1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
|
#
# Bindle Binaries Linux Firewall
# Copyright (c) 2019 David M. Syzdek <david@syzdek.net>.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
# met:
#
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
# * Neither the name of David M. Syzdek nor the
# names of its contributors may be used to endorse or promote products
# derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
# IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID M. SYZDEK BE LIABLE FOR
# ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
# CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
# SUCH DAMAGE.
# The `firewall_dir` option overrides the default directory used to store
# firewall rules, ipset files, and pre/post hooks. Uncomment the line below
# to change the default location of the firewall rules.
# firewall_dir = @sysconfdir@/firewall.d
# The `quiet` option surpresses normal output of bbfw. To enable quiet mode,
# uncomment the line below and change the value to 'yes'.
# quiet = no
# The `verbose` option enables verbose output for utilities which support
# verbose flags (currently only iptables). To enable verbose output,
# uncomment the line below and change the value to 'yes'.
# verbose = yes
# Options which specify order of executions or loading of rules use the
# following keywords:
#
# global - files within %{firewall_dir}/global.d/
# apps - files within %{firewall_dir}/apps.d/%{app}/
# cluster - files within %{firewall_dir}/cluster.d/
# local - files within %{firewall_dir}/
#
# Types of files are always processed in the following order:
#
# pre-hooks (start and stop)
# ipsets load (start only)
# iptables load (start only)
# iptables flush (stop only / not user definable)
# ipsets flush (stop only / not user definable)
# post-hooks (start and stop)
#
# The `order_prehook` option defines the order in which pre-hooks are
# executed. To modify the order in which pre-hooks are executed, uncomment
# the line below and modify the order of the key words. See above for
# keyword descriptions.
# order_prehook = global apps cluster local
# The `order_posthook` option defines the order in which post-hooks are
# executed. To modify the order in which post-hooks are executed, uncomment
# the line below and modify the order of the key words. See above for
# keyword descriptions.
# order_posthook = global apps cluster local
# The `order_ipsets` option defines the order in which ipsets are
# loaded. To modify the order in which ipsets are loaded, uncomment
# the line below and modify the order of the key words. See above for
# keyword descriptions.
# order_ipsets = global apps cluster local
# The `order_iptables` option defines the order in which iptables
# and ip6tables are loaded. To modify the order in which rules are loaded,
# uncomment the line below and modify the order of the key words. See above
# for keyword descriptions.
# order_iptables = apps local cluster global
# end of configuration
|
