# $Id: firefly.example.cfg 56 2005-02-16 15:00:57Z  $
# Configuration file for filefly (8)
# Copyright 2003, 2004 Stefano Rivera

version = 1.0.11

# Programs:
iptables = /sbin/iptables
ip = /bin/ip
sysctl = /sbin/sysctl
tc = /sbin/tc

# Interfaces
intIf = eth0
extIf = ippp0
extNet = 0.0.0.0/0
inBW = 60kbit
outBW = 60kbit
intBW = 100mbit

# QOS
sfqPerturb = 10

# Enable NAT
NAT = True

# Logging
logDrops = False
logRejects = False
uncleanRate = 15/minute

[qos-out]
Limit 20kbit Ceiling 20kbit Prio 0 TOS Minimize-Delay SFQ:
  icmp/*
  tos/Minimize-Delay
  udp/domain
  tcp/domain
  tcp/ssh
  tcp/ftp
  tcp/telnet
  tcp/cddbp

Limit 50kbit Ceiling * Prio 1 TOS Minimize-Delay SFQ:
  tcp/vnc-0
  udp/2700:3000
  udp/wolfenstein
  udp/wolfenstein-1
  udp/wolfenstein-2
  udp/wolfenstein-3

Limit 20kbit Ceiling * Prio 2 TOS Maximize-Throughput SFQ:
  tos/Maximize-Throughput
  tcp/http
  tcp/https
  tcp/ftp-data

Limit 10kbit Ceiling * Prio 3 TOS Minimize-Cost SFQ:
  tos/Minimize-Cost
  tcp/smtp
  tcp/pop3
  tcp/pop3s
  tcp/imap
  tcp/imaps
  tcp/proxyper
  tcp/proxyper-test

Limit 10kbit Ceiling 50kbit Prio 4 TOS Minimize-Cost SFQ:
  */*

[qos-in]
Limit 20kbit Ceiling 20kbit Prio 0 TOS Minimize-Delay SFQ:
  icmp/*
  tos/Minimize-Delay
  udp/domain
  tcp/domain
  tcp/ssh
  tcp/ftp
  tcp/telnet
  tcp/cddbp

Limit 50kbit Ceiling * Prio 1 TOS Minimize-Delay SFQ:
  tcp/vnc-0
  udp/2700:3000
  udp/wolfenstein
  udp/wolfenstein-1
  udp/wolfenstein-2
  udp/wolfenstein-3

Limit 20kbit Ceiling * Prio 2 TOS Maximize-Throughput SFQ:
  tos/Maximize-Throughput
  tcp/http
  tcp/https
  tcp/ftp-data

Limit 10kbit Ceiling * Prio 3 TOS Minimize-Cost SFQ:
  tos/Minimize-Cost
  tcp/smtp
  tcp/pop3
  tcp/pop3s
  tcp/imap
  tcp/imaps
  tcp/proxyper
  tcp/proxyper-test

Limit 10kbit Ceiling 50kbit Prio 4 TOS Minimize-Cost SFQ:
  */*

[from-int]
blockReservedIPs = False
logUnclean = True

Accept:
  */*

[to-int]
blockReservedIPs = False
logUnclean = True

Accept:
  icmp/*
  udp/domain
  state/ESTABLISHED
  state/RELATED
  tcp/telnet
  tcp/exec
  tcp/ssh
  tcp/smtp
  tcp/time
  tcp/daytime
  tcp/finger
  tcp/http
  tcp/ftp
  tcp/ftp-data
  tcp/ident
  tcp/ipp
  tcp/netbios-ssn
  tcp/imap2
  tcp/imaps
  tcp/pop3
  tcp/pop3s
  tcp/ldap
  tcp/ldaps
  tcp/https
  tcp/swat
  tcp/webmin
  tcp/squid
  tcp/mysql
  tcp/proxyper
  tcp/proxyper-test
  tcp/x11
  tcp/xfs
  tcp/xfs-xtt
  tcp/vnc-1
  tcp/hylafax
  tcp/jabber
  tcp/jabber-ssl
  tcp/cvspserver
  tcp/shoutcast
  tcp/shoutcast1
  tcp/icecast
  tcp/icecast1
  udp/bootps
  udp/ntp
  udp/ipp
  udp/netbios-ns
  udp/netbios-dgm
  udp/xdmcp
  udp/icecast
  udp/snmp

