2002-08-07 16:28:04 +02:00
|
|
|
#
|
2003-03-18 16:16:33 +01:00
|
|
|
# Shorewall 1.4 -- Policy File
|
2002-08-07 16:28:04 +02:00
|
|
|
#
|
|
|
|
|
# /etc/shorewall/policy
|
|
|
|
|
#
|
|
|
|
|
# This file determines what to do with a new connection request if we
|
|
|
|
|
# don't get a match from the /etc/shorewall/rules file or from the
|
|
|
|
|
# /etc/shorewall/common[.def] file. For each source/destination pair, the
|
|
|
|
|
# file is processed in order until a match is found ("all" will match
|
|
|
|
|
# any client or server).
|
|
|
|
|
#
|
|
|
|
|
# Columns are:
|
|
|
|
|
#
|
|
|
|
|
# SOURCE Source zone. Must be the name of a zone defined
|
|
|
|
|
# in /etc/shorewall/zones, $FW or "all".
|
|
|
|
|
#
|
|
|
|
|
# DEST Destination zone. Must be the name of a zone defined
|
|
|
|
|
# in /etc/shorewall/zones, $FW or "all"
|
|
|
|
|
#
|
2002-11-24 21:12:22 +01:00
|
|
|
# WARNING: Firewall->Firewall policies are not allowed; if
|
|
|
|
|
# you have a policy where both SOURCE and DEST are $FW,
|
|
|
|
|
# Shorewall will not start!
|
|
|
|
|
#
|
2002-08-07 16:28:04 +02:00
|
|
|
# POLICY Policy if no match from the rules file is found. Must
|
2002-08-22 23:33:54 +02:00
|
|
|
# be "ACCEPT", "DROP", "REJECT" or "CONTINUE"
|
2002-08-07 16:28:04 +02:00
|
|
|
#
|
|
|
|
|
# LOG LEVEL If supplied, each connection handled under the default
|
|
|
|
|
# POLICY is logged at that level. If not supplied, no
|
|
|
|
|
# log message is generated. See syslog.conf(5) for a
|
|
|
|
|
# description of log levels.
|
|
|
|
|
#
|
2002-12-28 16:38:03 +01:00
|
|
|
# Beginning with Shorewall version 1.3.12, you may
|
|
|
|
|
# also specify ULOG (must be in upper case). This will
|
|
|
|
|
# log to the ULOG target and sent to a separate log
|
|
|
|
|
# through use of ulogd
|
|
|
|
|
# (http://www.gnumonks.org/projects/ulogd).
|
|
|
|
|
#
|
2002-08-07 16:28:04 +02:00
|
|
|
# If you don't want to log but need to specify the
|
|
|
|
|
# following column, place "_" here.
|
|
|
|
|
#
|
|
|
|
|
# LIMIT:BURST If passed, specifies the maximum TCP connection rate
|
|
|
|
|
# and the size of an acceptable burst. If not specified,
|
|
|
|
|
# TCP connections are not limited.
|
|
|
|
|
#
|
|
|
|
|
# As shipped, the default policies are:
|
|
|
|
|
#
|
|
|
|
|
# a) All connections from the local network to the internet are allowed
|
|
|
|
|
# b) All connections from the internet are ignored but logged at syslog
|
|
|
|
|
# level KERNEL.INFO.
|
|
|
|
|
# d) All other connection requests are rejected and logged at level
|
|
|
|
|
# KERNEL.INFO.
|
|
|
|
|
###############################################################################
|
|
|
|
|
#SOURCE DEST POLICY LOG LEVEL LIMIT:BURST
|
|
|
|
|
loc net ACCEPT
|
|
|
|
|
net all DROP info
|
|
|
|
|
all all REJECT info
|
|
|
|
|
#LAST LINE -- ADD YOUR ENTRIES ABOVE THIS LINE -- DO NOT REMOVE
|
