From a950059053f7394acfb453cc0d8194aa3dc721fa Mon Sep 17 00:00:00 2001 From: kumvijaya Date: Thu, 26 Sep 2024 11:31:07 +0530 Subject: T6732: added same as vyos 1x --- .../firewall/action-accept-drop-reject.xml.i | 25 ++ .../include/firewall/action-and-notrack.xml.i | 45 +++ .../include/firewall/action-forward.xml.i | 49 +++ .../include/firewall/action-l2.xml.i | 37 +++ .../include/firewall/action.xml.i | 49 +++ .../include/firewall/add-addr-to-group-ipv4.xml.i | 25 ++ .../include/firewall/add-addr-to-group-ipv6.xml.i | 25 ++ .../firewall/add-dynamic-address-groups.xml.i | 34 ++ .../firewall/add-dynamic-ipv6-address-groups.xml.i | 34 ++ .../include/firewall/address-inet.xml.i | 63 ++++ .../include/firewall/address-ipv6.xml.i | 37 +++ .../include/firewall/address-mask-inet.xml.i | 19 ++ .../include/firewall/address-mask-ipv6.xml.i | 14 + .../include/firewall/address-mask.xml.i | 14 + .../include/firewall/address.xml.i | 39 +++ .../include/firewall/bridge-custom-name.xml.i | 45 +++ .../include/firewall/bridge-hook-forward.xml.i | 41 +++ .../include/firewall/bridge-hook-input.xml.i | 40 +++ .../include/firewall/bridge-hook-output.xml.i | 40 +++ .../include/firewall/bridge-hook-prerouting.xml.i | 37 +++ .../include/firewall/common-rule-bridge.xml.i | 55 ++++ .../include/firewall/common-rule-inet.xml.i | 24 ++ .../include/firewall/common-rule-ipv4-raw.xml.i | 47 +++ .../include/firewall/common-rule-ipv4.xml.i | 44 +++ .../include/firewall/common-rule-ipv6-raw.xml.i | 49 +++ .../include/firewall/common-rule-ipv6.xml.i | 44 +++ .../include/firewall/connection-mark.xml.i | 15 + .../include/firewall/connection-status.xml.i | 28 ++ .../include/firewall/conntrack-helper.xml.i | 46 +++ .../firewall/default-action-base-chains.xml.i | 22 ++ .../include/firewall/default-action-bridge.xml.i | 34 ++ .../include/firewall/default-action.xml.i | 38 +++ .../include/firewall/default-log.xml.i | 8 + interface-definitions/include/firewall/dscp.xml.i | 36 ++ interface-definitions/include/firewall/eq.xml.i | 14 + .../firewall/firewall-hashing-parameters.xml.i | 35 ++ .../include/firewall/firewall-mark.xml.i | 26 ++ interface-definitions/include/firewall/fqdn.xml.i | 14 + .../include/firewall/fragment.xml.i | 21 ++ .../include/firewall/fwmark.xml.i | 14 + interface-definitions/include/firewall/geoip.xml.i | 28 ++ .../include/firewall/global-options.xml.i | 366 +++++++++++++++++++++ interface-definitions/include/firewall/gre.xml.i | 116 +++++++ interface-definitions/include/firewall/gt.xml.i | 14 + .../include/firewall/hop-limit.xml.i | 12 + .../include/firewall/icmp-type-name.xml.i | 73 ++++ interface-definitions/include/firewall/icmp.xml.i | 34 ++ .../include/firewall/icmpv6-type-name.xml.i | 85 +++++ .../include/firewall/icmpv6.xml.i | 34 ++ .../firewall/inbound-interface-no-group.xml.i | 34 ++ .../include/firewall/inbound-interface.xml.i | 10 + .../include/firewall/ipv4-custom-name.xml.i | 43 +++ .../include/firewall/ipv4-hook-forward.xml.i | 40 +++ .../include/firewall/ipv4-hook-input.xml.i | 37 +++ .../include/firewall/ipv4-hook-output.xml.i | 65 ++++ .../include/firewall/ipv4-hook-prerouting.xml.i | 52 +++ .../include/firewall/ipv6-custom-name.xml.i | 43 +++ .../include/firewall/ipv6-hook-forward.xml.i | 40 +++ .../include/firewall/ipv6-hook-input.xml.i | 37 +++ .../include/firewall/ipv6-hook-output.xml.i | 65 ++++ .../include/firewall/ipv6-hook-prerouting.xml.i | 52 +++ interface-definitions/include/firewall/limit.xml.i | 33 ++ .../include/firewall/log-options.xml.i | 89 +++++ interface-definitions/include/firewall/log.xml.i | 8 + interface-definitions/include/firewall/lt.xml.i | 14 + .../include/firewall/mac-address.xml.i | 19 ++ .../include/firewall/mac-group.xml.i | 10 + .../include/firewall/match-ether-type.xml.i | 30 ++ .../include/firewall/match-interface.xml.i | 43 +++ .../include/firewall/match-ipsec-in.xml.i | 21 ++ .../include/firewall/match-ipsec-out.xml.i | 21 ++ .../include/firewall/match-ipsec.xml.i | 33 ++ .../include/firewall/match-vlan.xml.i | 42 +++ interface-definitions/include/firewall/name.xml.i | 18 + .../include/firewall/nat-balance.xml.i | 28 ++ .../include/firewall/nft-queue.xml.i | 34 ++ .../include/firewall/offload-target.xml.i | 10 + .../firewall/outbound-interface-no-group.xml.i | 34 ++ .../include/firewall/outbound-interface.xml.i | 10 + .../include/firewall/packet-options.xml.i | 63 ++++ interface-definitions/include/firewall/port.xml.i | 26 ++ .../include/firewall/protocol.xml.i | 34 ++ .../include/firewall/recent.xml.i | 44 +++ .../include/firewall/rule-log-level.xml.i | 45 +++ .../firewall/set-packet-modifications.xml.i | 96 ++++++ .../source-destination-dynamic-group-ipv6.xml.i | 17 + .../source-destination-dynamic-group.xml.i | 17 + .../firewall/source-destination-group-inet.xml.i | 50 +++ .../firewall/source-destination-group-ipv4.xml.i | 41 +++ .../firewall/source-destination-group-ipv6.xml.i | 42 +++ .../firewall/source-destination-group.xml.i | 42 +++ interface-definitions/include/firewall/state.xml.i | 30 ++ .../include/firewall/synproxy.xml.i | 40 +++ .../include/firewall/tcp-flags.xml.i | 119 +++++++ .../include/firewall/tcp-mss.xml.i | 25 ++ interface-definitions/include/firewall/time.xml.i | 70 ++++ .../firewall/timeout-common-protocols.xml.i | 171 ++++++++++ interface-definitions/include/firewall/ttl.xml.i | 12 + 98 files changed, 4087 insertions(+) create mode 100644 interface-definitions/include/firewall/action-accept-drop-reject.xml.i create mode 100644 interface-definitions/include/firewall/action-and-notrack.xml.i create mode 100644 interface-definitions/include/firewall/action-forward.xml.i create mode 100644 interface-definitions/include/firewall/action-l2.xml.i create mode 100644 interface-definitions/include/firewall/action.xml.i create mode 100644 interface-definitions/include/firewall/add-addr-to-group-ipv4.xml.i create mode 100644 interface-definitions/include/firewall/add-addr-to-group-ipv6.xml.i create mode 100644 interface-definitions/include/firewall/add-dynamic-address-groups.xml.i create mode 100644 interface-definitions/include/firewall/add-dynamic-ipv6-address-groups.xml.i create mode 100644 interface-definitions/include/firewall/address-inet.xml.i create mode 100644 interface-definitions/include/firewall/address-ipv6.xml.i create mode 100644 interface-definitions/include/firewall/address-mask-inet.xml.i create mode 100644 interface-definitions/include/firewall/address-mask-ipv6.xml.i create mode 100644 interface-definitions/include/firewall/address-mask.xml.i create mode 100644 interface-definitions/include/firewall/address.xml.i create mode 100644 interface-definitions/include/firewall/bridge-custom-name.xml.i create mode 100644 interface-definitions/include/firewall/bridge-hook-forward.xml.i create mode 100644 interface-definitions/include/firewall/bridge-hook-input.xml.i create mode 100644 interface-definitions/include/firewall/bridge-hook-output.xml.i create mode 100644 interface-definitions/include/firewall/bridge-hook-prerouting.xml.i create mode 100644 interface-definitions/include/firewall/common-rule-bridge.xml.i create mode 100644 interface-definitions/include/firewall/common-rule-inet.xml.i create mode 100644 interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i create mode 100644 interface-definitions/include/firewall/common-rule-ipv4.xml.i create mode 100644 interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i create mode 100644 interface-definitions/include/firewall/common-rule-ipv6.xml.i create mode 100644 interface-definitions/include/firewall/connection-mark.xml.i create mode 100644 interface-definitions/include/firewall/connection-status.xml.i create mode 100644 interface-definitions/include/firewall/conntrack-helper.xml.i create mode 100644 interface-definitions/include/firewall/default-action-base-chains.xml.i create mode 100644 interface-definitions/include/firewall/default-action-bridge.xml.i create mode 100644 interface-definitions/include/firewall/default-action.xml.i create mode 100644 interface-definitions/include/firewall/default-log.xml.i create mode 100644 interface-definitions/include/firewall/dscp.xml.i create mode 100644 interface-definitions/include/firewall/eq.xml.i create mode 100644 interface-definitions/include/firewall/firewall-hashing-parameters.xml.i create mode 100644 interface-definitions/include/firewall/firewall-mark.xml.i create mode 100644 interface-definitions/include/firewall/fqdn.xml.i create mode 100644 interface-definitions/include/firewall/fragment.xml.i create mode 100644 interface-definitions/include/firewall/fwmark.xml.i create mode 100644 interface-definitions/include/firewall/geoip.xml.i create mode 100644 interface-definitions/include/firewall/global-options.xml.i create mode 100644 interface-definitions/include/firewall/gre.xml.i create mode 100644 interface-definitions/include/firewall/gt.xml.i create mode 100644 interface-definitions/include/firewall/hop-limit.xml.i create mode 100644 interface-definitions/include/firewall/icmp-type-name.xml.i create mode 100644 interface-definitions/include/firewall/icmp.xml.i create mode 100644 interface-definitions/include/firewall/icmpv6-type-name.xml.i create mode 100644 interface-definitions/include/firewall/icmpv6.xml.i create mode 100644 interface-definitions/include/firewall/inbound-interface-no-group.xml.i create mode 100644 interface-definitions/include/firewall/inbound-interface.xml.i create mode 100644 interface-definitions/include/firewall/ipv4-custom-name.xml.i create mode 100644 interface-definitions/include/firewall/ipv4-hook-forward.xml.i create mode 