/sbin