From 3d1cf84f39fece3f2a9f8b7247a792212eb81177 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Sat, 8 Jan 2022 15:50:26 -0300
Subject: Feat: major refactor

---
 files/ferm/ferm.conf.tpc | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 files/ferm/ferm.conf.tpc

(limited to 'files')

diff --git a/files/ferm/ferm.conf.tpc b/files/ferm/ferm.conf.tpc
new file mode 100644
index 0000000..8a1017e
--- /dev/null
+++ b/files/ferm/ferm.conf.tpc
@@ -0,0 +1,33 @@
+# Firewall configuration for a TPC
+# Inspired by http://ferm.foo-projects.org/download/examples/workstation.ferm
+# File managed by puppet
+
+table filter {
+    chain INPUT {
+        policy DROP;
+
+        # connection tracking
+        #mod state state INVALID DROP;
+        #mod state state (ESTABLISHED RELATED) ACCEPT;
+
+        # allow local connections
+        interface lo ACCEPT;
+
+        # respond to ping
+        #proto icmp icmp-type echo-request ACCEPT;
+
+        # allow SSH connections
+        #proto tcp dport ssh ACCEPT;
+
+        # ident connections are also allowed
+        #proto tcp dport auth ACCEPT;
+
+        # the rest is dropped by the above policy
+    }
+
+    # outgoing connections are not limited
+    chain OUTPUT policy ACCEPT;
+
+    # this is not a router
+    chain FORWARD policy DROP;
+}
-- 
cgit v1.2.3