100644 interface-definitions/include/firewall/ipv4-hook-input.xml.i create mode 100644 interface-definitions/include/firewall/ipv4-hook-output.xml.i create mode 100644 interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i create mode 100644 interface-definitions/include/firewall/ipv6-custom-name.xml.i create mode 100644 interface-definitions/include/firewall/ipv6-hook-forward.xml.i create mode 100644 interface-definitions/include/firewall/ipv6-hook-input.xml.i create mode 100644 interface-definitions/include/firewall/ipv6-hook-output.xml.i create mode 100644 interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i create mode 100644 interface-definitions/include/firewall/limit.xml.i create mode 100644 interface-definitions/include/firewall/log-options.xml.i create mode 100644 interface-definitions/include/firewall/log.xml.i create mode 100644 interface-definitions/include/firewall/lt.xml.i create mode 100644 interface-definitions/include/firewall/mac-address.xml.i create mode 100644 interface-definitions/include/firewall/mac-group.xml.i create mode 100644 interface-definitions/include/firewall/match-ether-type.xml.i create mode 100644 interface-definitions/include/firewall/match-interface.xml.i create mode 100644 interface-definitions/include/firewall/match-ipsec-in.xml.i create mode 100644 interface-definitions/include/firewall/match-ipsec-out.xml.i create mode 100644 interface-definitions/include/firewall/match-ipsec.xml.i create mode 100644 interface-definitions/include/firewall/match-vlan.xml.i create mode 100644 interface-definitions/include/firewall/name.xml.i create mode 100644 interface-definitions/include/firewall/nat-balance.xml.i create mode 100644 interface-definitions/include/firewall/nft-queue.xml.i create mode 100644 interface-definitions/include/firewall/offload-target.xml.i create mode 100644 interface-definitions/include/firewall/outbound-interface-no-group.xml.i create mode 100644 interface-definitions/include/firewall/outbound-interface.xml.i create mode 100644 interface-definitions/include/firewall/packet-options.xml.i create mode 100644 interface-definitions/include/firewall/port.xml.i create mode 100644 interface-definitions/include/firewall/protocol.xml.i create mode 100644 interface-definitions/include/firewall/recent.xml.i create mode 100644 interface-definitions/include/firewall/rule-log-level.xml.i create mode 100644 interface-definitions/include/firewall/set-packet-modifications.xml.i create mode 100644 interface-definitions/include/firewall/source-destination-dynamic-group-ipv6.xml.i create mode 100644 interface-definitions/include/firewall/source-destination-dynamic-group.xml.i create mode 100644 interface-definitions/include/firewall/source-destination-group-inet.xml.i create mode 100644 interface-definitions/include/firewall/source-destination-group-ipv4.xml.i create mode 100644 interface-definitions/include/firewall/source-destination-group-ipv6.xml.i create mode 100644 interface-definitions/include/firewall/source-destination-group.xml.i create mode 100644 interface-definitions/include/firewall/state.xml.i create mode 100644 interface-definitions/include/firewall/synproxy.xml.i create mode 100644 interface-definitions/include/firewall/tcp-flags.xml.i create mode 100644 interface-definitions/include/firewall/tcp-mss.xml.i create mode 100644 interface-definitions/include/firewall/time.xml.i create mode 100644 interface-definitions/include/firewall/timeout-common-protocols.xml.i create mode 100644 interface-definitions/include/firewall/ttl.xml.i (limited to 'interface-definitions/include/firewall') diff --git a/interface-definitions/include/firewall/action-accept-drop-reject.xml.i b/interface-definitions/include/firewall/action-accept-drop-reject.xml.i new file mode 100644 index 0000000..7fd5231 --- /dev/null +++ b/interface-definitions/include/firewall/action-accept-drop-reject.xml.i @@ -0,0 +1,25 @@ + + + + Action for packets + + accept drop reject + + + accept + Action to accept + + + drop + Action to drop + + + reject + Action to reject + + + (accept|drop|reject) + + + + diff --git a/interface-definitions/include/firewall/action-and-notrack.xml.i b/interface-definitions/include/firewall/action-and-notrack.xml.i new file mode 100644 index 0000000..de11f7d --- /dev/null +++ b/interface-definitions/include/firewall/action-and-notrack.xml.i @@ -0,0 +1,45 @@ + + + + Rule action + + accept continue jump notrack reject return drop queue + + + accept + Accept matching entries + + + continue + Continue parsing next rule + + + jump + Jump to another chain + + + reject + Reject matching entries + + + return + Return from the current chain and continue at the next rule of the last chain + + + drop + Drop matching entries + + + queue + Enqueue packet to userspace + + + notrack + Ignore connection tracking + + + (accept|continue|jump|notrack|reject|return|drop|queue) + + + + diff --git a/interface-definitions/include/firewall/action-forward.xml.i b/interface-definitions/include/firewall/action-forward.xml.i new file mode 100644 index 0000000..4e59f3c --- /dev/null +++ b/interface-definitions/include/firewall/action-forward.xml.i @@ -0,0 +1,49 @@ + + + + Rule action + + accept continue jump reject return drop queue offload synproxy + + + accept + Accept matching entries + + + continue + Continue parsing next rule + + + jump + Jump to another chain + + + reject + Reject matching entries + + + return + Return from the current chain and continue at the next rule of the last chain + + + drop + Drop matching entries + + + queue + Enqueue packet to userspace + + + offload + Offload packet via flowtable + + + synproxy + Synproxy connections + + + (accept|continue|jump|reject|return|drop|queue|offload|synproxy) + + + + diff --git a/interface-definitions/include/firewall/action-l2.xml.i b/interface-definitions/include/firewall/action-l2.xml.i new file mode 100644 index 0000000..84af576 --- /dev/null +++ b/interface-definitions/include/firewall/action-l2.xml.i @@ -0,0 +1,37 @@ + + + + Rule action + + accept continue jump return drop queue + + + accept + Accept matching entries + + + continue + Continue parsing next rule + + + jump + Jump to another chain + + + return + Return from the current chain and continue at the next rule of the last chain + + + drop + Drop matching entries + + + queue + Enqueue packet to userspace + + + (accept|continue|jump|return|drop|queue) + + + + diff --git a/interface-definitions/include/firewall/action.xml.i b/interface-definitions/include/firewall/action.xml.i new file mode 100644 index 0000000..e1f0c6c --- /dev/null +++ b/interface-definitions/include/firewall/action.xml.i @@ -0,0 +1,49 @@ + + + + Rule action + + accept continue jump reject return drop queue offload synproxy + + + accept + Accept matching entries + + + continue + Continue parsing next rule + + + jump + Jump to another chain + + + reject + Reject matching entries + + + return + Return from the current chain and continue at the next rule of the last chain + + + drop + Drop matching entries + + + queue + Enqueue packet to userspace + + + offload + Offload packet via flowtable + + + synproxy + Synproxy connections + + + (accept|continue|jump|reject|return|drop|queue|offload|synproxy) + + + + diff --git a/interface-definitions/include/firewall/add-addr-to-group-ipv4.xml.i b/interface-definitions/include/firewall/add-addr-to-group-ipv4.xml.i new file mode 100644 index 0000000..a47cadd --- /dev/null +++ b/interface-definitions/include/firewall/add-addr-to-group-ipv4.xml.i @@ -0,0 +1,25 @@ + + + + Add ip address to dynamic address-group + + + + + Add source ip addresses to dynamic address-group + + + #include + + + + + Add destination ip addresses to dynamic address-group + + + #include + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/add-addr-to-group-ipv6.xml.i b/interface-definitions/include/firewall/add-addr-to-group-ipv6.xml.i new file mode 100644 index 0000000..2cb0774 --- /dev/null +++ b/interface-definitions/include/firewall/add-addr-to-group-ipv6.xml.i @@ -0,0 +1,25 @@ + + + + Add ipv6 address to dynamic ipv6-address-group + + + + + Add source ipv6 addresses to dynamic ipv6-address-group + + + #include + + + + + Add destination ipv6 addresses to dynamic ipv6-address-group + + + #include + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/add-dynamic-address-groups.xml.i b/interface-definitions/include/firewall/add-dynamic-address-groups.xml.i new file mode 100644 index 0000000..769761c --- /dev/null +++ b/interface-definitions/include/firewall/add-dynamic-address-groups.xml.i @@ -0,0 +1,34 @@ + + + + Dynamic address-group + + firewall group dynamic-group address-group + + + + + + Set timeout + + <number>s + Timeout value in seconds + + + <number>m + Timeout value in minutes + + + <number>h + Timeout value in hours + + + <number>d + Timeout value in days + + + \d+(s|m|h|d) + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/add-dynamic-ipv6-address-groups.xml.i b/interface-definitions/include/firewall/add-dynamic-ipv6-address-groups.xml.i new file mode 100644 index 0000000..7bd91c5 --- /dev/null +++ b/interface-definitions/include/firewall/add-dynamic-ipv6-address-groups.xml.i @@ -0,0 +1,34 @@ + + + + Dynamic ipv6-address-group + + firewall group dynamic-group ipv6-address-group + + + + + + Set timeout + + <number>s + Timeout value in seconds + + + <number>m + Timeout value in minutes + + + <number>h + Timeout value in hours + + + <number>d + Timeout value in days + + + \d+(s|m|h|d) + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/address-inet.xml.i b/interface-definitions/include/firewall/address-inet.xml.i