interface definition: sanewall-interface

5
sanewall-interface

sanewall-interface

create an interface definition

        interface
        real-interface
        name
        rule-params

## Description

An `interface` definition creates a firewall for protecting the host on which the firewall is running.

The default policy is DROP, so that if no subcommands are given, the firewall will just drop all incoming and outgoing traffic using this interface.

The behaviour of the defined interface is controlled by adding subcommands (listed in if-see-also).

Forwarded traffic is never matched by the `interface` rules, even if it was originally destined for the firewall but was redirected using NAT. Any traffic to be passed through the firewall for whatever reason must be in a `router` (see def-router).

## Parameters

`real-interface`

- This is the interface name as shown by `ip link show`. Generally anything `iptables` accepts is valid.

  The + (plus sign) after some text will match all interfaces that start with this text.

  Multiple interfaces may be specified by enclosing them within quotes, delimited by spaces for example:

      interface "eth0 eth1 ppp0" myname

`name`

- This is a name for this interface. You should use short names (10 characters maximum) without spaces or other symbols.

  A name should be unique for all Sanewall interface and router definitions.

`rule-params`

- The set of rule parameters to further restrict the traffic that is matched to this interface.

  See rule-params for information on the parameters that can be used. Some examples:

      interface eth0 intranet src 192.0.2.0/24

      interface eth0 internet src not "${UNROUTABLE_IPS}"

  See sanewall.conf for an explanation of `${UNROUTABLE_IPS}`.

## See Also

- sanewall
- sanewall.conf
- def-router
- cmd-policy
- cmd-protection
- cmd-client
- cmd-server
- cmd-group
- helpcmd-iptables
- helpcmd-masquerade