files/ferm/ferm.conf.tpc


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

# Firewall configuration for a TPC
# Inspired by http://ferm.foo-projects.org/download/examples/workstation.ferm
# File managed by puppet

table filter {
    chain INPUT {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        # allow local connections
        interface lo ACCEPT;

        # respond to ping
        #proto icmp icmp-type echo-request ACCEPT;

        # allow SSH connections
        #proto tcp dport ssh ACCEPT;

        # ident connections are also allowed
        #proto tcp dport auth ACCEPT;

        # the rest is dropped by the above policy
    }

    # outgoing connections are not limited
    chain OUTPUT policy ACCEPT;

    # this is not a router
    chain FORWARD policy DROP;
}