fix call to register_restart_command (set $use_hup to true)

[pve-firewall.git] / debian / example / 100.fw

diff --git a/debian/example/100.fw b/debian/example/100.fw
index dffd144fee496923ebaf88ceaf15a8935b00dbf2..7a8da4806366aff9c0123ffc97cec2a5893c9d5c 100644 (file)
--- a/debian/example/100.fw
+++ b/debian/example/100.fw
@@ -29,6 +29,8 @@ ips: 1
 #ips_queues: 0
 ips_queues: 0:3
 
 #ips_queues: 0
 ips_queues: 0:3
 

+[IPSET ipfilter-net0] # only allow specified IPs on net0
+192.168.2.10

 
 [RULES]
 
 
 [RULES]
 


@@ -45,8 +47,10 @@ IN SSH(ACCEPT) -i net0 # a comment
 IN SSH(ACCEPT) -i net0 -source 192.168.2.192  # only allow SSH from  192.168.2.192
 IN SSH(ACCEPT) -i net0 -source 10.0.0.1-10.0.0.10 #accept SSH for ip in range 10.0.0.1 to 10.0.0.10
 IN SSH(ACCEPT) -i net0 -source 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for 10.0.0.1 or 10.0.0.2 or 10.0.0.3
 IN SSH(ACCEPT) -i net0 -source 192.168.2.192  # only allow SSH from  192.168.2.192
 IN SSH(ACCEPT) -i net0 -source 10.0.0.1-10.0.0.10 #accept SSH for ip in range 10.0.0.1 to 10.0.0.10
 IN SSH(ACCEPT) -i net0 -source 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for 10.0.0.1 or 10.0.0.2 or 10.0.0.3

-IN SSH(ACCEPT) -i net0 -source +mynetgroup   #accept ssh for netgroup mynetgroup
+IN SSH(ACCEPT) -i net0 -source +mynetgroup   #accept ssh for ipset mynetgroup

 IN SSH(ACCEPT) -i net0 -source myserveralias   #accept ssh for alias myserveralias
 IN SSH(ACCEPT) -i net0 -source myserveralias   #accept ssh for alias myserveralias

+IN SSH(ACCEPT) -i net0 -source FE80:0000:0000:0000:0202:B3FF:FE1E:8329
+IN ACCEPT -i net0 -p icmpv6

 
 |IN SSH(ACCEPT) -i net0 # disabled rule
 
 
 |IN SSH(ACCEPT) -i net0 # disabled rule