[pve-firewall.git] / example / host.fw

# /etc/pve/local/host.fw

[OPTIONS]

enable: 0
tcp_flags_log_level: info
smurf_log_level: nolog
log_level_in: info
log_level_out: info

# default policy
policy_in: DROP
policy_out: ACCEPT

# allow more connections (default is 65536)
nf_conntrack_max: 196608

# reduce conntrack established timeout (default is 432000 - 5days)
nf_conntrack_tcp_timeout_established: 7875

# Enable firewall when bridges contains IP address.
# The firewall is not fully functional in that case, so
# you need to enable that explicitly
allow_bridge_route: 1

# disable SMURFS filter
nosmurfs: 0

# filter illegal combinations of TCP flags
tcpflags: 1

# rules processing speed optimizations 
optimize : 1

[RULES]

IN  SSH(ACCEPT) net0
OUT SSH(ACCEPT) net0
Commit	Line	Data
2d404ffc DM	1	# /etc/pve/local/host.fw
	2
	3	[OPTIONS]
	4
	5	enable: 0
	6	tcp_flags_log_level: info
	7	smurf_log_level: nolog
178a63be DM	8	log_level_in: info
178a63be DM	9	log_level_out: info
72f63fde DM	10
	11	# default policy
	12	policy_in: DROP
	13	policy_out: ACCEPT
	14
530c005e	15	# allow more connections (default is 65536)
1ec3e3d0	16	nf_conntrack_max: 196608
2d404ffc	17
28c082a1 AD	18	# reduce conntrack established timeout (default is 432000 - 5days)
	19	nf_conntrack_tcp_timeout_established: 7875
	20
530c005e DM	21	# Enable firewall when bridges contains IP address.
	22	# The firewall is not fully functional in that case, so
	23	# you need to enable that explicitly
	24	allow_bridge_route: 1
92e976b3	25
4ac863a6 DM	26	# disable SMURFS filter
	27	nosmurfs: 0
	28
11f12eae DM	29	# filter illegal combinations of TCP flags
	30	tcpflags: 1
	31
cc10e5d7 AD	32	# rules processing speed optimizations
	33	optimize : 1
	34
92e976b3 DM	35	[RULES]
	36
	37	IN SSH(ACCEPT) net0
	38	OUT SSH(ACCEPT) net0