new file mode 100644 index 0000000..02ed8f6 --- /dev/null +++ b/interface-definitions/include/firewall/address-inet.xml.i @@ -0,0 +1,63 @@ + + + + IP address, subnet, or range + + ipv4 + IPv4 address to match + + + ipv4net + IPv4 prefix to match + + + ipv4range + IPv4 address range to match + + + !ipv4 + Match everything except the specified address + + + !ipv4net + Match everything except the specified prefix + + + !ipv4range + Match everything except the specified range + + + ipv6net + Subnet to match + + + ipv6range + IP range to match + + + !ipv6 + Match everything except the specified address + + + !ipv6net + Match everything except the specified prefix + + + !ipv6range + Match everything except the specified range + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/address-ipv6.xml.i b/interface-definitions/include/firewall/address-ipv6.xml.i new file mode 100644 index 0000000..fa60c0c --- /dev/null +++ b/interface-definitions/include/firewall/address-ipv6.xml.i @@ -0,0 +1,37 @@ + + + + IP address, subnet, or range + + ipv6 + IP address to match + + + ipv6net + Subnet to match + + + ipv6range + IP range to match + + + !ipv6 + Match everything except the specified address + + + !ipv6net + Match everything except the specified prefix + + + !ipv6range + Match everything except the specified range + + + + + + + + + + diff --git a/interface-definitions/include/firewall/address-mask-inet.xml.i b/interface-definitions/include/firewall/address-mask-inet.xml.i new file mode 100644 index 0000000..e2a5927 --- /dev/null +++ b/interface-definitions/include/firewall/address-mask-inet.xml.i @@ -0,0 +1,19 @@ + + + + IP mask + + ipv4 + IPv4 mask to apply + + + ipv6 + IP mask to apply + + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/address-mask-ipv6.xml.i b/interface-definitions/include/firewall/address-mask-ipv6.xml.i new file mode 100644 index 0000000..8c04832 --- /dev/null +++ b/interface-definitions/include/firewall/address-mask-ipv6.xml.i @@ -0,0 +1,14 @@ + + + + IP mask + + ipv6 + IP mask to apply + + + + + + + diff --git a/interface-definitions/include/firewall/address-mask.xml.i b/interface-definitions/include/firewall/address-mask.xml.i new file mode 100644 index 0000000..7f6f17d --- /dev/null +++ b/interface-definitions/include/firewall/address-mask.xml.i @@ -0,0 +1,14 @@ + + + + IP mask + + ipv4 + IPv4 mask to apply + + + + + + + diff --git a/interface-definitions/include/firewall/address.xml.i b/interface-definitions/include/firewall/address.xml.i new file mode 100644 index 0000000..2e1bde5 --- /dev/null +++ b/interface-definitions/include/firewall/address.xml.i @@ -0,0 +1,39 @@ + + + + IP address, subnet, or range + + ipv4 + IPv4 address to match + + + ipv4net + IPv4 prefix to match + + + ipv4range + IPv4 address range to match + + + !ipv4 + Match everything except the specified address + + + !ipv4net + Match everything except the specified prefix + + + !ipv4range + Match everything except the specified range + + + + + + + + + + + + diff --git a/interface-definitions/include/firewall/bridge-custom-name.xml.i b/interface-definitions/include/firewall/bridge-custom-name.xml.i new file mode 100644 index 0000000..9a2a829 --- /dev/null +++ b/interface-definitions/include/firewall/bridge-custom-name.xml.i @@ -0,0 +1,45 @@ + + + + Bridge custom firewall + + [a-zA-Z0-9][\w\-\.]* + + + + #include + #include + #include + + + Set jump target. Action jump must be defined in default-action to use this setting + + firewall bridge name + + + + + + Bridge Firewall forward filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + #include + #include + #include + #include + + + + + diff --git a/interface-definitions/include/firewall/bridge-hook-forward.xml.i b/interface-definitions/include/firewall/bridge-hook-forward.xml.i new file mode 100644 index 0000000..fcc9819 --- /dev/null +++ b/interface-definitions/include/firewall/bridge-hook-forward.xml.i @@ -0,0 +1,41 @@ + + + + Bridge forward firewall + + + + + Bridge firewall forward filter + + + #include + #include + #include + + + Bridge Firewall forward filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + #include + #include + #include + #include + + + + + + + diff --git a/interface-definitions/include/firewall/bridge-hook-input.xml.i b/interface-definitions/include/firewall/bridge-hook-input.xml.i new file mode 100644 index 0000000..f6a11f8 --- /dev/null +++ b/interface-definitions/include/firewall/bridge-hook-input.xml.i @@ -0,0 +1,40 @@ + + + + Bridge input firewall + + + + + Bridge firewall input filter + + + #include + #include + #include + + + Bridge Firewall input filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + #include + #include + #include + + + + + + + diff --git a/interface-definitions/include/firewall/bridge-hook-output.xml.i b/interface-definitions/include/firewall/bridge-hook-output.xml.i new file mode 100644 index 0000000..38b8b08 --- /dev/null +++ b/interface-definitions/include/firewall/bridge-hook-output.xml.i @@ -0,0 +1,40 @@ + + + + Bridge output firewall + + + + + Bridge firewall output filter + + + #include + #include + #include + + + Bridge Firewall output filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + #include + #include + #include + + + + + + + diff --git a/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i b/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i new file mode 100644 index 0000000..ea56764 --- /dev/null +++ b/interface-definitions/include/firewall/bridge-hook-prerouting.xml.i @@ -0,0 +1,37 @@ + + + + Bridge prerouting firewall + + + + + Bridge firewall prerouting filter + + + #include + #include + #include + + + Bridge firewall prerouting filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + + + + + + + diff --git a/interface-definitions/include/firewall/common-rule-bridge.xml.i b/interface-definitions/include/firewall/common-rule-bridge.xml.i new file mode 100644 index 0000000..80088bb --- /dev/null +++ b/interface-definitions/include/firewall/common-rule-bridge.xml.i @@ -0,0 +1,55 @@ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + + + Destination parameters + + + #include + #include + #include + #include + #include + + + + + Set jump target. Action jump must be defined to use this setting + + firewall bridge name + + + + + + Source parameters + + + #include + #include + #include + #include + #include + + + diff --git a/interface-definitions/include/firewall/common-rule-inet.xml.i b/interface-definitions/include/firewall/common-rule-inet.xml.i new file mode 100644 index 0000000..e44938b --- /dev/null +++ b/interface-definitions/include/firewall/common-rule-inet.xml.i @@ -0,0 +1,24 @@ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + diff --git a/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i new file mode 100644 index 0000000..e8da1a0 --- /dev/null +++ b/interface-definitions/include/firewall/common-rule-ipv4-raw.xml.i @@ -0,0 +1,47 @@ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + + + Destination parameters + + + #include + #include + #include + #include + #include + #include + #include + + + + + Source parameters + + + #include + #include + #include + #include + #include + #include + #include + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/common-rule-ipv4.xml.i b/interface-definitions/include/firewall/common-rule-ipv4.xml.i new file mode 100644 index 0000000..803b94b --- /dev/null +++ b/interface-definitions/include/firewall/common-rule-ipv4.xml.i @@ -0,0 +1,44 @@ + +#include +#include +#include +#include + + + Destination parameters + + + #include + #include + #include + #include + #include + #include + #include + #include + + + + + Set jump target. Action jump must be defined to use this setting + + firewall ipv4 name + + + + + + Source parameters + + + #include + #include + #include + #include + #include + #include + #include + #include + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i b/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i new file mode 100644 index 0000000..3f7c5a0 --- /dev/null +++ b/interface-definitions/include/firewall/common-rule-ipv6-raw.xml.i @@ -0,0 +1,49 @@ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + + + Destination parameters + + + #include + #include + #include + #include + #include + #include + #include + #include + + + + + Source parameters + + + #include + #include + #include + #include + #include + #include + #include + #include + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/common-rule-ipv6.xml.i b/interface-definitions/include/firewall/common-rule-ipv6.xml.i new file mode 100644 index 0000000..bb176fe --- /dev/null +++ b/interface-definitions/include/firewall/common-rule-ipv6.xml.i @@ -0,0 +1,44 @@ + +#include +#include +#include +#include + + + Destination parameters + + + #include + #include + #include + #include + #include + #include + #include + #include + + + + + Set jump target. Action jump must be defined to use this setting + + firewall ipv6 name + + + + + + Source parameters + + + #include + #include + #include + #include + #include + #include + #include + #include + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/connection-mark.xml.i b/interface-definitions/include/firewall/connection-mark.xml.i new file mode 100644 index 0000000..69f7fe6 --- /dev/null +++ b/interface-definitions/include/firewall/connection-mark.xml.i @@ -0,0 +1,15 @@ + + + + Connection mark + + u32:0-2147483647 + Connection-mark to match + + + + + + + + diff --git a/interface-definitions/include/firewall/connection-status.xml.i b/interface-definitions/include/firewall/connection-status.xml.i new file