## Debian GNU Linux Firewall Package
## This file has been automatically generated by debconf. It will be overwritten
## the next time you configure firewall without choosing "don't touch".


## Sysconfig definitions
#  These entries define the global behaviour of the firewall package. Normally
#  they are preset in /etc/default/uif and may be overwritten by this
#  section.
#
#  syntax:   LogLevel : set the kernel loglevel for iptables rules
#            LogPrefix: prepend this string to all iptables logs
#            LogLimit:  set packet log limit per time interval (times/interval)
#            LogBurst:  set packet log burst
#            Limit:     set packet limit per time interval (times/interval)
#            Burst:     set packet burst
#  example:
#   sysconfig {
#      LogLevel      debug
#      LogPrefix     FW
#      LogLimit      20/minute
#      LogBurst      5
#      Limit         20/minute
#      Burst         5
#      AccountPrefix ACC_
#   }


## Include predefined services
#  The include section takes a bunch of files and includes them into this
#  configuration file.
#
#  syntax:  "filename"
#include {
#    "/etc/uif/services"
#}


## Services needed for workstation setup
#  The service section provides the protocol definitions you're
#  using in the rules. You're forced to declare everything you
#  need for your setup.
#
#  syntax: service_name [tcp([source:range]/[dest:range])] [udp([source:range]/[dest:range])]
#                       [protocol_name([source:range][/][dest:range])] [service_name] ...
#  examples: http  tcp(/80)
#            dns   tcp(/53) udp(/53)
#            group http dns tcp(/443)
#            ipsec esp(/) udp(/500)
service {
    traceroute  udp(32769:65535/33434:33523) icmp(11)
    ping        icmp(8)
}

## Network definitions needed for simple workstation setup
#  In the network section you're asked to provide informations on all
#  hosts and/or networks running in your setup.
#
#  syntax: net_name [ip-address[:mac-address]] [network] [net_name]
#  examples: webserver 192.168.1.5
#            intranet  10.1.0.0/16
#            dmz       10.5.0.0/255.255.0.0
#            some      intranet dmz 10.2.1.1
#            router    10.1.0.1=0A:32:F2:C7:1A:31
network {
    localhost   127.0.0.1
    all         0.0.0.0/0
    trusted     192.168.1.0/24
}

## Interface definitions
#  Since all definitions used in the filter section are symbolic,
#  you've to specify symbolic names for all your interfaces you're
#  going to use.
#
#  syntax: interface_name [unix network interface] [interface_name]
#  examples: internal eth0
#            external ippp0 ipsec0
#            allppp   ppp+
#            group    external allppp eth3
interface {
    loop     lo
}

## Filter definitions
#  The filter section defines the rules for in, out, forward, masquerading
#  and nat. All rules make use of the symbolic names defined above. This
#  section can be used multiple times in one config file. This makes more
#  senese when using one of these alias names:
#  filter, nat, input, output, forward, masquerade
#
#  syntax: in[-/+]  [i=interface] [s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n]
#          out[-/+] [o=interface] [s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n]
#          fw[>/-/+]  [i/o=interface][s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n]
#          masq[-/+][i/o=interface][s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n]
#          nat[-/+] additionally allows [S=from source] [D=to destination] [P=to port:[range]]
#  additional:
#          All keys mentioned in the syntax section (in/out/...) can be prefixed with "sl", which
#          causes the creation of a stateless rule.
#  flags:  limit([count/time[,burst]])
#          reject([reject type])
#          log([name])
#          account(name)
#  examples:
#       masq+  o=extern s=intranet
#       nat+   s=intranet p=http   D=relayintern   P=squid
#       in+    s=trusted  p=ssh,ping,traceroute,http
#       out-   s=intranet p=smb    f=reject
#       fw-    d=microsoft         f=reject,log(ms-alert)
#       slin+  s=testnet
#       slout- d=testnet
#       fw>    o=extern
#       fw+    p=myhttp            f=account(HTTP)
#              Take an attention about the protocol for your accounting rules. If you
#              want to count user http traffice, you may need a "myhttp tcp(80/)".
filter {
    in+  i=loop    s=localhost
    out+ o=loop    d=localhost

    in+  p=ping,traceroute
    in+  s=trusted
    out+ d=all

    in-  f=log(input),reject
    out- f=log(output),reject
    fw-  f=log(forward),reject
}
