X-Git-Url: https://git.proxmox.com/?p=pve-firewall.git;a=blobdiff_plain;f=debian%2Fexample%2F100.fw;h=7a8da4806366aff9c0123ffc97cec2a5893c9d5c;hp=5ccdcaed40b0eef61b32c25bd523eb75e23a26e8;hb=a6811508c4532792400c10ddf0ea8906e4b6653c;hpb=44be8ceb181b163eb4d418b27b5ae92d8ca35293;ds=sidebyside diff --git a/debian/example/100.fw b/debian/example/100.fw index 5ccdcae..7a8da48 100644 --- a/debian/example/100.fw +++ b/debian/example/100.fw @@ -29,26 +29,36 @@ ips: 1 #ips_queues: 0 ips_queues: 0:3 +[IPSET ipfilter-net0] # only allow specified IPs on net0 +192.168.2.10 [RULES] -#TYPE ACTION IFACE SOURCE DEST PROTO D-PORT S-PORT - -IN SSH(ACCEPT) net0 -IN SSH(ACCEPT) net0 # a comment -IN SSH(ACCEPT) net0 192.168.2.192 # only allow SSH from 192.168.2.192 -IN SSH(ACCEPT) net0 10.0.0.1-10.0.0.10 #accept SSH for ip in range 10.0.0.1 to 10.0.0.10 -IN SSH(ACCEPT) net0 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for 10.0.0.1 or 10.0.0.2 or 10.0.0.3 -IN SSH(ACCEPT) net0 +mynetgroup #accept ssh for netgroup mynetgroup -IN SSH(ACCEPT) net0 myserveralias #accept ssh for alias myserveralias - -|IN SSH(ACCEPT) net0 # disabled rule +#TYPE ACTION [OPTIONS] +# -i +# -source +# -dest +# -p +# -dport +# -sport + +IN SSH(ACCEPT) -i net0 +IN SSH(ACCEPT) -i net0 # a comment +IN SSH(ACCEPT) -i net0 -source 192.168.2.192 # only allow SSH from 192.168.2.192 +IN SSH(ACCEPT) -i net0 -source 10.0.0.1-10.0.0.10 #accept SSH for ip in range 10.0.0.1 to 10.0.0.10 +IN SSH(ACCEPT) -i net0 -source 10.0.0.1,10.0.0.2,10.0.0.3 #accept ssh for 10.0.0.1 or 10.0.0.2 or 10.0.0.3 +IN SSH(ACCEPT) -i net0 -source +mynetgroup #accept ssh for ipset mynetgroup +IN SSH(ACCEPT) -i net0 -source myserveralias #accept ssh for alias myserveralias +IN SSH(ACCEPT) -i net0 -source FE80:0000:0000:0000:0202:B3FF:FE1E:8329 +IN ACCEPT -i net0 -p icmpv6 + +|IN SSH(ACCEPT) -i net0 # disabled rule # add a security group -GROUP group1 net0 +GROUP group1 -i net0 -OUT DNS(ACCEPT) net0 -OUT Ping(ACCEPT) net0 +OUT DNS(ACCEPT) -i net0 +OUT Ping(ACCEPT) -i net0 OUT SSH(ACCEPT)