1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
|
---
lastproofread: '2026-03-30'
---
(firewall-global-options-configuration)=
# Global Options Firewall Configuration
## Overview
Some firewall settings are global and affect the entire system. This section
provides information about these global options that you can configure using
the VyOS CLI.
Configuration commands covered in this section:
```{cfgcmd} set firewall global-options ...
```
## Configuration
```{cfgcmd} set firewall global-options all-ping [enable | disable]
By default, when VyOS receives an ICMP echo request packet destined for
itself, it answers with an ICMP echo reply, unless your firewall prevents
it.
You can set firewall rules to accept, drop, or reject ICMP in, out, or
local traffic. You can also use the **firewall global-options all-ping**
command. This command affects only LOCAL traffic (packets destined for your
VyOS system), not IN or OUT traffic.
:::{note}
**firewall global-options all-ping** affects only LOCAL traffic
and always behaves in the most restrictive way
:::
:::{code-block} none
set firewall global-options all-ping enable
:::
When you set this command, VyOS answers every ICMP echo request addressed
to itself, but that response occurs only if no other rule drops or rejects
local echo requests. In case of conflict, VyOS does not answer ICMP echo
requests.
:::{code-block} none
set firewall global-options all-ping disable
:::
When you set this command, VyOS answers no ICMP echo requests addressed to
itself, regardless of where they come from or what specific rules accept
them.
```
```{cfgcmd} set firewall global-options apply-to-bridged-traffic [ipv4 | ipv6]
Apply IPv4 or IPv6 firewall rules to bridged traffic.
```
```{cfgcmd} set firewall global-options broadcast-ping [enable | disable]
Enable or disable the response to ICMP broadcast messages. The system
alters the following parameter:
* ``net.ipv4.icmp_echo_ignore_broadcasts``
```
```{cfgcmd} set firewall global-options ip-src-route [enable | disable]
```
```{cfgcmd} set firewall global-options ipv6-src-route [enable | disable]
Set whether VyOS accepts packets with a source route option.
The following sysctl parameters will be changed:
* ``net.ipv4.conf.all.accept_source_route``
* ``net.ipv6.conf.all.accept_source_route``
```
```{cfgcmd} set firewall global-options receive-redirects [enable | disable]
```
```{cfgcmd} set firewall global-options ipv6-receive-redirects [enable | disable]
Allow VyOS to accept ICMPv4 and ICMPv6 redirect messages.
The following sysctl parameters will be changed:
* ``net.ipv4.conf.all.accept_redirects``
* ``net.ipv6.conf.all.accept_redirects``
```
```{cfgcmd} set firewall global-options send-redirects [enable | disable]
Allow VyOS to send ICMPv4 redirect messages.
The following sysctl parameter will be changed:
* ``net.ipv4.conf.all.send_redirects``
```
```{cfgcmd} set firewall global-options log-martians [enable | disable]
Allow VyOS to log martian IPv4 packets.
The following sysctl parameter will be changed:
* ``net.ipv4.conf.all.log_martians``
```
```{cfgcmd} set firewall global-options source-validation [strict | loose | disable]
Set the IPv4 source validation mode.
The following sysctl parameter will be changed:
* ``net.ipv4.conf.all.rp_filter``
```
```{cfgcmd} set firewall global-options syn-cookies [enable | disable]
Allow VyOS to use IPv4 TCP SYN Cookies.
The following sysctl parameter will be changed:
* ``net.ipv4.tcp_syncookies``
```
```{cfgcmd} set firewall global-options twa-hazards-protection [enable | disable]
Enable or disable VyOS {rfc}`1337` conformance.
The following sysctl parameter will be changed:
* ``net.ipv4.tcp_rfc1337``
```
```{cfgcmd} set firewall global-options state-policy established action [accept | drop | reject]
```
```{cfgcmd} set firewall global-options state-policy established log
```
```{cfgcmd} set firewall global-options state-policy established log-level [emerg | alert | crit | err | warn | notice | info | debug]
Set the global setting for an established connection.
```
```{cfgcmd} set firewall global-options state-policy invalid action [accept | drop | reject]
```
```{cfgcmd} set firewall global-options state-policy invalid log
```
```{cfgcmd} set firewall global-options state-policy invalid log-level [emerg | alert | crit | err | warn | notice | info | debug]
Set the global setting for invalid packets.
```
```{cfgcmd} set firewall global-options state-policy related action [accept | drop | reject]
```
```{cfgcmd} set firewall global-options state-policy related log
```
```{cfgcmd} set firewall global-options state-policy related log-level [emerg | alert | crit | err | warn | notice | info | debug]
Set the global setting for related connections.
```
VyOS supports setting timeouts for connections by connection type. You can
set timeout values for generic connections, ICMP connections, UDP
connections, or TCP connections in various states.
```{eval-rst}
.. cfgcmd:: set firewall global-options timeout icmp <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout other <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout tcp close <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout tcp close-wait <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout tcp established <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout tcp fin-wait <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout tcp last-ack <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout tcp syn-recv <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout tcp syn-sent <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout tcp time-wait <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout udp other <1-21474836>
:defaultvalue:
.. cfgcmd:: set firewall global-options timeout udp stream <1-21474836>
:defaultvalue:
Set the timeout in seconds for a protocol or state.
```
|