mode 100644 index 0000000..5236c2f --- /dev/null +++ b/interface-definitions/include/firewall/connection-status.xml.i @@ -0,0 +1,28 @@ + + + + Connection status + + + + + NAT connection status + + destination source + + + destination + Match connections that are subject to destination NAT + + + source + Match connections that are subject to source NAT + + + (destination|source) + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/conntrack-helper.xml.i b/interface-definitions/include/firewall/conntrack-helper.xml.i new file mode 100644 index 0000000..3ca1a03 --- /dev/null +++ b/interface-definitions/include/firewall/conntrack-helper.xml.i @@ -0,0 +1,46 @@ + + + + Match related traffic from conntrack helpers + + ftp h323 pptp nfs sip tftp sqlnet + + + ftp + Related traffic from FTP helper + + + h323 + Related traffic from H.323 helper + + + pptp + Related traffic from PPTP helper + + + nfs + Related traffic from NFS helper + + + rtsp + Related traffic from RTSP helper + + + sip + Related traffic from SIP helper + + + tftp + Related traffic from TFTP helper + + + sqlnet + Related traffic from SQLNet helper + + + (ftp|h323|pptp|nfs|rtsp|sip|tftp|sqlnet) + + + + + diff --git a/interface-definitions/include/firewall/default-action-base-chains.xml.i b/interface-definitions/include/firewall/default-action-base-chains.xml.i new file mode 100644 index 0000000..aa62abf --- /dev/null +++ b/interface-definitions/include/firewall/default-action-base-chains.xml.i @@ -0,0 +1,22 @@ + + + + Default-action for rule-set + + drop accept + + + drop + Drop if no prior rules are hit + + + accept + Accept if no prior rules are hit + + + (drop|accept) + + + accept + + diff --git a/interface-definitions/include/firewall/default-action-bridge.xml.i b/interface-definitions/include/firewall/default-action-bridge.xml.i new file mode 100644 index 0000000..858c7ae --- /dev/null +++ b/interface-definitions/include/firewall/default-action-bridge.xml.i @@ -0,0 +1,34 @@ + + + + Default-action for rule-set + + drop jump return accept continue + + + drop + Drop if no prior rules are hit + + + jump + Jump to another chain if no prior rules are hit + + + return + Return from the current chain and continue at the next rule of the last chain + + + accept + Accept if no prior rules are hit + + + continue + Continue parsing next rule + + + (drop|jump|return|accept|continue) + + + drop + + diff --git a/interface-definitions/include/firewall/default-action.xml.i b/interface-definitions/include/firewall/default-action.xml.i new file mode 100644 index 0000000..53a1614 --- /dev/null +++ b/interface-definitions/include/firewall/default-action.xml.i @@ -0,0 +1,38 @@ + + + + Default-action for rule-set + + drop jump reject return accept continue + + + drop + Drop if no prior rules are hit + + + jump + Jump to another chain if no prior rules are hit + + + reject + Drop and notify source if no prior rules are hit + + + return + Return from the current chain and continue at the next rule of the last chain + + + accept + Accept if no prior rules are hit + + + continue + Continue parsing next rule + + + (drop|jump|reject|return|accept|continue) + + + drop + + diff --git a/interface-definitions/include/firewall/default-log.xml.i b/interface-definitions/include/firewall/default-log.xml.i new file mode 100644 index 0000000..dceacdb --- /dev/null +++ b/interface-definitions/include/firewall/default-log.xml.i @@ -0,0 +1,8 @@ + + + + Log packets hitting default-action + + + + diff --git a/interface-definitions/include/firewall/dscp.xml.i b/interface-definitions/include/firewall/dscp.xml.i new file mode 100644 index 0000000..dd4da48 --- /dev/null +++ b/interface-definitions/include/firewall/dscp.xml.i @@ -0,0 +1,36 @@ + + + + DSCP value + + u32:0-63 + DSCP value to match + + + <start-end> + DSCP range to match + + + + + + + + + + DSCP value not to match + + u32:0-63 + DSCP value not to match + + + <start-end> + DSCP range not to match + + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/eq.xml.i b/interface-definitions/include/firewall/eq.xml.i new file mode 100644 index 0000000..e1b4f37 --- /dev/null +++ b/interface-definitions/include/firewall/eq.xml.i @@ -0,0 +1,14 @@ + + + + Match on equal value + + u32:0-255 + Equal to value + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/firewall-hashing-parameters.xml.i b/interface-definitions/include/firewall/firewall-hashing-parameters.xml.i new file mode 100644 index 0000000..7f34de3 --- /dev/null +++ b/interface-definitions/include/firewall/firewall-hashing-parameters.xml.i @@ -0,0 +1,35 @@ + + + + Define the parameters of the packet header to apply the hashing + + source-address destination-address source-port destination-port random + + + source-address + Use source IP address for hashing + + + destination-address + Use destination IP address for hashing + + + source-port + Use source port for hashing + + + destination-port + Use destination port for hashing + + + random + Do not use information from ip header. Use random value. + + + (source-address|destination-address|source-port|destination-port|random) + + + + random + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/firewall-mark.xml.i b/interface-definitions/include/firewall/firewall-mark.xml.i new file mode 100644 index 0000000..36a939b --- /dev/null +++ b/interface-definitions/include/firewall/firewall-mark.xml.i @@ -0,0 +1,26 @@ + + + + Firewall mark + + u32:0-2147483647 + Firewall mark to match + + + !u32:0-2147483647 + Inverted Firewall mark to match + + + <start-end> + Firewall mark range to match + + + !<start-end> + Firewall mark inverted range to match + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/fqdn.xml.i b/interface-definitions/include/firewall/fqdn.xml.i new file mode 100644 index 0000000..9eb3925 --- /dev/null +++ b/interface-definitions/include/firewall/fqdn.xml.i @@ -0,0 +1,14 @@ + + + + Fully qualified domain name + + <fqdn> + Fully qualified domain name + + + + + + + diff --git a/interface-definitions/include/firewall/fragment.xml.i b/interface-definitions/include/firewall/fragment.xml.i new file mode 100644 index 0000000..1f4c110 --- /dev/null +++ b/interface-definitions/include/firewall/fragment.xml.i @@ -0,0 +1,21 @@ + + + + IP fragment match + + + + + Second and further fragments of fragmented packets + + + + + + Head fragments or unfragmented packets + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/fwmark.xml.i b/interface-definitions/include/firewall/fwmark.xml.i new file mode 100644 index 0000000..4607ef5 --- /dev/null +++ b/interface-definitions/include/firewall/fwmark.xml.i @@ -0,0 +1,14 @@ + + + + Match fwmark value + + u32:1-2147483647 + Match firewall mark value + + + + + + + diff --git a/interface-definitions/include/firewall/geoip.xml.i b/interface-definitions/include/firewall/geoip.xml.i new file mode 100644 index 0000000..9fb37a5 --- /dev/null +++ b/interface-definitions/include/firewall/geoip.xml.i @@ -0,0 +1,28 @@ + + + + GeoIP options - Data provided by DB-IP.com + + + + + GeoIP country code + + <country> + Country code (2 characters) + + + ^(ad|ae|af|ag|ai|al|am|ao|aq|ar|as|at|au|aw|ax|az|ba|bb|bd|be|bf|bg|bh|bi|bj|bl|bm|bn|bo|bq|br|bs|bt|bv|bw|by|bz|ca|cc|cd|cf|cg|ch|ci|ck|cl|cm|cn|co|cr|cu|cv|cw|cx|cy|cz|de|dj|dk|dm|do|dz|ec|ee|eg|eh|er|es|et|fi|fj|fk|fm|fo|fr|ga|gb|gd|ge|gf|gg|gh|gi|gl|gm|gn|gp|gq|gr|gs|gt|gu|gw|gy|hk|hm|hn|hr|ht|hu|id|ie|il|im|in|io|iq|ir|is|it|je|jm|jo|jp|ke|kg|kh|ki|km|kn|kp|kr|kw|ky|kz|la|lb|lc|li|lk|lr|ls|lt|lu|lv|ly|ma|mc|md|me|mf|mg|mh|mk|ml|mm|mn|mo|mp|mq|mr|ms|mt|mu|mv|mw|mx|my|mz|na|nc|ne|nf|ng|ni|nl|no|np|nr|nu|nz|om|pa|pe|pf|pg|ph|pk|pl|pm|pn|pr|ps|pt|pw|py|qa|re|ro|rs|ru|rw|sa|sb|sc|sd|se|sg|sh|si|sj|sk|sl|sm|sn|so|sr|ss|st|sv|sx|sy|sz|tc|td|tf|tg|th|tj|tk|tl|tm|tn|to|tr|tt|tv|tw|tz|ua|ug|um|us|uy|uz|va|vc|ve|vg|vi|vn|vu|wf|ws|ye|yt|za|zm|zw)$ + + + + + + + Inverse match of country-codes + + + + + + diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i new file mode 100644 index 0000000..05fdd75 --- /dev/null +++ b/interface-definitions/include/firewall/global-options.xml.i @@ -0,0 +1,366 @@ + + + + Global Options + + + + + Policy for handling of all IPv4 ICMP echo requests + + enable disable + + + enable + Enable processing of all IPv4 ICMP echo requests + + + disable + Disable processing of all IPv4 ICMP echo requests + + + (enable|disable) + + + enable + + + + Policy for handling broadcast IPv4 ICMP echo and timestamp requests + + enable disable + + + enable + Enable processing of broadcast IPv4 ICMP echo/timestamp requests + + + disable + Disable processing of broadcast IPv4 ICMP echo/timestamp requests + + + (enable|disable) + + + disable + + + + Apply configured firewall rules to traffic switched by bridges + + + + + Accept ARP and DHCP despite they are marked as invalid connection + + + + + + Apply configured IPv4 firewall rules + + + + + + Apply configured IPv6 firewall rules + + + + + + + + Policy for handling IPv4 directed broadcast forwarding on all interfaces + + enable disable + + + enable + Enable IPv4 directed broadcast forwarding on all interfaces + + + disable + Disable IPv4 directed broadcast forwarding on all interfaces + + + (enable|disable) + + + enable + + + + Policy for handling IPv4 packets with source route option + + enable disable + + + enable + Enable processing of IPv4 packets with source route option + + + disable + Disable processing of IPv4 packets with source route option + + + (enable|disable) + + + disable + + + + Policy for logging IPv4 packets with invalid addresses + + enable disable + + + enable + Enable logging of IPv4 packets with invalid