optional rule parameters: sanewall-rule-params

5
sanewall-rule-params

sanewall-rule-params

sanewall-src

sanewall-dst

sanewall-srctype

sanewall-dsttype

sanewall-inface

sanewall-outface

sanewall-physin

sanewall-physout

sanewall-custom

sanewall-log

sanewall-loglimit

sanewall-proto

sanewall-uid

sanewall-gid

sanewall-mac-param

sanewall-mark-param

sanewall-tos-param

sanewall-dscp-param

optional rule parameters

Common

        src
        not
        host

        dst
        not
        host

        srctype
        not
        type

        dsttype
        not
        type

        proto
        not
        protocol

        mac
        not
        macaddr

        dscp
        not

           value
           class classid

        mark
        not
        id

        tos
        not
        id

        custom
        "iptables-options..."

Router Only

        inface
        not
        interface

        outface
        not
        interface

        physin
        not
        interface

        physout
        not
        interface

Interface Only

        uid
        not
        user

        gid
        not
        group

Logging

        log
        "log text"
        level loglevel

        loglimit
        "log text"
        level loglevel

## Description

Optional rule parameters are accepted by many commands to narrow the match they make. Not all parameters are accepted by all commands so you should check the individual commands for exclusions.

All matches are made against the REQUEST. Sanewall automatically sets up the necessary stateful rules to deal with replies in the reverse direction.

Use the option `not` to match any value other than the one(s) specified.

The logging parameters are unusual in that they do not affect the match, they just cause a log message to be emitted. Therefore, the logging parameters don't support the `not` option.

Sanewall is designed so that if you specify a parameter that is also used internally by the command then a warning will be issued (and the internal version will be used).

## Common

Use `src` and `dst` to define the source and destination IP addresses of the request respectively. `host` defines the IP or IPs to be matched. Examples:

    server smtp accept src not 192.0.2.1
    server smtp accept dst 198.51.100.1
    server smtp accept src not 192.0.2.1 dst 198.51.100.1

Use `srctype` or `dsttype` to define the source or destination IP address type of the request. `type` is the address type category as used in the kernel's network stack. It can be one of:

UNSPEC

- an unspecified address (i.e. 0.0.0.0)

UNICAST

- a unicast address

LOCAL

- a local address

BROADCAST

- a broadcast address

ANYCAST

- an anycast address

MULTICAST

- a multicast address

BLACKHOLE

- a blackhole address

UNREACHABLE

- an unreachable address

PROHIBIT

- a prohibited address

THROW

NAT

XRESOLVE

- undocumented

See `iptables(8)` or run `iptables -m addrtype --help` for more information. Examples:

    server smtp accept srctype not "UNREACHABLE PROHIBIT"

Use `proto` to match by protocol. The `protocol` can be any accepted by iptables(8).

Use `mac` to match by MAC address. The `macaddr` matches to the "remote" host. In an `interface`, "remote" always means the non-local host. In a `router`, "remote" refers to the source of requests for `server`s. It refers to the destination of requests for `client`s. Examples:

    # Only allow pop3 requests to the e6 host
    client pop3 accept mac 00:01:01:00:00:e6

    # Only allow hosts other than e7/e8 to access smtp
    server smtp accept mac not "00:01:01:00:00:e7 00:01:01:00:00:e8"

Use `dscp` to match the DSCP field on packets. For details on DSCP `value`s and `classid`s, see helpconf-dscp.

    server smtp accept dscp not "0x20 0x30"
    server smtp accept dscp not class "BE EF"

Use `mark` to match marks set on packets. For details on mark `id`s, see helpconf-mark.

    server smtp accept mark not "20 55"

Use `tos` to match the TOS field on packets. For details on TOS `id`s, see helpconf-tos.

    server smtp accept tos not "Maximize-Throughput 0x10"

Use `custom` to pass arguments directly to iptables(8). All of the parameters must be in a single quoted string. To pass an option to iptables(8) that itself contains a space you need to quote strings in the usual bash(1) manner. For example:

    server smtp accept custom "--some-option some-value"
    server smtp accept custom "--some-option 'some-value second-value'"

## Router Only

Use `inface` and `outface` to define the `interface` via which a request is received and forwarded respectively. Use the same format as def-interface. Examples:

    server smtp accept inface not eth0
    server smtp accept inface not "eth0 eth1"
    server smtp accept inface eth0 outface eth1

Use `physin` and `physout` to define the physical `interface` via which a request is received or send in cases where the inface or outface is known to be a virtual interface; e.g. a bridge. Use the same format as def-interface. Examples:

    server smtp accept physin not eth0

## Interface only

These parameters match information related to information gathered from the local host. They are silently ignored for incoming requests or requests that will be forwarded.

Use `uid` to match the operating system user sending the traffic. The `user` is a username, uid number or a quoted list of the two.

For example, to limit which users can access POP3 and IMAP:

    client "pop3 imap" accept user not "user1 user2 user3"

This will allow all requests to reach the server but prevent replies unless the web server is running as apache:

    server http accept user apache

Use `gid` to match the operating system group sending the traffic. The `group` is a group name, gid number or a quoted list of the two.

The Linux kernel infrastructure to match PID/SID and executable names with `pid`, `sid` and `cmd` has been removed so these options can no longer be used.

## Logging

Use `log` or `loglimit` to log matching packets to syslog. Unlike iptables(8) logging, this is not an action: Sanewall will produce multiple iptables commands to accomplish both the action for the rule and the logging.

Logging is controlled using the `SANEWALL_LOG_OPTIONS` and `SANEWALL_LOG_LEVEL` environment variables (see sanewall-variables). `loglimit` additionally honours the `SANEWALL_LOG_FREQUENCY` and `SANEWALL_LOG_BURST` variables.

Specifying `level` (which takes the same values as `SANEWALL_LOG_LEVEL`) allows you to override the log level for a single rule.

## Internal use

In addition to the commands in the synopsis, Sanewall provides `limit`, `sport` and `dport` which are used internally. These should not normally be used in configuration files unless you really understand what you are doing.

`limit` requires the arguments `frequency` and `burst` and will limit the matching of traffic in both directions.

`sport` requires an argument `port` which can be a name, number, range (FROM:TO) or a quoted list of ports. It specifies the source port of a request.

`dport` requires an argument `port` which can be a name, number, range (FROM:TO) or a quoted list of ports. It specifies the destination port of a request.

## See Also

- sanewall
- sanewall.conf
- cmd-client
- cmd-server
- def-interface
- def-router
- helpconf-mark
- helpconf-tos
- helpconf-dscp
- sanewall-variables
- administration tool for IPv4 firewalls: iptables(8)