https://github.com/nlm/firval
a netfilter firewall rules generator designed to be easier to read, write and maintain
https://github.com/nlm/firval
Last synced: 12 months ago
JSON representation
a netfilter firewall rules generator designed to be easier to read, write and maintain
- Host: GitHub
- URL: https://github.com/nlm/firval
- Owner: nlm
- License: mit
- Created: 2014-06-07T15:03:32.000Z (about 12 years ago)
- Default Branch: master
- Last Pushed: 2015-12-03T10:32:48.000Z (over 10 years ago)
- Last Synced: 2024-11-08T02:20:13.813Z (over 1 year ago)
- Language: Python
- Homepage:
- Size: 139 KB
- Stars: 4
- Watchers: 3
- Forks: 0
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
firval
======
a netfilter firewall rules generator designed to be easier to read, write and maintain
Install
=======
git clone https://github.com/nlm/firval
pip install ./firval
How to use
==========
Write a yaml configuration file and feed it to firval.py,
it will produce a iptables-restore compatible rule file
it means you can do this:
cat rules.yaml | firval | iptables-restore
Configuration syntax
====================
interfaces:
IFNAME: PHYSICALINTERFACE
addresses:
ADDRNAME: HOSTADDR | NETADDR
ports:
PORTNAME: PORTNUMBER
chains:
filter|nat|mangle:
CHAINNAME:
- RULE
- ...
services:
SERVICENAME:
proto: tcp | udp | icmp
port: PORT-NUMBER(,PORT-NUMBER)* (only for tcp or udp)
type: ICMP-TYPE (only for icmp)
rulesets:
IFNAME-to-IFNAME:
filter|nat|mangle:
input|forward|output|...: (availability depends if in 'filter', 'nat' or 'mangle')
- RULE
- ...
RULE = ((accept|reject|drop|masquerade|log|nflog)
((not)? from ADDRNAME ((not)? port PORTNAME)?)?
((not)? to ADDRNAME ((not)? port PORTNAME)?)?
((not)? proto (tcp|udp|icmp|any))?
(service SERVICENAME)?
(state (new|established|invalid))?
(limit INTEGER/TIMEUNIT (burst INTEGER)?)?
(comment "COMMENT")?
(prefix "LOG_PREFIX"))
| (jump CHAINNAME)