addresses + + + disable + Disable logging of Ipv4 packets with invalid addresses + + + (enable|disable) + + + enable + + + + Policy for handling received IPv4 ICMP redirect messages + + enable disable + + + enable + Enable processing of received IPv4 ICMP redirect messages + + + disable + Disable processing of received IPv4 ICMP redirect messages + + + (enable|disable) + + + disable + + + + Retains last successful value if domain resolution fails + + + + + + Domain resolver update interval + + u32:10-3600 + Interval (seconds) + + + + + + 300 + + + + Policy for sending IPv4 ICMP redirect messages + + enable disable + + + enable + Enable sending IPv4 ICMP redirect messages + + + disable + Disable sending IPv4 ICMP redirect messages + + + (enable|disable) + + + enable + + + + Policy for IPv4 source validation by reversed path, as specified in RFC3704 + + strict loose disable + + + strict + Enable IPv4 Strict Reverse Path Forwarding as defined in RFC3704 + + + loose + Enable IPv4 Loose Reverse Path Forwarding as defined in RFC3704 + + + disable + No IPv4 source validation + + + (strict|loose|disable) + + + disable + + + + Global firewall state-policy + + + + + Global firewall policy for packets part of an established connection + + + #include + #include + #include + + + + + Global firewall policy for packets part of an invalid connection + + + #include + #include + #include + + + + + Global firewall policy for packets part of a related connection + + + #include + #include + #include + + + + + + + Policy for using TCP SYN cookies with IPv4 + + enable disable + + + enable + Enable use of TCP SYN cookies with IPv4 + + + disable + Disable use of TCP SYN cookies with IPv4 + + + (enable|disable) + + + enable + + + + Connection timeout options + + + #include + + + + + RFC1337 TCP TIME-WAIT assasination hazards protection + + enable disable + + + enable + Enable RFC1337 TIME-WAIT hazards protection + + + disable + Disable RFC1337 TIME-WAIT hazards protection + + + (enable|disable) + + + disable + + + + Policy for handling received ICMPv6 redirect messages + + enable disable + + + enable + Enable processing of received ICMPv6 redirect messages + + + disable + Disable processing of received ICMPv6 redirect messages + + + (enable|disable) + + + disable + + + + Policy for IPv6 source validation by reversed path, as specified in RFC3704 + + strict loose disable + + + strict + Enable IPv6 Strict Reverse Path Forwarding as defined in RFC3704 + + + loose + Enable IPv6 Loose Reverse Path Forwarding as defined in RFC3704 + + + disable + No IPv6 source validation + + + (strict|loose|disable) + + + disable + + + + Policy for handling IPv6 packets with routing extension header + + enable disable + + + enable + Enable processing of IPv6 packets with routing header type 2 + + + disable + Disable processing of IPv6 packets with routing header + + + (enable|disable) + + + disable + + + + diff --git a/interface-definitions/include/firewall/gre.xml.i b/interface-definitions/include/firewall/gre.xml.i new file mode 100644 index 0000000..e7b9fd5 --- /dev/null +++ b/interface-definitions/include/firewall/gre.xml.i @@ -0,0 +1,116 @@ + + + + GRE fields to match + + + + + GRE flag bits to match + + + + + Header includes optional key field + + + + + Header does not include optional key field + + + + + + + + Header includes optional checksum + + + + + Header does not include optional checksum + + + + + + + + Header includes a sequence number field + + + + + Header does not include a sequence number field + + + + + + + + + + EtherType of encapsulated packet + + ip ip6 arp 802.1q 802.1ad + + + u32:0-65535 + Ethernet protocol number + + + u32:0x0-0xffff + Ethernet protocol number (hex) + + + ip + IPv4 + + + ip6 + IPv6 + + + arp + Address Resolution Protocol + + + 802.1q + VLAN-tagged frames (IEEE 802.1q) + + + 802.1ad + Provider Bridging (IEEE 802.1ad, Q-in-Q) + + + gretap + Transparent Ethernet Bridging (L2 Ethernet over GRE, gretap) + + + (ip|ip6|arp|802.1q|802.1ad|gretap|0x[0-9a-fA-F]{1,4}) + + + + + #include + + + GRE Version + + gre + Standard GRE + + + pptp + Point to Point Tunnelling Protocol + + + (gre|pptp) + + + + + + diff --git a/interface-definitions/include/firewall/gt.xml.i b/interface-definitions/include/firewall/gt.xml.i new file mode 100644 index 0000000..c879171 --- /dev/null +++ b/interface-definitions/include/firewall/gt.xml.i @@ -0,0 +1,14 @@ + + + + Match on greater then value + + u32:0-255 + Greater then value + + + + + + + diff --git a/interface-definitions/include/firewall/hop-limit.xml.i b/interface-definitions/include/firewall/hop-limit.xml.i new file mode 100644 index 0000000..d375dc9 --- /dev/null +++ b/interface-definitions/include/firewall/hop-limit.xml.i @@ -0,0 +1,12 @@ + + + + Hop limit + + + #include + #include + #include + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/icmp-type-name.xml.i b/interface-definitions/include/firewall/icmp-type-name.xml.i new file mode 100644 index 0000000..d4197cf --- /dev/null +++ b/interface-definitions/include/firewall/icmp-type-name.xml.i @@ -0,0 +1,73 @@ + + + + ICMP type-name + + echo-reply destination-unreachable source-quench redirect echo-request router-advertisement router-solicitation time-exceeded parameter-problem timestamp-request timestamp-reply info-request info-reply address-mask-request address-mask-reply + + + echo-reply + ICMP type 0: echo-reply + + + destination-unreachable + ICMP type 3: destination-unreachable + + + source-quench + ICMP type 4: source-quench + + + redirect + ICMP type 5: redirect + + + echo-request + ICMP type 8: echo-request + + + router-advertisement + ICMP type 9: router-advertisement + + + router-solicitation + ICMP type 10: router-solicitation + + + time-exceeded + ICMP type 11: time-exceeded + + + parameter-problem + ICMP type 12: parameter-problem + + + timestamp-request + ICMP type 13: timestamp-request + + + timestamp-reply + ICMP type 14: timestamp-reply + + + info-request + ICMP type 15: info-request + + + info-reply + ICMP type 16: info-reply + + + address-mask-request + ICMP type 17: address-mask-request + + + address-mask-reply + ICMP type 18: address-mask-reply + + + (echo-reply|destination-unreachable|source-quench|redirect|echo-request|router-advertisement|router-solicitation|time-exceeded|parameter-problem|timestamp-request|timestamp-reply|info-request|info-reply|address-mask-request|address-mask-reply) + + + + diff --git a/interface-definitions/include/firewall/icmp.xml.i b/interface-definitions/include/firewall/icmp.xml.i new file mode 100644 index 0000000..deb50a4 --- /dev/null +++ b/interface-definitions/include/firewall/icmp.xml.i @@ -0,0 +1,34 @@ + + + + ICMP type and code information + + + + + ICMP code + + u32:0-255 + ICMP code (0-255) + + + + + + + + + ICMP type + + u32:0-255 + ICMP type (0-255) + + + + + + + #include + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/icmpv6-type-name.xml.i b/interface-definitions/include/firewall/icmpv6-type-name.xml.i new file mode 100644 index 0000000..e17a20e --- /dev/null +++ b/interface-definitions/include/firewall/icmpv6-type-name.xml.i @@ -0,0 +1,85 @@ + + + + ICMPv6 type-name + + destination-unreachable packet-too-big time-exceeded echo-request echo-reply mld-listener-query mld-listener-report mld-listener-reduction nd-router-solicit nd-router-advert nd-neighbor-solicit nd-neighbor-advert nd-redirect parameter-problem router-renumbering ind-neighbor-solicit ind-neighbor-advert mld2-listener-report + + + destination-unreachable + ICMPv6 type 1: destination-unreachable + + + packet-too-big + ICMPv6 type 2: packet-too-big + + + time-exceeded + ICMPv6 type 3: time-exceeded + + + echo-request + ICMPv6 type 128: echo-request + + + echo-reply + ICMPv6 type 129: echo-reply + + + mld-listener-query + ICMPv6 type 130: mld-listener-query + + + mld-listener-report + ICMPv6 type 131: mld-listener-report + + + mld-listener-reduction + ICMPv6 type 132: mld-listener-reduction + + + nd-router-solicit + ICMPv6 type 133: nd-router-solicit + + + nd-router-advert + ICMPv6 type 134: nd-router-advert + + + nd-neighbor-solicit + ICMPv6 type 135: nd-neighbor-solicit + + + nd-neighbor-advert + ICMPv6 type 136: nd-neighbor-advert + + + nd-redirect + ICMPv6 type 137: nd-redirect + + + parameter-problem + ICMPv6 type 4: parameter-problem + + + router-renumbering + ICMPv6 type 138: router-renumbering + + + ind-neighbor-solicit + ICMPv6 type 141: ind-neighbor-solicit + + + ind-neighbor-advert + ICMPv6 type 142: ind-neighbor-advert + + + mld2-listener-report + ICMPv6 type 143: mld2-listener-report + + + (destination-unreachable|packet-too-big|time-exceeded|echo-request|echo-reply|mld-listener-query|mld-listener-report|mld-listener-reduction|nd-router-solicit|nd-router-advert|nd-neighbor-solicit|nd-neighbor-advert|nd-redirect|parameter-problem|router-renumbering|ind-neighbor-solicit|ind-neighbor-advert|mld2-listener-report) + + + + diff --git a/interface-definitions/include/firewall/icmpv6.xml.i b/interface-definitions/include/firewall/icmpv6.xml.i new file mode 100644 index 0000000..c011862 --- /dev/null +++ b/interface-definitions/include/firewall/icmpv6.xml.i @@ -0,0 +1,34 @@ + + + + ICMPv6 type and code information + + + + + ICMPv6 code + + u32:0-255 + ICMPv6 code (0-255) + + + + + + + + + ICMPv6 type + + u32:0-255 + ICMPv6 type (0-255) + + + + + + + #include + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/inbound-interface-no-group.xml.i b/interface-definitions/include/firewall/inbound-interface-no-group.xml.i new file mode 100644 index 0000000..bcd4c95 --- /dev/null +++ b/interface-definitions/include/firewall/inbound-interface-no-group.xml.i @@ -0,0 +1,34 @@ + + + + Match inbound-interface + + + + + Match interface + + + vrf name + + + txt + Interface name + + + txt* + Interface name with wildcard + + + !txt + Inverted interface name to match + + + (\!?)