<?xml version="1.0"?> <interfaceDefinition> <node name="firewall" owner="${vyos_conf_scripts_dir}/firewall.py"> <properties> <priority>199</priority> <help>Firewall</help> </properties> <children> <leafNode name="all-ping"> <properties> <help>Policy for handling of all IPv4 ICMP echo requests</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable processing of all IPv4 ICMP echo requests</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable processing of all IPv4 ICMP echo requests</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>enable</defaultValue> </leafNode> <leafNode name="broadcast-ping"> <properties> <help>Policy for handling broadcast IPv4 ICMP echo and timestamp requests</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable processing of broadcast IPv4 ICMP echo/timestamp requests</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable processing of broadcast IPv4 ICMP echo/timestamp requests</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>disable</defaultValue> </leafNode> <leafNode name="config-trap"> <properties> <help>SNMP trap generation on firewall configuration changes</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable sending SNMP trap on firewall configuration change</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable sending SNMP trap on firewall configuration change</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>disable</defaultValue> </leafNode> <node name="group"> <properties> <help>Firewall group</help> </properties> <children> <tagNode name="address-group"> <properties> <help>Firewall address-group</help> <constraint> <regex>[a-zA-Z0-9][\w\-\.]*</regex> </constraint> </properties> <children> <leafNode name="address"> <properties> <help>Address-group member</help> <valueHelp> <format>ipv4</format> <description>IPv4 address to match</description> </valueHelp> <valueHelp> <format>ipv4range</format> <description>IPv4 range to match (e.g. 10.0.0.1-10.0.0.200)</description> </valueHelp> <constraint> <validator name="ipv4-address"/> <validator name="ipv4-range"/> </constraint> <multi/> </properties> </leafNode> <leafNode name="include"> <properties> <help>Include another address-group</help> <completionHelp> <path>firewall group address-group</path> </completionHelp> <multi/> </properties> </leafNode> #include <include/generic-description.xml.i> </children> </tagNode> <tagNode name="domain-group"> <properties> <help>Firewall domain-group</help> <constraint> <regex>[a-zA-Z_][a-zA-Z0-9][\w\-\.]*</regex> </constraint> <constraintErrorMessage>Name of domain-group can only contain alpha-numeric letters, hyphen, underscores and not start with numeric</constraintErrorMessage> </properties> <children> <leafNode name="address"> <properties> <help>Domain-group member</help> <valueHelp> <format>txt</format> <description>Domain address to match</description> </valueHelp> <constraint> <regex>[a-z0-9]+([\-\.]{1}[a-z0-9]+)*\.[a-z]{2,99}?(\/.*)?</regex> </constraint> <multi/> </properties> </leafNode> #include <include/generic-description.xml.i> </children> </tagNode> <tagNode name="ipv6-address-group"> <properties> <help>Firewall ipv6-address-group</help> <constraint> <regex>[a-zA-Z0-9][\w\-\.]*</regex> </constraint> </properties> <children> <leafNode name="address"> <properties> <help>Address-group member</help> <valueHelp> <format>ipv6</format> <description>IPv6 address to match</description> </valueHelp> <valueHelp> <format>ipv6range</format> <description>IPv6 range to match (e.g. 2002::1-2002::ff)</description> </valueHelp> <constraint> <validator name="ipv6-address"/> <validator name="ipv6-range"/> </constraint> <multi/> </properties> </leafNode> <leafNode name="include"> <properties> <help>Include another ipv6-address-group</help> <completionHelp> <path>firewall group ipv6-address-group</path> </completionHelp> <multi/> </properties> </leafNode> #include <include/generic-description.xml.i> </children> </tagNode> <tagNode name="ipv6-network-group"> <properties> <help>Firewall ipv6-network-group</help> <constraint> <regex>[a-zA-Z0-9][\w\-\.]*</regex> </constraint> </properties> <children> #include <include/generic-description.xml.i> <leafNode name="network"> <properties> <help>Network-group member</help> <valueHelp> <format>ipv6net</format> <description>IPv6 address to match</description> </valueHelp> <constraint> <validator name="ipv6-prefix"/> </constraint> <multi/> </properties> </leafNode> <leafNode name="include"> <properties> <help>Include another ipv6-network-group</help> <completionHelp> <path>firewall group ipv6-network-group</path> </completionHelp> <multi/> </properties> </leafNode> </children> </tagNode> <tagNode name="mac-group"> <properties> <help>Firewall mac-group</help> <constraint> <regex>[a-zA-Z0-9][\w\-\.]