implement nosmurfs option for hiost firewall

[pve-firewall.git] / example / host.fw

diff --git a/example/host.fw b/example/host.fw
index c64d9cd9a27b120d9bc3d2d9faf6bdb706f6b5c9..663d2d7f05b5d0506cfaa449a3036fd5b078b565 100644 (file)
--- a/example/host.fw
+++ b/example/host.fw
@@ -8,4 +8,25 @@ smurf_log_level: nolog
 log_level_in: info
 log_level_out: info
 
-# TODO
\ No newline at end of file
+# default policy
+policy_in: DROP
+policy_out: ACCEPT
+
+# allow more connections (default is 65536)
+nf_conntrack_max: 196608
+
+# Enable firewall when bridges contains IP address.
+# The firewall is not fully functional in that case, so
+# you need to enable that explicitly
+allow_bridge_route: 1
+
+# disable SMURFS filter
+nosmurfs: 0
+
+# filter illegal combinations of TCP flags
+tcpflags: 1
+
+[RULES]
+
+IN  SSH(ACCEPT) net0
+OUT SSH(ACCEPT) net0