fix README

[pve-firewall.git] / example / host.fw

diff --git a/example/host.fw b/example/host.fw
index 5ecca3d330e3b4afde91ea8753e5b0b4b3107a1c..a8ae5682cbdade55714ccd360f3821447655170e 100644 (file)
--- a/example/host.fw
+++ b/example/host.fw
@@ -7,8 +7,26 @@ tcp_flags_log_level: info
 smurf_log_level: nolog
 log_level_in: info
 log_level_out: info
+
+# allow more connections (default is 65536)
 nf_conntrack_max: 196608
 
+# reduce conntrack established timeout (default is 432000 - 5days)
+nf_conntrack_tcp_timeout_established: 7875
+
+# Enable firewall when bridges contains IP address.
+# The firewall is not fully functional in that case, so
+# you need to enable that explicitly
+allow_bridge_route: 1
+
+# disable SMURFS filter
+nosmurfs: 0
+
+# filter illegal combinations of TCP flags
+tcpflags: 1
+
+# rules processing speed optimizations 
+optimize : 1
 
 [RULES]