Reject:
  tcp/microsoft-ds # Not yet running Samba 3
  */*

[to-ext]
blockReservedIPs = False
logUnclean = True

Accept:
  icmp/*
  udp/domain
  state/ESTABLISHED
  state/RELATED
  tcp/ftp-data
  tcp/ftp
  tcp/telnet
  tcp/ssh
  tcp/smtp
  tcp/time
  tcp/domain
  tcp/gopher
  tcp/finger
  tcp/whois
  tcp/http
  tcp/81
  tcp/https
  tcp/pop3
  tcp/pop3s
  tcp/auth
  tcp/uucp-path
  tcp/nntp
  tcp/imap
  tcp/imaps
  tcp/squid
  tcp/webcache
  tcp/tproxy
  tcp/proxyper
  tcp/proxyper-test
  tcp/vnc-0
  tcp/8000
  tcp/bittorrent-track
  tcp/bittorrent-track1
  tcp/bittorrent-1
  tcp/bittorrent-2
  tcp/bittorrent-3
  tcp/bittorrent-4
  tcp/bittorrent-5
  tcp/bittorrent-6
  tcp/bittorrent-7
  tcp/bittorrent-8
  tcp/bittorrent-9
  tcp/pgpkeyserv
  tcp/systats
  udp/gopher
  udp/ntp

Reject:
  */*

[from-ext]
blockReservedIPs = False
logUnclean = True

Accept:
  udp/domain

Reject with tcp-reset:
  tcp/ident

Accept:
  state/ESTABLISHED
  state/RELATED

Accept:
  icmp/echo-reply
  icmp/destination-unreachable
  icmp/time-exceeded

Drop:
  */*

[forward-in]
blockReservedIPs = False
logUnclean = True

Accept:
  state/ESTABLISHED
  state/RELATED
  icmp/echo-reply
  icmp/destination-unreachable
  icmp/time-exceeded

DNAT to sr.owlsbarn.rivera.za.net:
  tcp/6881:6889
  tcp/dc
  tcp/edonkey
  tcp/fasttrack
  tcp/gnutella-svc
  tcp/gnutella-rtr
  tcp/napster
  tcp/overnet
  tcp/soulseek
  udp/dc
  udp/edonkey
  udp/fasttrack
  udp/gnutella-svc
  udp/gnutella-rtr
  udp/overnet
  udp/soulseek

Drop:
  */*

[forward-out]
blockReservedIPs = False
logUnclean = True

Accept:
  icmp/*
  udp/domain
  udp/2700:3000 # Wolf  ET
  udp/wolfenstein
  udp/wolfenstein-1
  udp/wolfenstein-2
  udp/wolfenstein-3
  udp/gopher
  udp/ntp
  udp/realplayer-1
  udp/realplayer-2
  udp/rtsp
  udp/irc
  udp/dc
  udp/edonkey
  udp/fasttrack
  udp/gnutella-svc
  udp/gnutella-rtr
  udp/overnet
  udp/soulseek
  state/ESTABLISHED
  state/RELATED
  tcp/ftp-data
  tcp/ftp
  tcp/telnet
  tcp/ssh
  tcp/smtp
  tcp/time
  tcp/domain
  tcp/gopher
  tcp/finger
  tcp/ircd
  tcp/http
  tcp/https
  tcp/8000
  tcp/pop3
  tcp/auth
  tcp/uucp-path
  tcp/uucp
  tcp/nntp
  tcp/ntp
  tcp/imap
  tcp/squid
  tcp/webcache
  tcp/tproxy
  tcp/acdsee-intouch
  tcp/vnc-0
  tcp/cddbp
  tcp/bittorrent-track
  tcp/bittorrent-track1
  tcp/bittorrent-1
  tcp/bittorrent-2
  tcp/bittorrent-3
  tcp/bittorrent-4
  tcp/bittorrent-5
  tcp/bittorrent-6
  tcp/bittorrent-7
  tcp/bittorrent-8
  tcp/bittorrent-9
  tcp/msn-chat
  tcp/rtsp
  tcp/dc
  tcp/edonkey
  tcp/edonkey-1
  tcp/fasttrack
  tcp/gnutella-svc
  tcp/gnutella-rtr
  tcp/napster
  tcp/napster-s-1
  tcp/napster-s-2
  tcp/napster-s-3
  tcp/napster-s-4
  tcp/napster-s-5
  tcp/overnet
  tcp/soulseek
  tcp/topcoder
  tcp/411
  tcp/pgpkeyserv
  tcp/systats

Accept source:
  udp/wolfenstein
  udp/wolfenstein-1
  udp/wolfenstein-2
  udp/wolfenstein-3
  tcp/bittorrent-1
  tcp/bittorrent-2
  tcp/bittorrent-3
  tcp/bittorrent-4
  tcp/bittorrent-5
  tcp/bittorrent-6
  tcp/bittorrent-7
  tcp/bittorrent-8
  tcp/bittorrent-9

Reject:
  */*
