fix README

[pve-firewall.git] / example / 100.fw

diff --git a/example/100.fw b/example/100.fw
index b7b27dd1c6b1488b9b1c9ced7c2b147cb78fab5f..b1f65c3bc0efa0f542baed15120d9f3a32839e37 100644 (file)
--- a/example/100.fw
+++ b/example/100.fw
@@ -1,6 +1,7 @@
 # Example VM firewall configuration
 
-[OPTIONS] # VM specific firewall options
+# VM specific firewall options
+[OPTIONS]
 
 # disable/enable the whole thing
 enable: 1 
@@ -9,8 +10,8 @@ enable: 1
 macfilter: 0
 
 # default policy
-policy-in: DROP
-policy-out: REJECT
+policy_in: DROP
+policy_out: REJECT
 
 # log dropped incoming connection
 log_level_in: info
@@ -18,15 +19,16 @@ log_level_in: info
 # disable log for outgoing connections
 log_level_out: nolog
 
-# filter SMURFS
-nosmurfs: 1
-
-# filter illegal combinations of TCP flags
-tcpflags: 1
-
 # enable DHCP
 dhcp: 1
 
+# enable ips
+ips: 1
+
+# specify nfqueue queues (optionnal)
+#ips_queues: 0
+ips_queues: 0:3
+
 
 [RULES]
 
@@ -35,6 +37,10 @@ dhcp: 1
 IN SSH(ACCEPT) net0
 IN SSH(ACCEPT) net0 # a comment
 IN SSH(ACCEPT) net0 192.168.2.192  # only allow SSH from  192.168.2.192
+IN SSH(ACCEPT) net0 10.0.0.1-10.0.0.10 #accept SSH for ip in range 10.0.0.1 to 10.0.0.10
+IN SSH(ACCEPT) net0 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for 10.0.0.1 or 10.0.0.2 or 10.0.0.3
+IN SSH(ACCEPT) net0 +mynetgroup   #accept ssh for netgroup mynetgroup
+
 |IN SSH(ACCEPT) net0 # disabled rule
 
 # add a security group