(bond|br|dum|en|ersp|eth|gnv|ifb|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)([0-9]?)(\*?)(.+)?|(\!?)lo + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/inbound-interface.xml.i b/interface-definitions/include/firewall/inbound-interface.xml.i new file mode 100644 index 0000000..13df71d --- /dev/null +++ b/interface-definitions/include/firewall/inbound-interface.xml.i @@ -0,0 +1,10 @@ + + + + Match inbound-interface + + + #include + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/ipv4-custom-name.xml.i b/interface-definitions/include/firewall/ipv4-custom-name.xml.i new file mode 100644 index 0000000..8046b2d --- /dev/null +++ b/interface-definitions/include/firewall/ipv4-custom-name.xml.i @@ -0,0 +1,43 @@ + + + + IPv4 custom firewall + + [a-zA-Z0-9][\w\-\.]* + + + + #include + #include + #include + + + Set jump target. Action jump must be defined in default-action to use this setting + + firewall ipv4 name + + + + + + IPv4 Firewall custom rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + #include + #include + + + + + diff --git a/interface-definitions/include/firewall/ipv4-hook-forward.xml.i b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i new file mode 100644 index 0000000..b0e240a --- /dev/null +++ b/interface-definitions/include/firewall/ipv4-hook-forward.xml.i @@ -0,0 +1,40 @@ + + + + IPv4 forward firewall + + + + + IPv4 firewall forward filter + + + #include + #include + #include + + + IPv4 Firewall forward filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + #include + #include + #include + + + + + + + diff --git a/interface-definitions/include/firewall/ipv4-hook-input.xml.i b/interface-definitions/include/firewall/ipv4-hook-input.xml.i new file mode 100644 index 0000000..491d1a9 --- /dev/null +++ b/interface-definitions/include/firewall/ipv4-hook-input.xml.i @@ -0,0 +1,37 @@ + + + + IPv4 input firewall + + + + + IPv4 firewall input filter + + + #include + #include + #include + + + IPv4 Firewall input filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + + + + + + + diff --git a/interface-definitions/include/firewall/ipv4-hook-output.xml.i b/interface-definitions/include/firewall/ipv4-hook-output.xml.i new file mode 100644 index 0000000..ee91575 --- /dev/null +++ b/interface-definitions/include/firewall/ipv4-hook-output.xml.i @@ -0,0 +1,65 @@ + + + + IPv4 output firewall + + + + + IPv4 firewall output filter + + + #include + #include + #include + + + IPv4 Firewall output filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + + + + + + + IPv4 firewall output raw + + + #include + #include + #include + + + IPv4 Firewall output raw rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + + + + + + + diff --git a/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i b/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i new file mode 100644 index 0000000..b431303 --- /dev/null +++ b/interface-definitions/include/firewall/ipv4-hook-prerouting.xml.i @@ -0,0 +1,52 @@ + + + + IPv4 prerouting firewall + + + + + IPv4 firewall prerouting raw + + + #include + #include + + + Set jump target. Action jump must be defined in default-action to use this setting + + firewall ipv4 name + + + + + + IPv4 Firewall prerouting raw rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + + + Set jump target. Action jump must be defined to use this setting + + firewall ipv4 name + + + + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/ipv6-custom-name.xml.i b/interface-definitions/include/firewall/ipv6-custom-name.xml.i new file mode 100644 index 0000000..fb8740c --- /dev/null +++ b/interface-definitions/include/firewall/ipv6-custom-name.xml.i @@ -0,0 +1,43 @@ + + + + IPv6 custom firewall + + [a-zA-Z0-9][\w\-\.]* + + + + #include + #include + #include + + + Set jump target. Action jump must be defined in default-action to use this setting + + firewall ipv6 name + + + + + + IPv6 Firewall custom rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + #include + #include + + + + + diff --git a/interface-definitions/include/firewall/ipv6-hook-forward.xml.i b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i new file mode 100644 index 0000000..7efc261 --- /dev/null +++ b/interface-definitions/include/firewall/ipv6-hook-forward.xml.i @@ -0,0 +1,40 @@ + + + + IPv6 forward firewall + + + + + IPv6 firewall forward filter + + + #include + #include + #include + + + IPv6 Firewall forward filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + #include + #include + #include + + + + + + + diff --git a/interface-definitions/include/firewall/ipv6-hook-input.xml.i b/interface-definitions/include/firewall/ipv6-hook-input.xml.i new file mode 100644 index 0000000..154b102 --- /dev/null +++ b/interface-definitions/include/firewall/ipv6-hook-input.xml.i @@ -0,0 +1,37 @@ + + + + IPv6 input firewall + + + + + IPv6 firewall input filter + + + #include + #include + #include + + + IPv6 Firewall input filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + + + + + + + diff --git a/interface-definitions/include/firewall/ipv6-hook-output.xml.i b/interface-definitions/include/firewall/ipv6-hook-output.xml.i new file mode 100644 index 0000000..d3c4c1e --- /dev/null +++ b/interface-definitions/include/firewall/ipv6-hook-output.xml.i @@ -0,0 +1,65 @@ + + + + IPv6 output firewall + + + + + IPv6 firewall output filter + + + #include + #include + #include + + + IPv6 Firewall output filter rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + + + + + + + IPv6 firewall output raw + + + #include + #include + #include + + + IPv6 Firewall output raw rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + + + + + + + diff --git a/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i b/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i new file mode 100644 index 0000000..21f8de6 --- /dev/null +++ b/interface-definitions/include/firewall/ipv6-hook-prerouting.xml.i @@ -0,0 +1,52 @@ + + + + IPv6 prerouting firewall + + + + + IPv6 firewall prerouting raw + + + #include + #include + + + Set jump target. Action jump must be defined in default-action to use this setting + + firewall ipv6 name + + + + + + IPv6 Firewall prerouting raw rule number + + u32:1-999999 + Number for this firewall rule + + + + + Firewall rule number must be between 1 and 999999 + + + #include + #include + #include + + + Set jump target. Action jump must be defined to use this setting + + firewall ipv6 name + + + + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/limit.xml.i b/interface-definitions/include/firewall/limit.xml.i new file mode 100644 index 0000000..21068de --- /dev/null +++ b/interface-definitions/include/firewall/limit.xml.i @@ -0,0 +1,33 @@ + + + + Rate limit using a token bucket filter + + + + + Maximum number of packets to allow in excess of rate + + u32:0-4294967295 + Maximum number of packets to allow in excess of rate + + + + + + + + + Maximum average matching rate + + txt + integer/unit (Example: 5/minute) + + + \d+/(second|minute|hour|day) + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/log-options.xml.i b/interface-definitions/include/firewall/log-options.xml.i new file mode 100644 index 0000000..e8b0cde --- /dev/null +++ b/interface-definitions/include/firewall/log-options.xml.i @@ -0,0 +1,89 @@ + + + + Log options + + + + + Set log group + + u32:0-65535 + Log group to send messages to + + + + + + + + + Length of packet payload to include in netlink message + + u32:0-9000 + Length of packet payload to include in netlink message + + + + + + + + + Number of packets to queue inside the kernel before sending them to userspace + + u32:0-65535 + Number of packets to queue inside the kernel before sending them to userspace + + + + + + + + + Set log-level + + emerg alert crit err warn notice info debug + + + emerg + Emerg log level + + + alert + Alert log level + + + crit + Critical log level + + + err + Error log level + + + warn + Warning log level + + + notice + Notice log level + + + info + Info log level + + + debug + Debug log level + + + (emerg|alert|crit|err|warn|notice|info|debug) + + level must be alert, crit, debug, emerg, err, info, notice or warn + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/log.xml.i b/interface-definitions/include/firewall/log.xml.i new file mode 100644 index 0000000..21548f3 --- /dev/null +++ b/interface-definitions/include/firewall/log.xml.i @@ -0,0 +1,8 @@ + + + + Log packets hitting this rule + + + + diff --git a/interface-definitions/include/firewall/lt.xml.i b/interface-definitions/include/firewall/lt.xml.i new file mode 100644 index 0000000..77894d3 --- /dev/null +++ b/interface-definitions/include/firewall/lt.xml.i @@ -0,0 +1,14 @@ + + + + Match on less then value + + u32:0-255 + Less then value + + + + + + + diff --git a/interface-definitions/include/firewall/mac-address.xml.i b/interface-definitions/include/firewall/mac-address.xml.i new file mode 100644 index 0000000..db3e1e3 --- /dev/null +++ b/interface-definitions/include/firewall/mac-address.xml.i @@ -0,0 +1,19 @@ + + + + MAC address + + macaddr + MAC address to match + + + !macaddr + Match everything except the specified MAC address + + + + + + + + diff --git a/interface-definitions/include/firewall/mac-group.xml.i b/interface-definitions/include/firewall/mac-group.xml.i new file mode 100644 index 0000000..dbce3fc --- /dev/null +++ b/interface-definitions/include/firewall/mac-group.xml.i @@ -0,0 +1,10 @@ + + + + Group of MAC addresses + + firewall group mac-group + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/match-ether-type.xml.i b/interface-definitions/include/firewall/match-ether-type.xml.i new file mode 100644 index 0000000..abfa903 --- /dev/null +++ b/interface-definitions/include/firewall/match-ether-type.xml.i @@ -0,0 +1,30 @@ + + + + Ethernet type + + 802.1q 802.1ad arp ipv4 ipv6 + + + 802.1q + Customer VLAN tag type + + + 802.1ad + Service VLAN tag type + + + arp + Adress Resolution Protocol + + + _ipv4 + Internet Protocol version 4 + + + _ipv6 + Internet Protocol version 6 + + + + diff --git a/interface-definitions/include/firewall/match-interface.xml.i b/interface-definitions/include/firewall/match-interface.xml.i new file mode 100644 index 0000000..f25686e --- /dev/null +++ b/interface-definitions/include/firewall/match-interface.xml.i @@ -0,0 +1,43 @@ + + + + Match interface + + + vrf name + + + txt + Interface name + + + txt* + Interface name with wildcard + + + !txt + Inverted interface name to match + + + (\!?)