*</regex> </constraint> </properties> <children> #include <include/generic-description.xml.i> <leafNode name="mac-address"> <properties> <help>Mac-group member</help> <valueHelp> <format><MAC address></format> <description>MAC address to match</description> </valueHelp> <constraint> <validator name="mac-address"/> </constraint> <multi/> </properties> </leafNode> <leafNode name="include"> <properties> <help>Include another mac-group</help> <completionHelp> <path>firewall group mac-group</path> </completionHelp> <multi/> </properties> </leafNode> </children> </tagNode> <tagNode name="network-group"> <properties> <help>Firewall network-group</help> <constraint> <regex>[a-zA-Z0-9][\w\-\.]*</regex> </constraint> </properties> <children> #include <include/generic-description.xml.i> <leafNode name="network"> <properties> <help>Network-group member</help> <valueHelp> <format>ipv4net</format> <description>IPv4 Subnet to match</description> </valueHelp> <constraint> <validator name="ipv4-prefix"/> </constraint> <multi/> </properties> </leafNode> <leafNode name="include"> <properties> <help>Include another network-group</help> <completionHelp> <path>firewall group network-group</path> </completionHelp> <multi/> </properties> </leafNode> </children> </tagNode> <tagNode name="port-group"> <properties> <help>Firewall port-group</help> <constraint> <regex>[a-zA-Z0-9][\w\-\.]*</regex> </constraint> </properties> <children> #include <include/generic-description.xml.i> <leafNode name="port"> <properties> <help>Port-group member</help> <valueHelp> <format>txt</format> <description>Named port (any name in /etc/services, e.g., http)</description> </valueHelp> <valueHelp> <format>u32:1-65535</format> <description>Numbered port</description> </valueHelp> <valueHelp> <format>start-end</format> <description>Numbered port range (e.g. 1001-1050)</description> </valueHelp> <multi/> <constraint> <validator name="port-range"/> </constraint> </properties> </leafNode> <leafNode name="include"> <properties> <help>Include another port-group</help> <completionHelp> <path>firewall group port-group</path> </completionHelp> <multi/> </properties> </leafNode> </children> </tagNode> </children> </node> <leafNode name="ip-src-route"> <properties> <help>Policy for handling IPv4 packets with source route option</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable processing of IPv4 packets with source route option</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable processing of IPv4 packets with source route option</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>disable</defaultValue> </leafNode> <tagNode name="ipv6-name"> <properties> <help>IPv6 firewall rule-set name</help> <constraint> <regex>[a-zA-Z0-9][\w\-\.]*</regex> </constraint> </properties> <children> #include <include/firewall/name-default-action.xml.i> #include <include/firewall/name-default-log.xml.i> #include <include/generic-description.xml.i> <tagNode name="rule"> <properties> <help>Firewall rule number (IPv6)</help> <valueHelp> <format>u32:1-999999</format> <description>Number for this Firewall rule</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 1-999999"/> </constraint> <constraintErrorMessage>Firewall rule number must be between 1 and 999999</constraintErrorMessage> </properties> <children> #include <include/firewall/action.xml.i> #include <include/generic-description.xml.i> <node name="destination"> <properties> <help>Destination parameters</help> </properties> <children> #include <include/firewall/address-ipv6.xml.i> #include <include/firewall/geoip.