Harald.Hoyer@redhat.de
With this utility you can easily set up packet filter rules to build a firewall for your intranet.
Use the "What's this" toolbar icon and click on an element to get a quick help about the element.
Here you see the firewall rules, which are processed by ascending rule numbers. If a rule fits an incoming packet the action of the rule is executed. With the up and down arrows you can move a rule in the list. The "Delete" button will delete the selected rule. The "Modify" button will let you modify the selected rule. The "New" button lets you create a new rule, that will be appended to the end of the list.
Here you can choose, which ICMP packets will be accepted for input.
Only ICMP messages with the type destination-unreachable source-quench time-exceeded or parameter-problem will be accepted.
Only ICMP messages with the type ping, pong, destination-unreachable, source-qu!ench, time-exceeded or parameter-problem will be accepted.
means all ICMP messages will be accepted.
Here you can choose the default action, which takes effect to the packet, if no rule applies.
means that the packet will take its normal way through the network layer to an application or to an other host.
means the packet will be ignored without notification to the sender.
means the packet will be ignored and an ICMP message is sent to the sender telling it that the packet was rejected.
Here you describe the pattern for which the rule will apply and the action that takes effect if the rule matches a packet.
The SrcDev and DstDev comboboxes let you specify a device. The DstDev will only work, if the packet will be forwarded. You can also choose "*", if the device doesn't matter.
The SrcIP and DstIP comboboxes take a CIDR IP address, which is in the format xxx.xxx.xxx.xxx/yyy. Where xxx.xxx.xxx.xxx is an IP network address and yy specify the amount of valid bits from the left. E.g. 127.0.0.1/8 means all IPs with 127. in the beginning, 192.168.1.1/32 means the exact IP address 192.168.1.1. You can also choose "*", if the IP doesn't matter.
The SrcPorts and DstPorts take a port or a port range in the format port[:port]. E.g. 1:80 means all ports from 1 to 80. You can also choose "*", if the port doesn't matter. If you selected the ICMP protocol, the destination port is equal to the icmp type of the packet. Instead of a number (e.g. 80) you can also specify the service name (www), found in /etc/services.
The Proto combo lets you choose a protocol which the packet must fit to apply to the rule. E.g. TCP, UDP or ICMP or * for all protocols.
In the Action combobox you can choose between:
means that the packet will take its normal way through the network layer to an application or to an other host.
means the packet will be ignored without notification to the sender.
means the packet will be ignored and an ICMP message is sent to the sender telling it that the packet was rejected.
will redirect the packet to a local port instead of the destination address.
In the RedirPort input field, you choose a port to which the packet is redirected (transparent proxy), if the action is REDIRECT.
If you check Log appearance, then a log entry appears in /var/log/messages, if the rule takes effect.
If you check Bidirectional, then the rule will also fit a packet with source and destination parameters swapped.
If you check Start of connection, then the rule will only fit the start of a TCP connection. Hint: Choose protocol TCP and action ACCEPT first.
If you check Only connected, then the rule will only fit an already established TCP connection. Hint: Choose protocol TCP first and action DENY or REJECT first.
The firewall-config tool generates /etc/sysconfig/ipchains.
If you have activated the service ipchains, the startscript /etc/init.d/ipchains will install the rules at startup.
By pressing the button Activate you install the generated rules and the service ipchains at startup. The button Deactivate deinstalls all firewall rules and removes the service ipchains from startup.
Or you may reload the rules manually as root by
# service ipchains restart
firewall-config, kcmfirewall Copyright 1999 Red Hat Inc., Harald.Hoyer@redhat.de
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.