(bond|br|dum|en|ersp|eth|gnv|ifb|ipoe|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)([0-9]?)(\*?)(.+)?|(\!?)lo + + + + + + + Match interface-group + + firewall group interface-group + + + txt + Interface-group name to match + + + !txt + Inverted interface-group name to match + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/match-ipsec-in.xml.i b/interface-definitions/include/firewall/match-ipsec-in.xml.i new file mode 100644 index 0000000..62ed646 --- /dev/null +++ b/interface-definitions/include/firewall/match-ipsec-in.xml.i @@ -0,0 +1,21 @@ + + + + Inbound IPsec packets + + + + + Inbound traffic that was IPsec encapsulated + + + + + + Inbound traffic that was not IPsec encapsulated + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/match-ipsec-out.xml.i b/interface-definitions/include/firewall/match-ipsec-out.xml.i new file mode 100644 index 0000000..880fdd4 --- /dev/null +++ b/interface-definitions/include/firewall/match-ipsec-out.xml.i @@ -0,0 +1,21 @@ + + + + Outbound IPsec packets + + + + + Outbound traffic to be IPsec encapsulated + + + + + + Outbound traffic that will not be IPsec encapsulated + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/match-ipsec.xml.i b/interface-definitions/include/firewall/match-ipsec.xml.i new file mode 100644 index 0000000..d8d31ef --- /dev/null +++ b/interface-definitions/include/firewall/match-ipsec.xml.i @@ -0,0 +1,33 @@ + + + + IPsec encapsulated packets + + + + + Inbound traffic that was IPsec encapsulated + + + + + + Inbound traffic that was not IPsec encapsulated + + + + + + Outbound traffic to be IPsec encapsulated + + + + + + Outbound traffic that will not be IPsec encapsulated + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/match-vlan.xml.i b/interface-definitions/include/firewall/match-vlan.xml.i new file mode 100644 index 0000000..d58e843 --- /dev/null +++ b/interface-definitions/include/firewall/match-vlan.xml.i @@ -0,0 +1,42 @@ + + + + VLAN parameters + + + + + Vlan id + + u32:0-4096 + Vlan id + + + <start-end> + Vlan id range to match + + + + + + + + + Vlan priority(pcp) + + u32:0-7 + Vlan priority + + + <start-end> + Vlan priority range to match + + + + + + + #include + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/name.xml.i b/interface-definitions/include/firewall/name.xml.i new file mode 100644 index 0000000..231b9b1 --- /dev/null +++ b/interface-definitions/include/firewall/name.xml.i @@ -0,0 +1,18 @@ + + + + Local IPv4 firewall ruleset name for interface + + firewall name + + + + + + Local IPv6 firewall ruleset name for interface + + firewall ipv6-name + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/nat-balance.xml.i b/interface-definitions/include/firewall/nat-balance.xml.i new file mode 100644 index 0000000..01793f0 --- /dev/null +++ b/interface-definitions/include/firewall/nat-balance.xml.i @@ -0,0 +1,28 @@ + + + + Translated IP address + + ipv4 + IPv4 address to match + + + + + + + + + Set probability for this output value + + u32:1-100 + Set probability for this output value + + + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/nft-queue.xml.i b/interface-definitions/include/firewall/nft-queue.xml.i new file mode 100644 index 0000000..8799eac --- /dev/null +++ b/interface-definitions/include/firewall/nft-queue.xml.i @@ -0,0 +1,34 @@ + + + + Queue target to use. Action queue must be defined to use this setting + + u32:0-65535 + Queue target + + + + + + + + + Options used for queue target. Action queue must be defined to use this setting + + bypass fanout + + + bypass + Let packets go through if userspace application cannot back off + + + fanout + Distribute packets between several queues + + + (bypass|fanout) + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/offload-target.xml.i b/interface-definitions/include/firewall/offload-target.xml.i new file mode 100644 index 0000000..940ed80 --- /dev/null +++ b/interface-definitions/include/firewall/offload-target.xml.i @@ -0,0 +1,10 @@ + + + + Set flowtable offload target. Action offload must be defined to use this setting + + firewall flowtable + + + + diff --git a/interface-definitions/include/firewall/outbound-interface-no-group.xml.i b/interface-definitions/include/firewall/outbound-interface-no-group.xml.i new file mode 100644 index 0000000..e3bace4 --- /dev/null +++ b/interface-definitions/include/firewall/outbound-interface-no-group.xml.i @@ -0,0 +1,34 @@ + + + + Match outbound-interface + + + + + Match interface + + + vrf name + + + txt + Interface name + + + txt* + Interface name with wildcard + + + !txt + Inverted interface name to match + + + (\!?)(bond|br|dum|en|ersp|eth|gnv|ifb|lan|l2tp|l2tpeth|macsec|peth|ppp|pppoe|pptp|sstp|tun|veth|vti|vtun|vxlan|wg|wlan|wwan)([0-9]?)(\*?)(.+)?|(\!?)lo + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/outbound-interface.xml.i b/interface-definitions/include/firewall/outbound-interface.xml.i new file mode 100644 index 0000000..8654dfd --- /dev/null +++ b/interface-definitions/include/firewall/outbound-interface.xml.i @@ -0,0 +1,10 @@ + + + + Match outbound-interface + + + #include + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/packet-options.xml.i b/interface-definitions/include/firewall/packet-options.xml.i new file mode 100644 index 0000000..cd94e69 --- /dev/null +++ b/interface-definitions/include/firewall/packet-options.xml.i @@ -0,0 +1,63 @@ + + + + Payload size in bytes, including header and data to match + + u32:1-65535 + Packet length to match + + + <start-end> + Packet length range to match + + + + + + + + + + Payload size in bytes, including header and data not to match + + u32:1-65535 + Packet length not to match + + + <start-end> + Packet length range not to match + + + + + + + + + + Packet type + + broadcast host multicast other + + + broadcast + Match broadcast packet type + + + host + Match host packet type, addressed to local host + + + multicast + Match multicast packet type + + + other + Match packet addressed to another host + + + (broadcast|host|multicast|other) + + + + diff --git a/interface-definitions/include/firewall/port.xml.i b/interface-definitions/include/firewall/port.xml.i new file mode 100644 index 0000000..3bacaff --- /dev/null +++ b/interface-definitions/include/firewall/port.xml.i @@ -0,0 +1,26 @@ + + + + Port + + txt + Named port (any name in /etc/services, e.g., http) + + + u32:1-65535 + Numbered port + + + <start-end> + Numbered port range (e.g. 1001-1005) + + + + \n\n Multiple destination ports can be specified as a comma-separated list.\n For example: 'telnet,http,123,1001-1005' + + + + + + + diff --git a/interface-definitions/include/firewall/protocol.xml.i b/interface-definitions/include/firewall/protocol.xml.i new file mode 100644 index 0000000..e391cae --- /dev/null +++ b/interface-definitions/include/firewall/protocol.xml.i @@ -0,0 +1,34 @@ + + + + Protocol to match (protocol name, number, or "all") + + + all tcp_udp + + + all + All IP protocols + + + tcp_udp + Both TCP and UDP + + + u32:0-255 + IP protocol number + + + <protocol> + IP protocol name + + + !<protocol> + IP protocol name + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/recent.xml.i b/interface-definitions/include/firewall/recent.xml.i new file mode 100644 index 0000000..38f40b9 --- /dev/null +++ b/interface-definitions/include/firewall/recent.xml.i @@ -0,0 +1,44 @@ + + + + Parameters for matching recently seen sources + + + + + Source addresses seen more than N times + + u32:1-255 + Source addresses seen more than N times + + + + + + + + + Source addresses seen in the last second/minute/hour + + second minute hour + + + second + Source addresses seen COUNT times in the last second + + + minute + Source addresses seen COUNT times in the last minute + + + hour + Source addresses seen COUNT times in the last hour + + + (second|minute|hour) + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/rule-log-level.xml.i b/interface-definitions/include/firewall/rule-log-level.xml.i new file mode 100644 index 0000000..3ac4738 --- /dev/null +++ b/interface-definitions/include/firewall/rule-log-level.xml.i @@ -0,0 +1,45 @@ + + + + Set log-level. Log must be enable. + + emerg alert crit err warn notice info debug + + + emerg + Emerg log level + + + alert + Alert log level + + + crit + Critical log level + + + err + Error log level + + + warn + Warning log level + + + notice + Notice log level + + + info + Info log level + + + debug + Debug log level + + + (emerg|alert|crit|err|warn|notice|info|debug) + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/set-packet-modifications.xml.i