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> #include <include/firewall/port.xml.i> </children> </node> <node name="source"> <properties> <help>Source parameters</help> </properties> <children> #include <include/firewall/address-ipv6.xml.i> #include <include/firewall/geoip.xml.i> #include <include/firewall/source-destination-group-ipv6.xml.i> #include <include/firewall/port.xml.i> </children> </node> #include <include/firewall/common-rule.xml.i> <node name="hop-limit"> <properties> <help>Hop Limit</help> </properties> <children> <leafNode name="eq"> <properties> <help>Value to match a hop limit equal to it</help> <valueHelp> <format>u32:0-255</format> <description>Hop limit equal to value</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> </constraint> </properties> </leafNode> <leafNode name="gt"> <properties> <help>Value to match a hop limit greater than or equal to it</help> <valueHelp> <format>u32:0-255</format> <description>Hop limit greater than value</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> </constraint> </properties> </leafNode> <leafNode name="lt"> <properties> <help>Value to match a hop limit less than or equal to it</help> <valueHelp> <format>u32:0-255</format> <description>Hop limit less than value</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> </constraint> </properties> </leafNode> </children> </node> <node name="icmpv6"> <properties> <help>ICMPv6 type and code information</help> </properties> <children> <leafNode name="code"> <properties> <help>ICMPv6 code (0-255)</help> <valueHelp> <format>u32:0-255</format> <description>ICMPv6 code (0-255)</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> </constraint> </properties> </leafNode> <leafNode name="type"> <properties> <help>ICMPv6 type (0-255)</help> <valueHelp> <format>u32:0-255</format> <description>ICMPv6 type (0-255)</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> </constraint> </properties> </leafNode> #include <include/firewall/icmpv6-type-name.xml.i> </children> </node> </children> </tagNode> </children> </tagNode> <leafNode name="ipv6-receive-redirects"> <properties> <help>Policy for handling received ICMPv6 redirect messages</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable processing of received ICMPv6 redirect messages</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable processing of received ICMPv6 redirect messages</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>disable</defaultValue> </leafNode> <leafNode name="ipv6-src-route"> <properties> <help>Policy for handling IPv6 packets with routing extension header</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable processing of IPv6 packets with routing header type 2</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable processing of IPv6 packets with routing header</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>disable</defaultValue> </leafNode> <leafNode name="log-martians"> <properties> <help>Policy for logging IPv4 packets with invalid addresses</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable logging of IPv4 packets with invalid addresses</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable logging of Ipv4 packets with invalid addresses</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>enable</defaultValue> </leafNode> <tagNode name="name"> <properties> <help>IPv4 firewall rule-set name</help> <constraint> <regex>[a-zA-Z0-9][\w\-\.]*</regex> </constraint> </properties> <children> #include <include/firewall/name-default-action.xml.i> #include <include/firewall/name-default-log.xml.i> #include <include/generic-description.xml.i> <tagNode name="rule"> <properties> <help>Firewall rule number (IPv4)</help> <valueHelp> <format>u32:1-999999</format> <description>Number for this Firewall rule</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 1-999999"/> </constraint> <constraintErrorMessage>Firewall rule number must be between 1 and 999999</constraintErrorMessage> </properties> <children> #include <include/firewall/action.xml.i> #include <include/generic-description.xml.i> <node name="destination"> <properties> <help>Destination parameters</help> </properties> <children> #include <include/firewall/address.xml.i> #include <include/firewall/geoip.xml.i> #include <include/firewall/source-destination-group.xml.i> #include <include/firewall/port.xml.i> </children> </node> <node name="source"> <properties> <help>Source parameters</help> </properties> <children> #include <include/firewall/address.xml.i> #include <include/firewall/geoip.xml.i> #include <include/firewall/source-destination-group.xml.i> #include <include/firewall/port.xml.i> </children> </node> #include <include/firewall/common-rule.xml.i> <node name="icmp"> <properties> <help>ICMP type and code information</help> </properties> <children> <leafNode name="code"> <properties> <help>ICMP code (0-255)</help> <valueHelp> <format>u32:0-255</format> <description>ICMP code (0-255)</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> </constraint> </properties> </leafNode> <leafNode name="type"> <properties> <help>ICMP type (0-255)</help> <valueHelp> <format>u32:0-255</format> <description>ICMP