home *** CD-ROM | disk | FTP | other *** search
/ PC-Online 1999 November / PCOnline_11_1999.iso / filesbbs / OS2 / IJFIRE12.ZIP / firewall / firerule.cn_ next >
Text File  |  1999-08-20  |  7KB  |  175 lines
  1. #-----------------------------------------------------------------------------
  2. # FIRERULE.CNF
  3. #-----------------------------------------------------------------------------
  4. #
  5. # Location.:  Firewall directory (may vary).
  6. #
  7. # Purpose..:  Define "Access Control Rules" used by the F/X Firewall.
  8. #             Attributes not listed in the individual rules will get default
  9. #             values from the firerule file located in the base directory.
  10. #
  11. # Syntax...:  Records begin in first position of a line. Attributes and Values
  12. #             are case-sensitive. Lines starting with the '#' denote a comment.
  13. #             "Quote" strings / IP addresses, but NOT integers and constants.
  14. #
  15. # Help.....:  Product docs and the matching .dct file (for the tech. inclined).
  16. #
  17. # Errors...:  Written to 'FIREWALL.ERR' in the base directory.
  18. #_____________________________________________________________________________
  19.  
  20.  
  21.  
  22.  
  23. #-----------------------------------------------------------------------------#
  24. #                                          #
  25. #   SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE     #
  26. #                                                                             #
  27. #      Transparent access to and from NT Server with real IP address.         #
  28. #                                                                             #
  29. #-----------------------------------------------------------------------------#
  30.  
  31. NT-SERVER_IN    Rule-Status = Disabled,
  32.         Comment = "Internet ---> NT Server",
  33.         Source = "any",
  34.         Destination = "www.ntserver.com",
  35.         Rule-Action = Allow,
  36.  
  37. NT-SERVER_OUT    Rule-Status = Disabled,
  38.         Comment = "NT Server ---> Internet",
  39.         Source = "www.ntserver.com",
  40.         Destination = "any",
  41.         Rule-Action = Allow,
  42.  
  43.  
  44.  
  45. #-----------------------------------------------------------------------------#
  46. #                                          #
  47. #    SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE    #
  48. #                                                                             #
  49. #     Port and IP Address Redirection  to lan-PC with domestic IP address.    #
  50. #                                                                             #
  51. #-----------------------------------------------------------------------------#
  52.  
  53. PORTMAP-TELNET-IN    Rule-Status = Disabled,
  54.             Comment = "Map incoming Telnet to HTTP",
  55.             Source = "any",
  56.             Destination = "firewall.company.com",
  57.             Service = TELNET,
  58.             Rule-Action = Portmap,
  59.             Mapping-Dest-IP = "192.168.1.20",
  60.             Mapping-Dest-Port = WWW
  61.  
  62.  
  63. PORTMAP-TELNET-OUT    Rule-Status = Disabled,
  64.             Comment = "Map outgoing HTTP back to Telnet",
  65.             Source = "192.168.1.20",
  66.             Destination = "any",
  67.             Source-Port = WWW,
  68.             Rule-Action = Portmap,
  69.             Mapping-Dest-Port = TELNET
  70.  
  71.  
  72. #-----------------------------------------------------------------------------#
  73. #                                          #
  74. #    SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE    #
  75. #                                                                             #
  76. #                    Specifying a range of ports                              #
  77. #                                                                             #
  78. #     The samples in this section demonstrate the available options for       #
  79. #     matching a selection of ports, using a combination of pre-defined       #
  80. #     operators and actual port numbers (or resolvable service names).        #
  81. #                                                                             #
  82. #    Notice, when using NAT to provide services for internal LAN clients,     #
  83. #     ports above 10000 must generally be left open at the Firewall PC.       #
  84. #                                                                             #
  85. #-----------------------------------------------------------------------------#
  86.  
  87. PORT-RANGE    Rule-Status = Disabled,
  88.         Comment = "Deny 3 ports",
  89.         Source = "any",
  90.         Destination = "fx.dk",
  91.         Service-List = "ftp smtp pop3",
  92.         Rule-Action = Deny
  93.  
  94. PORT-RANGE    Rule-Status = Disabled,
  95.         Comment = "Deny ports below 10000",
  96.         Source = "any",
  97.         Destination = "fx.dk",
  98.         Service-List = "<10000",
  99.         Rule-Action = Deny
  100.  
  101. PORT-RANGE    Rule-Status = Disabled,
  102.         Comment = "Allow range of ports",
  103.         Source = "any",
  104.         Destination = "fx.dk",
  105.         Service-List = "23:80",
  106.         Rule-Action = Allow
  107.  
  108. MULTIPLE-RANGES    Rule-Status = Disabled,
  109.         Comment = "Allow multiple ranges of ports",
  110.         Source = "any",
  111.         Destination = "fx.dk",
  112.         Service-List = "ftp:telnet 57:67 150:999",
  113.         Rule-Action = Allow
  114.  
  115. DISABLE-ALL    Rule-Status = Disabled,
  116.         Comment = "Deny all ports, except 80",
  117.         Source = "any",
  118.         Destination = "fx.dk",
  119.         Service-List = "0:65535 -www-http",
  120.         Rule-Action = Deny
  121.  
  122. PORT-HOLE    Rule-Status = Disabled,
  123.         Comment = "Allow range of ports",
  124.         Source = "any",
  125.         Destination = "cyberspace.dk",
  126.         Service-List = ">1024 <4000 -3000:3500",
  127.         Rule-Action = Allow
  128.  
  129.  
  130. #-----------------------------------------------------------------------------#
  131. #                                          #
  132. #    SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE    #
  133. #                                                                             #
  134. #       Accounting for a lan with IP addresses in the 192.168.1.x segment     #
  135. #                                                                             #
  136. #-----------------------------------------------------------------------------#
  137.  
  138. ACCOUNT-IP-OUT        Rule-Status = Disabled,
  139.             Comment = "Accounting per Source-IP (outgoing)",
  140.             Source = "192.168.1.0",
  141.             Destination = "any",
  142.             Rule-Action = Account,
  143.                        Account-Control = Enabled,
  144.             Account-Type = Source-IP,
  145.             Account-File = "firewall\acc\ip-usage",
  146.  
  147. ACCOUNT-IP-IN        Rule-Status = Disabled,
  148.             Comment = "Accounting per Destination-IP (incoming)",
  149.             Destination = "192.168.1.0",
  150.                            Destination-Netmask = "255.255.255.0",
  151.             Source = "any",
  152.             Rule-Action = Account,
  153.                        Account-Control = Enabled,
  154.             Account-Type = Destination-IP,
  155.             Account-File = "firewall\acc\ip-usage"
  156.  
  157.  
  158. #-----------------------------------------------------------------------------#
  159. #                                          #
  160. #    SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE SAMPLE    #
  161. #                                                                             #
  162. #                  Logging all references to www.fx.dk                        #
  163. #                                                                             #
  164. #-----------------------------------------------------------------------------#
  165.  
  166. LOG-FX.DK        Rule-Status = Disabled,
  167.             Comment = "Log all references to fx.dk",
  168.             Source = "any",
  169.             Destination = "www.fx.dk",
  170.             Rule-Action = Log,
  171.             Log-Control = Enabled,
  172.             Log-File = "firewall\fx.dk",
  173.             Log-Mask = "rule date time msg prot source dest dump",
  174.  
  175.