b/interface-definitions/include/firewall/set-packet-modifications.xml.i new file mode 100644 index 0000000..ee019b6 --- /dev/null +++ b/interface-definitions/include/firewall/set-packet-modifications.xml.i @@ -0,0 +1,96 @@ + + + + Packet modifications + + + + + Set connection mark + + u32:0-2147483647 + Connection mark + + + + + + + + + Set DSCP (Packet Differentiated Services Codepoint) bits + + u32:0-63 + DSCP number + + + + + + + + + Set packet mark + + u32:1-2147483647 + Packet mark + + + + + + + + + Set the routing table for matched packets + + u32:1-200 + Table number + + + main + Main table + + + + (main) + + + main + protocols static table + + + + + + VRF to forward packet with + + txt + VRF instance name + + + default + Forward into default global VRF + + + default + vrf name + + #include + + + + + Set TCP Maximum Segment Size + + u32:500-1460 + Explicitly set TCP MSS value + + + + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/source-destination-dynamic-group-ipv6.xml.i b/interface-definitions/include/firewall/source-destination-dynamic-group-ipv6.xml.i new file mode 100644 index 0000000..845f8fe --- /dev/null +++ b/interface-definitions/include/firewall/source-destination-dynamic-group-ipv6.xml.i @@ -0,0 +1,17 @@ + + + + Group + + + + + Group of dynamic ipv6 addresses + + firewall group dynamic-group ipv6-address-group + + + + + + diff --git a/interface-definitions/include/firewall/source-destination-dynamic-group.xml.i b/interface-definitions/include/firewall/source-destination-dynamic-group.xml.i new file mode 100644 index 0000000..29ab98c --- /dev/null +++ b/interface-definitions/include/firewall/source-destination-dynamic-group.xml.i @@ -0,0 +1,17 @@ + + + + Group + + + + + Group of dynamic addresses + + firewall group dynamic-group address-group + + + + + + diff --git a/interface-definitions/include/firewall/source-destination-group-inet.xml.i b/interface-definitions/include/firewall/source-destination-group-inet.xml.i new file mode 100644 index 0000000..1740516 --- /dev/null +++ b/interface-definitions/include/firewall/source-destination-group-inet.xml.i @@ -0,0 +1,50 @@ + + + + Group + + + + + Group of IPv4 addresses + + firewall group address-group + + + + + + Group of IPv6 addresses + + firewall group ipv6-address-group + + + + #include + + + Group of IPv4 networks + + firewall group network-group + + + + + + Group of IPv6 networks + + firewall group ipv6-network-group + + + + + + Group of ports + + firewall group port-group + + + + + + diff --git a/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i new file mode 100644 index 0000000..8c34fb9 --- /dev/null +++ b/interface-definitions/include/firewall/source-destination-group-ipv4.xml.i @@ -0,0 +1,41 @@ + + + + Group + + + + + Group of addresses + + firewall group address-group + + + + + + Group of domains + + firewall group domain-group + + + + + + Group of networks + + firewall group network-group + + + + + + Group of ports + + firewall group port-group + + + + + + diff --git a/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i b/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i new file mode 100644 index 0000000..2a42d23 --- /dev/null +++ b/interface-definitions/include/firewall/source-destination-group-ipv6.xml.i @@ -0,0 +1,42 @@ + + + + Group + + + + + Group of addresses + + firewall group ipv6-address-group + + + + + + Group of domains + + firewall group domain-group + + + + #include + + + Group of networks + + firewall group ipv6-network-group + + + + + + Group of ports + + firewall group port-group + + + + + + diff --git a/interface-definitions/include/firewall/source-destination-group.xml.i b/interface-definitions/include/firewall/source-destination-group.xml.i new file mode 100644 index 0000000..6ebee35 --- /dev/null +++ b/interface-definitions/include/firewall/source-destination-group.xml.i @@ -0,0 +1,42 @@ + + + + Group + + + + + Group of addresses + + firewall group address-group + + + + + + Group of domains + + firewall group domain-group + + + + #include + + + Group of networks + + firewall group network-group + + + + + + Group of ports + + firewall group port-group + + + + + + diff --git a/interface-definitions/include/firewall/state.xml.i b/interface-definitions/include/firewall/state.xml.i new file mode 100644 index 0000000..dee9722 --- /dev/null +++ b/interface-definitions/include/firewall/state.xml.i @@ -0,0 +1,30 @@ + + + + Session state + + established invalid new related + + + established + Established state + + + invalid + Invalid state + + + new + New state + + + related + Related state + + + (established|invalid|new|related) + + + + + diff --git a/interface-definitions/include/firewall/synproxy.xml.i b/interface-definitions/include/firewall/synproxy.xml.i new file mode 100644 index 0000000..a65126e --- /dev/null +++ b/interface-definitions/include/firewall/synproxy.xml.i @@ -0,0 +1,40 @@ + + + + Synproxy options + + + + + TCP synproxy options + + + + + TCP Maximum segment size + + u32:501-65535 + Maximum segment size for synproxy connections + + + + + + + + + TCP window scale for synproxy connections + + u32:1-14 + TCP window scale + + + + + + + + + + + diff --git a/interface-definitions/include/firewall/tcp-flags.xml.i b/interface-definitions/include/firewall/tcp-flags.xml.i new file mode 100644 index 0000000..36546c2 --- /dev/null +++ b/interface-definitions/include/firewall/tcp-flags.xml.i @@ -0,0 +1,119 @@ + + + + TCP options to match + + + + + TCP flags to match + + + + + Synchronise flag + + + + + + Acknowledge flag + + + + + + Finish flag + + + + + + Reset flag + + + + + + Urgent flag + + + + + + Push flag + + + + + + Explicit Congestion Notification flag + + + + + + Congestion Window Reduced flag + + + + + + Match flags not set + + + + + Synchronise flag + + + + + + Acknowledge flag + + + + + + Finish flag + + + + + + Reset flag + + + + + + Urgent flag + + + + + + Push flag + + + + + + Explicit Congestion Notification flag + + + + + + Congestion Window Reduced flag + + + + + + + + + + diff --git a/interface-definitions/include/firewall/tcp-mss.xml.i b/interface-definitions/include/firewall/tcp-mss.xml.i new file mode 100644 index 0000000..dc49b42 --- /dev/null +++ b/interface-definitions/include/firewall/tcp-mss.xml.i @@ -0,0 +1,25 @@ + + + + TCP options to match + + + + + Maximum segment size (MSS) + + u32:1-16384 + Maximum segment size + + + <min>-<max> + TCP MSS range (use '-' as delimiter) + + + + + + + + + diff --git a/interface-definitions/include/firewall/time.xml.i b/interface-definitions/include/firewall/time.xml.i new file mode 100644 index 0000000..7bd7374 --- /dev/null +++ b/interface-definitions/include/firewall/time.xml.i @@ -0,0 +1,70 @@ + + + + Time to match rule + + + + + Date to start matching rule + + txt + Enter date using following notation - YYYY-MM-DD + + + (\d{4}\-\d{2}\-\d{2}) + + + + + + Time of day to start matching rule + + txt + Enter time using using 24 hour notation - hh:mm:ss + + + ([0-2][0-9](\:[0-5][0-9]){1,2}) + + + + + + Date to stop matching rule + + txt + Enter date using following notation - YYYY-MM-DD + + + (\d{4}\-\d{2}\-\d{2}) + + + + + + Time of day to stop matching rule + + txt + Enter time using using 24 hour notation - hh:mm:ss + + + ([0-2][0-9](\:[0-5][0-9]){1,2}) + + + + + + Comma separated weekdays to match rule on + + txt + Name of day (Monday, Tuesday, Wednesday, Thursdays, Friday, Saturday, Sunday) + + + u32:0-6 + Day number (0 = Sunday ... 6 = Saturday) + + + + + + \ No newline at end of file diff --git a/interface-definitions/include/firewall/timeout-common-protocols.xml.i b/interface-definitions/include/firewall/timeout-common-protocols.xml.i new file mode 100644 index 0000000..037d7d2 --- /dev/null +++ b/interface-definitions/include/firewall/timeout-common-protocols.xml.i @@ -0,0 +1,171 @@ + + + + ICMP timeout in seconds + + u32:1-21474836 + ICMP timeout in seconds + + + + + + 30 + + + + Generic connection timeout in seconds + + u32:1-21474836 + Generic connection timeout in seconds + + + + + + 600 + + + + TCP connection timeout options + + + + + TCP CLOSE-WAIT timeout in seconds + + u32:1-21474836 + TCP CLOSE-WAIT timeout in seconds + + + + + + 60 + + + + TCP CLOSE timeout in seconds + + u32:1-21474836 + TCP CLOSE timeout in seconds + + + + + + 10 + + + + TCP ESTABLISHED timeout in seconds + + u32:1-21474836 + TCP ESTABLISHED timeout in seconds + + + + + + 432000 + + + + TCP FIN-WAIT timeout in seconds + + u32:1-21474836 + TCP FIN-WAIT timeout in seconds + + + + + + 120 + + + + TCP LAST-ACK timeout in seconds + + u32:1-21474836 + TCP LAST-ACK timeout in seconds + + + + + + 30 + + + + TCP SYN-RECEIVED timeout in seconds + + u32:1-21474836 + TCP SYN-RECEIVED timeout in seconds + + + + + + 60 + + + + TCP SYN-SENT timeout in seconds + + u32:1-21474836 + TCP SYN-SENT timeout in seconds + + + + + + 120 + + + + TCP TIME-WAIT timeout in seconds + + u32:1-21474836 + TCP TIME-WAIT timeout in seconds + + + + + + 120 + + + + + + UDP timeout options + + + + + UDP generic timeout in seconds + + u32:1-21474836 + UDP generic timeout in seconds + + + + + + 30 + + + + UDP stream timeout in seconds + + u32:1-21474836 + UDP stream timeout in seconds + + + + + + 180 + + + diff --git a/interface-definitions/include/firewall/ttl.xml.i b/interface-definitions/include/firewall/ttl.xml.i new file mode 100644 index 0000000..9c782a9 --- /dev/null +++ b/interface-definitions/include/firewall/ttl.xml.i @@ -0,0 +1,12 @@ + + + + Time to live limit + + + #include + #include + #include + + + \ No newline at end of file -- cgit v1.2.3