type (0-255)</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> </constraint> </properties> </leafNode> #include <include/firewall/icmp-type-name.xml.i> </children> </node> <node name="ttl"> <properties> <help>Time to live limit</help> </properties> <children> <leafNode name="eq"> <properties> <help>Value to match a ttl equal to it</help> <valueHelp> <format>u32:0-255</format> <description>ttl equal to value</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> </constraint> </properties> </leafNode> <leafNode name="gt"> <properties> <help>Value to match a ttl greater than or equal to it</help> <valueHelp> <format>u32:0-255</format> <description>ttl greater than value</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> </constraint> </properties> </leafNode> <leafNode name="lt"> <properties> <help>Value to match a ttl less than or equal to it</help> <valueHelp> <format>u32:0-255</format> <description>ttl less than value</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-255"/> </constraint> </properties> </leafNode> </children> </node> </children> </tagNode> </children> </tagNode> <leafNode name="receive-redirects"> <properties> <help>Policy for handling received IPv4 ICMP redirect messages</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable processing of received IPv4 ICMP redirect messages</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable processing of received IPv4 ICMP redirect messages</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>disable</defaultValue> </leafNode> <leafNode name="send-redirects"> <properties> <help>Policy for sending IPv4 ICMP redirect messages</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable sending IPv4 ICMP redirect messages</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable sending IPv4 ICMP redirect messages</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>enable</defaultValue> </leafNode> <leafNode name="source-validation"> <properties> <help>Policy for source validation by reversed path, as specified in RFC3704</help> <completionHelp> <list>strict loose disable</list> </completionHelp> <valueHelp> <format>strict</format> <description>Enable Strict Reverse Path Forwarding as defined in RFC3704</description> </valueHelp> <valueHelp> <format>loose</format> <description>Enable Loose Reverse Path Forwarding as defined in RFC3704</description> </valueHelp> <valueHelp> <format>disable</format> <description>No source validation</description> </valueHelp> <constraint> <regex>(strict|loose|disable)</regex> </constraint> </properties> <defaultValue>disable</defaultValue> </leafNode> <node name="state-policy"> <properties> <help>Global firewall state-policy</help> </properties> <children> <node name="established"> <properties> <help>Global firewall policy for packets part of an established connection</help> </properties> <children> #include <include/firewall/action-accept-drop-reject.xml.i> #include <include/firewall/rule-log-level.xml.i> </children> </node> <node name="invalid"> <properties> <help>Global firewall policy for packets part of an invalid connection</help> </properties> <children> #include <include/firewall/action-accept-drop-reject.xml.i> #include <include/firewall/rule-log-level.xml.i> </children> </node> <node name="related"> <properties> <help>Global firewall policy for packets part of a related connection</help> </properties> <children> #include <include/firewall/action-accept-drop-reject.xml.i> #include <include/firewall/rule-log-level.xml.i> </children> </node> </children> </node> <leafNode name="syn-cookies"> <properties> <help>Policy for using TCP SYN cookies with IPv4</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable use of TCP SYN cookies with IPv4</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable use of TCP SYN cookies with IPv4</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>enable</defaultValue> </leafNode> <leafNode name="twa-hazards-protection"> <properties> <help>RFC1337 TCP TIME-WAIT assasination hazards protection</help> <completionHelp> <list>enable disable</list> </completionHelp> <valueHelp> <format>enable</format> <description>Enable RFC1337 TIME-WAIT hazards protection</description> </valueHelp> <valueHelp> <format>disable</format> <description>Disable RFC1337 TIME-WAIT hazards protection</description> </valueHelp> <constraint> <regex>(enable|disable)</regex> </constraint> </properties> <defaultValue>disable</defaultValue> </leafNode> </children> </node> </interfaceDefinition>