From 2d355a4c1baadc761d6b12645d0274da8866f722 Mon Sep 17 00:00:00 2001
From: Tim Meusel <tim@bastelfreak.de>
Date: Mon, 18 Sep 2017 15:23:36 +0200
Subject: initial commit

---
 files/ferm.conf | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)
 create mode 100644 files/ferm.conf

(limited to 'files')

diff --git a/files/ferm.conf b/files/ferm.conf
new file mode 100644
index 0000000..27eea58
--- /dev/null
+++ b/files/ferm.conf
@@ -0,0 +1,38 @@
+# -*- shell-script -*-
+#
+# Ferm example script
+#
+# Firewall configuration for a workstation which accepts remote ssh login.
+#
+# Author: Max Kellermann <max@duempel.org>
+#
+
+table filter {
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        mod state state INVALID DROP;
+        mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local connections
+        interface lo ACCEPT;
+
+        # respond to ping
+        proto icmp icmp-type echo-request ACCEPT;
+
+        # allow SSH connections
+        proto tcp dport ssh ACCEPT;
+
+        # ident connections are also allowed
+        proto tcp dport auth ACCEPT;
+
+        # the rest is dropped by the above policy
+    }
+
+    # outgoing connections are not limited
+    chain OUTPUT policy ACCEPT;
+
+    # this is not a router
+    chain FORWARD policy DROP;
+}
-- 
cgit v1.2.3