From 6ed85600b218a0457a1fd125c97314b1783e63bd Mon Sep 17 00:00:00 2001 From: Sebastian Weber Date: Wed, 17 Jan 2024 21:48:51 +0100 Subject: Fix typos in quick-start (cherry picked from commit 32460e70ef014616ec36fce9361f702d5cc1463a) # Conflicts: # docs/quick-start.rst --- docs/quick-start.rst | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) (limited to 'docs/quick-start.rst') diff --git a/docs/quick-start.rst b/docs/quick-start.rst index c8bb3f04..f0a3c828 100644 --- a/docs/quick-start.rst +++ b/docs/quick-start.rst @@ -158,8 +158,29 @@ Configure Stateful Packet Filtering With the new firewall structure, we have have a lot of flexibility in how we group and order our rules, as shown by the two alternative approaches below. +<<<<<<< HEAD Option 1: Common Chain ^^^^^^^^^^^^^^^^^^^^^^ +======= +Option 1: Global State Policies +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Using options defined in ``set firewall global-options state-policy``, state +policy rules that applies for both IPv4 and IPv6 are created. These global +state policies also applies for all traffic that passes through the router +(transit) and for traffic originated/destinated to/from the router itself, and +will be evaluated before any other rule defined in the firewall. + +Most installations would choose this option, and will contain: + +.. code-block:: none + + set firewall global-options state-policy established action accept + set firewall global-options state-policy related action accept + set firewall global-options state-policy invalid action drop + +Option 2: Common/Custom Chain +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +>>>>>>> 32460e70 (Fix typos in quick-start) We can create a common chain for stateful connection filtering of multiple interfaces (or multiple netfilter hooks on one interface). Those individual @@ -225,7 +246,7 @@ established and related connections, we can block all other incoming traffic addressed to our local network. Create a new chain (``OUTSIDE-IN``) which will drop all traffic that is not -explicity allowed at some point in the chain. Then, we can jump to that chain +explicitly allowed at some point in the chain. Then, we can jump to that chain from the ``forward`` hook when traffic is coming from the ``WAN`` interface group and is addressed to our local network. -- cgit v1.2.3