diff options
Diffstat (limited to 'fw/lib/example.ndb')
| -rw-r--r-- | fw/lib/example.ndb | 42 |
1 files changed, 42 insertions, 0 deletions
diff --git a/fw/lib/example.ndb b/fw/lib/example.ndb new file mode 100644 index 0000000..60f5119 --- /dev/null +++ b/fw/lib/example.ndb @@ -0,0 +1,42 @@ +# +# every attribute fw understands. an attribute that is absent does +# not constrain, so there is never a "*" to write; it is accepted, but +# leaving the attribute out says the same thing more quietly. +# +# allow=<dir> the rule permits. dir is in, out or * +# deny=<dir> the rule refuses +# proto=<name> a protocol: tcp, udp, icmp, ... +# port=<n> the port at the far end +# lport=<n> the port at this end +# ip=<addr> the address at the far end, optionally with a /mask +# ipmask=<mask> the mask, if you would rather write it separately +# +# in and out are directions, not layers: the same rule means the same +# thing whether fw is matching it against a packet on a wire or against +# a connection a program asked for. connect and announce are accepted +# as older spellings of out and in. +# +# rules are matched top to bottom and the first one that matches wins. +# nothing matching means deny, so a file with no rules permits nothing. +# + +# deny before allow, since the first match wins +deny=out ip=1.1.1.1 +deny=out ip=8.8.8.8 + +# the two spellings of a masked address are the same rule +allow=out ip=10.0.2.0/24 +allow=out ip=192.168.0.0 ipmask=/16 + +# v6 needs no distinguishing: it is the same attribute +allow=out ip=2001:db8::/32 + +# an entry may also be spread over indented continuation lines +allow=out + proto=tcp + port=443 + +# answer on one port, but never call out on it. lport is our end, so +# this is the port we serve; port would be the caller's, which we do not +# get to know until they call. +allow=in proto=tcp lport=17019 |