firefly.cfg(5)

NAME
firefly.cfg - The configuration file for firefly(8).

SYNOPSIS
firefly.cfg is the configuration file for firefly(8), the firewall table and QoS tree generator.

FILE FORMAT
firefly.cfg is in a Win32 .ini style format. It is divided into sections headed by a name in square brackets, i.e.

[from-int]

Each section (and the area before the first section) can contain parameters. Parameters defined before the opening of the first section are global parameters. They affect the running of the whole program. Parameters in sections only affect their section.

The file can contain extra leading and/or trailing whitespace.

Comments are escaped with a leading `#', and can appear on their own lines or following data.

SECTIONS
firefly.cfg can (and must) contain the following sections. The first 6 are for firewalling, and they can contain firewall chains. They affect the following flows of packets:

[from-int]
    internal-network -> me

[to-int]
    me -> internal-network

[from-ext]
    external-network -> me

[to-ext]
    me -> external-network

[forward-in]
    external-network -> internal-network

[forward-out]
    internal-network -> external-network

The last 2 are for QoS and contain QoS chains. They load egress qdiscs (classful HTB) in order to control the following flows of packets:

[qos-in]
    external-network -> internal-network

[qos-out]
    internal-network and me -> external-network

PARAMETERS
Parameters are defined in sections (or, for global parameters, above the first section) in the form

name = value

Parameter's names are case insensitive. Boolean values can be given in the style of Yes/No or True/False (case-insensitive). Bandwidth values can use any unit recognized by tc(8).

The following parameters can appear in the global pre-section:

version
    If this is set, the configuration file will only be able to be read by a copy of firefly(8) of the same major and minor version (revision/patch levels can change)

nat If this is set to True then firefly(8) will enable NAT (Network Address Translation) for packets forwarded across the machine. (Default: False)

intIf
    The name of the internal interface (Default: eth0)

extIf
    The name of the external interface (Default: ppp0)

extNet
    The address of the external network (Default: 0.0.0.0/0)

inBW
    The maximum incoming bandwidth from the external network (Default: 56kbit)

outBW
    The maximum outgoing bandwidth to the external network (Default: 48kbit)

intBW
    The maximum bandwidth of the internal network (Default: 100mbit)

sfqPerturb
    The perturb value for the SFQ qdisc. See tc-sfq(8) for more details. (Default: 10)

logDrops
    If set to True, log all dropped packets. (Default: False)

logRejects
    If set to True, log all rejected packets. (Default: False)

uncleanRate
    Set the maximum number of unclean packets to be logged (Default: 15/minute)

ip  Set the location of the ip(8) executable (from the iproute2 package) (Default: /bin/ip)

iptables
    Set the location of the iptables(8) executable (from the iptables package) (Default: /sbin/iptables)

sysctl
    Set the location of the sysctl(8) executable (from the procps package) (Default: /sbin/sysctl)

tc  Set the location of the tc(8) executable (from the iproute2 package) (Default: /sbin/tc)

The following parameters may appear in firewall sections:

blockreservedips
    If this is set to True then any packet from/to a reserved IP address range will be dropped. (Default: False)

logunclean
    If this is set to True then any packet that is malformed or matches the iptables(8) unclean rule for any other reason will be logged. They will be given the prefix `Unclean:' (Default: False)

FIREWALL CHAINS
The firewall sections of the firewall can contain firewall chains. Firewall chains are initiated with a line containing the action of the chain followed by a colon. The Syntax is

Accept:|Drop:|Queue:|Reject[ with reject-option ]:|Dnat to destination:

The actions have the following effects.

Accept:
    Accept all matched packets.

Drop:
    Drop all matched packets.

Queue:
    Pass all matched packets to userspace queueing.

Reject[ with reject-option]:
    Reject all matched packets. If the optional with reject-option section is given, the packet will be dropped with that option. See iptables(8) for a list of reject-options.

Dnat to destination:
    Redirect all matched packets to destination.

The chain itself consists of one or more rules to match the chain in the form

protocol/port

The asterisk (*) can be used as a wild-card for protocol and/or port.

The protocol can be one of the standard protocols (tcp, udp, or icmp) or an iptables(8) meta-protocol (mac, mark, state, tos, ah, esp, length, ttl, or unclean)

The port can be one of: a numeric port number for the given protocol, a name (as defined in services(5)), a numeric port range (i.e. tcp/1024:65535), or a meta-protocol port (i.e. state/ESTABLISHED).

The chain ends when a new chain or section starts or EOF.

QOS CHAINS
Chains in QoS sections are identical to firewall chains except for the intial line.

QoS Chains headers conform to the syntax:

Limit limit-bandwidth Ceiling ceiling-bandwidth Prio priority [TOS tos-type] [SFQ]:

Limit limit-bandwidth
    Set the throughput limit to limit-bandwidth. Can be wild (*) to indicate the defined maximum bandwidth.

Ceiling ceiling-bandwidth
    Set the throughput ceiling to ceiling-bandwidth. Can also be wild to indicate maximum bandwidth.

Prio priority
    Set the priority of the chain to priority.

TOS tos-type
    If specified, set the TOS (Type of service) flag of all matching packets to tos-type.

SFQ If specified, use SFQ qdiscs.

EXAMPLE
For an example, see the firefly.cfg file in the distribution tarball.

VERSION
This man-page is correct for Version 1.x of firefly(8).

AUTHOR
Stefano Rivera <scripts `at' rivera `dot' za `dot' net>

http://www.rivera.za.net/software/scripts

SEE ALSO
firefly(8), iptables(8), tc(8), tc-htb(8), tc-sfq(8)