--- name: "fiaif.conf" section: "5" platform: "linux" package: "fiaif" version: "1.23.1-4" release: "Debian 8 (Jessie)" platforms: ["linux"] url: "https://new.carta.tech/fiaif.conf" --- # fiaif.conf(5) fiaif global configuration file ## NAME **fiaif.conf - fiaif global configuration file** ## DESCRIPTION **fiaif.conf** is the file that declares which zones should be set up in the firewall. A "zone" is a piece of the "IP universe" existing on the other side of a particular interface. A zone is defined in a file listing rules for the handling of IP traffic into, out of, and through the associated interface. The zonefile is described in **zone.conf**(8)**.** General configuration parameters are also declared in this file. **fiaif.conf** and the zonefiles are [**bash**(1)](/bash/1.md) scripts in which the values of variables used in the fiaif program are assigned. Although they are shell scripts, they should contain nothing but assignment statements. Parameters in the configuration files are of three forms: **SIMPLE** These parameters take only a single value. The value may be a number or a string. **GROUP** These parameters are treated as a group, and all members of the group are processed in the same way. There are two parts to these parameters´ names. The first part is the name of the group, and the second part is a mnemonic. **ARRAY** Parameter values are declared in an array. Any number of values can be specified by incrementing the array index for each value. ## DEFINITIONS bashcommand -\> \[a shell command line\] dirpath -\> \[path to a directory (no trailing ´/´)\] fname -\> \[filename with no path\] modulename -\> \[the name of an iptables module\] portspec -\> \[a port number \| a service in /etc/services\] posint -\> \[an integer \>= 0\] TOStype -\> \[a Type-of-service name \| a Type-of-service number\] zonename -\> \[the zone identifier from a zone file\] byteint -\> 0..255 cidrmask -\> 0..32 nullstring -\> \[nothing\] string -\> \[char\]\\|\ boolean -\> 0\|1 burstspec -\> \\|\/\ IP4addr -\> \.\.\.\ iptablesprotocol -\> \[a protocol number \| a protocol name from /etc/protocols\] modulelist -\> \\|\ \ netaddr -\> \/\ netlist -\> \\|\ \ pathlist -\> \\|\:\ plist -\> \\|\ \ tablelist -\> mangle filter nat timespec -\> second\|minute\|hour\|day TOSportlist -\> \ \| any \| \ TOSportlistOpt -\> \ \| \,\ ICMPtype -\> \ zonelist -\> \\|\ \ ## CONSTANT PARAMETERS The values of these parameters should (almost certainly) not be altered. ### TABLES Syntax: **TABLES=** *"\"* A list of the packet processing tables in the Linux kernel. As of version 2.4.18, only three tables are available: **mangle**, **filter**, and **nat**. ### RESERVED\_NETWORKS Syntax: **RESERVED\_NETWORKS=** *"\"\|"\"* A list of the reserved ipnumbers and masks, or a file containing this list, one \ per line. See http://www.iana.com for more information. ### PRIVATE\_NETWORKS Syntax: **PRIVATE\_NETWORKS=** *"\"\|"\"* A list of the private ipnumbers and masks, or a file containing this list, one \ per line. See http://www.iana.com and rfc1918 for more information. ### LOOPBACK\_NET Syntax: **LOOPBACK\_NET=** *"\"* The network of the loopback interface. "127.0.0.1/8" in the distribution. ### BIN\_PATH Syntax: **BIN\_PATH=** *"\"* The search path for the iptables and tc binaries. ## PARAMETERS The values of these parameters should be altered. They define the firewall deployed by fiaif and customize it for local networks and security policy. ### DONT\_START Syntax: **DONT\_START=** *\* If set to one, the firewall will not be started. **DONT\_START** is set to 1 in the distributed fiaf.conf to prevent the inadvertant deployment of an unconfigured firewall from a download. Set the value to zero or delete the line to enable the firewall. ### CONF\_DIR Syntax: **CONF\_DIR=** *"\/"* The path to the configuration directory. **CONF\_DIR** is set to "/etc/fiaif/" in the distribution. ### SET\_PROC\_ERRORS Syntax: **SET\_PROC\_ERRORS=** *\* ### SET\_PROC\_WARNINGS Syntax: **SET\_PROC\_WARNINGS=** *\* When the command "fiaif test" is issued, a list of errors and warnings are displayed. If **SET\_PROC\_ERRORS** is 1, FIAIF will attempt to correct the errors. If **SET\_PROC\_WARNINGS** is 1, FIAIF will attempt to correct the warnings. ### SAVE\_STATE Syntax: **SAVE\_STATE=** *\* If enabled, FIAIF will save all iptables rules to a file after these have been applied, if no errors were encountered while generating the rules. When FIAIF is started again, this file is used if and only if no modifications have been made to any configuration files. Rules are saved to **/var/lib/fiaif/iptables.