# Firefly

The firewall and QOS script

Stefano Rivera
2003 Stefano Rivera
v1.0, 19 Nov 2003

## About Firefly

I wanted an all-in-one dial-up firewall and QOS script. It had load quickly whenever I went online, and also be nice and easy to configure. By configure, I also mean that it should handle port forwarding and other features of iptables easily. At that time, there was no firewall script around that could do that (and I still know of none), so I hacked up a bash script. This was a mess to maintain, so when I had some time (a year later), I rewrote it in Python.

To get the quick loading I wanted, it had to make efficient use of tables. To get these speed features without too much code bloat, I had to bias the script strongly towards my style of network (no DMZ & one router PC).

## Configuration File

The configuration file is in a style similar to old Windows™ `.ini` files (as is common with Python configuration files).

### Syntax

First things first, lines (or parts of lines) are commented out with '#' (as in bash scripts and Python).

The file is divided into sections (corrosponding to tables in the firewall), with a default section at the top (not marked with a [default] as in normal Python config. files). Sections are headed with their name in square brackets. There are only 6 sections defined:

Defined Sections

from-int

  Internal network → firewall machine.

from-ext

  External Network → firewall machine.

forward-out

  Internal Network → External Network.

forward-in

  External Network → Internal Network.

qos-in

  QOS on Internal Interface.

qos-out

  QOS on External Interface.

Inside the sections, one can have parameters and chains. Parameters are set using '=' (with or without surrounding spaces). Only parameters are allowed in the default section. Chains are started using the action followed by a ':'. Each port (or iptables module & option) to apply is in the format 'protocol/port'.

QOS Sections have special chains, in the format

    Limit speed Ceiling ceiling Prio priority TOS TOS to set all packets to SFQ:

Both the speed and ceiling parameters can be set to '*' to use the maximum speed.

Here is an example configuration file, showing all the features:

Configuration File

    # Globally set the program paths
    iptables = /sbin/iptables
    ifconfig = /sbin/ifconfig

    # other default section parameters...

    [from-int]
    blockReservedIPs = False
    logUnclean = True

    Accept:
      */*

    [to-int]
    blockReservedIPs = False
    logUnclean = True

    Accept:
      icmp/*
      udp/domain
      state/ESTABLISHED
      state/RELATED
      tcp/http
      # etc...

    Reject with tcp-reset:
      tcp/ident

    Reject:
      */*

    [qos-out]
    Limit 20kbit Ceiling 20kbit Prio 0 TOS Minimize-Delay SFQ:
      icmp/*
      tos/Minimize-Delay
      udp/domain

    Limit 50kbit Ceiling * Prio 1 TOS Minimize-Delay SFQ:
      tcp/vnc-0

    # etc...

    [forward-in]
    # Peer to peer protocols
    DNAT to sr.owlsbarn.rivera.za.net:
      tcp/6881:6889
      tcp/dc
      tcp/edonkey
      # etc.

    Accept:
      */*

    # etc...