** Enabling this option greatly improves start time of FIAIF, but may cause problems if, for example, the ipnumber of a static interface changes, in which case **/etc/init.d/fiaif** **force-reload** should be used to rebuild ruleset from configuration files. ### ZONES Syntax: **ZONES=** *"\"* A list of the zones to be set up. There must be a zone file in the configuration directory matching each zone named in this list. Example: **ZONES="INT EXT"** ### CONF\_\[XXX\] Syntax: **CONF\_\[XXX\]=** *"\"* A group (CONF) containing the names of the zone files. It should match closly the names listed in the **ZONES** parameter. The zone files must be in the directory specified in **CONF\_DIR**. Example: **CONF\_INT="zone.internal"** **CONT\_EXT="zone.external"** ### TEST\_FILE Syntax: **TEST\_FILE=** *"\/\"* The absolute pathname of the file to which commands are written when fiaif is run with the **´test´** option. Set to "/tmp/fiaif.out" in the distribution. ### DEBUG Syntax: **DEBUG=** *\* If set to 1, fiaif will not drop any packets, but all rules are still applied, and the results will be in the syslog. Use this as a debugging tool if you are experiencing problems while setting up the zones. Set to zero for fiaif to work normally. ### VERBOSE Syntax: **VERBOSE=** *\* Set this variable to 1 to have fiaif log all dropped or redirected packets in the syslog. If no logging is wanted, set it to 0. See LOG\_LIMIT and LOG\_BURST for details on when logging occurs. ### LOG\_PREFIX Syntax: **FIAIF\_** *\* Specify the prefix to use when logging packets to system log or though ulogd. ### ENABLE\_ULOGD Syntax: **ENABLE\_ULOGD=** *\* If set to 1 (and the ulogd is running on the system), fiaif logs via a ulogd. If set to 0, fiaif logs through the standard syslog facility. ### LOG\_LIMIT Syntax: **LOG\_LIMIT=** *\* ### LOG\_BURST Syntax: **LOG\_BURST=** *"\"* Specify how often dropped or rejected packets should be entered into the system log. Tune to avoid spamming of logs. **LOG\_LIMIT** is the maximum average matching rate. If no \ is provided, ´/second´ is assumed. **LOG\_BURST** is the maximum initial number of packets to match; this number is incrememted by one every time the limit specified above is not reached, up to this number. Note the quotes around **LOG\_BURST´s** value. ### LOG\_LEVEL Syntax: **LOG\_LEVEL=** *\* This specifies the loglevel, for logging to **syslog** or **ulogd.** When using syslog, the number specifies the priority, see **[syslog.conf(5)](/syslog.conf/5.md).** If **ENABLE\_ULOG** is true, **LOG\_LEVEL** number specifies the netlink group (1-32), to which the line to be logged is is sent. ### MODULES Syntax: **MODULES=** *"\"* Specifies iptables modules to be loaded upon starting the firewall. The modules remain loaded as long as the firewall is deployed. ### PRE\_SCRIPT\[N\] Syntax: **PRE\_SCRIPT\[N\]=** *"\"* ### POST\_SCRIPT\[N\] Syntax: **POST\_SCRIPT\[N\]=** *"\"* This pair of array parameters may contain shell commands to be executed before/after fiaif creates the iptables rules. The lines are executed in array-index sequence. Three chains per zone exists to support user-defined rules. The chain names are: **USER\_INPUT\_\** **USER\_OUTPUT\_\** **USER\_FORWARD\_\** Where the zone name is the name of the zone. Packets will go though these chains before hitting rules generated by INPUT, OUTPUT and FORWARD rules in the zone configuration files. Remember that only packets in the NEW state will hit these chains, and hence there is no need to test the state of a packet in these chains. ### ALIASES Points to a file with IP alias specifications. These aliases are available to all zone configuration files, and can be used in rules where the syntax **\[\\[/\\]=\>\[\\[/\\]** is used, as replacement for either side. See IPSET in zone.conf(8) for more information. ### TOS\_FILE Syntax: **TOS\_FILE=** *"\"* Specify the name of the Type-Of-Service configuration file located in the configuration directory. This file specifies manipulation of the TOS bits in TCP and UDP packets. Traffic control examines these fields to determine into which class a packet should fall. The file contains a group (TOS) with values of the form: **TOS\_\[XXX\]=** *"\ \ \"* Examples: **TOS\_MIN\_DLY\_UDP=** "Minimize-Delay udp" **TOS\_NORM\_SRVC\_TCP=** "Normal-Service tcp www,https" ## FILES */etc/fiaif/fiaif.conf* The configuration file for FIAIF */etc/fiaif/private\_networks* A list of private networks as specified by RFC1918 */etc/fiaif/reserved\_networks* A list of reserved networks as specified by IANA. */etc/fiaif/aliases* Specifies IP aliases to be used for all configuration files. ## AUTHOR Anders Fugmann \ ## SEE ALSO [**fiaif**(8)](/fiaif/8.md), **zone.conf**(8)