--- name: "firehol-services" section: "5" platform: "linux" package: "firehol-doc" version: "3.1.8+ds-1" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/firehol-services" --- # firehol-services(5) FireHOL services list ## NAME firehol-services - FireHOL services list ## SYNOPSIS AH all amanda any anystateless apcupsd apcupsdnis aptproxy asterisk cups custom cvspserver darkstat daytime dcc dcpp dhcp dhcprelay dhcpv6 dict distcc dns echo emule eserver ESP finger ftp gift giftui gkrellmd GRE h323 heartbeat http httpalt https hylafax iax iax2 ICMP icmp ICMPV6 icmpv6 icp ident imap imaps ipsecnatt ipv6error ipv6mld ipv6neigh ipv6router irc isakmp jabber jabberd l2tp ldap ldaps lpd microsoft\_ds mms msn msnp ms\_ds multicast mysql netbackup netbios\_dgm netbios\_ns netbios\_ssn nfs nis nntp nntps nrpe ntp nut nxserver openvpn oracle OSPF ping pop3 pop3s portmap postgres pptp privoxy radius radiusold radiusoldproxy radiusproxy rdp rndc rsync rtp samba sane sip smtp smtps snmp snmptrap socks squid ssh stun submission sunrpc swat syslog telnet tftp time timestamp tomcat upnp uucp vmware vmwareauth vmwareweb vnc webcache webmin whois xbox xdmcp ## DESCRIPTION ### service: AH - IPSec Authentication Header (AH) Example: - ``` server AH accept ``` Service Type: - • simple Server Ports: - • 51/any Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-AH\] Notes For more information see this http://web.archive.org/web/20100918134143/http://www.freeswan.org/freeswan\_trees/freeswan-1.99/doc/ipsec.html#AH.ipsec Archive of the FreeS/WAN documentation ⟨⟩\\c and RFC 2402 ⟨http://www.ietf.org/rfc/rfc2402.txt⟩\\c . \[WIKI-AH\]: http://en.wikipedia.org/wiki/IPsec#Authentication\_Header ### service: all - Match all traffic Example: - ``` server all accept ``` Service Type: - • simple Server Ports: - • all Client Ports: - • all Netfilter Modules - • nf\_conntrack\_ftp CONFIG\_NF\_CONNTRACK\_FTP ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_FTP.html⟩\\c - • nf\_conntrack\_irc CONFIG\_NF\_CONNTRACK\_IRC ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_IRC.html⟩\\c - • nf\_conntrack\_sip CONFIG\_NF\_CONNTRACK\_SIP ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_SIP.html⟩\\c - • nf\_conntrack\_pptp CONFIG\_NF\_CONNTRACK\_PPTP ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_PPTP.html⟩\\c - • nf\_conntrack\_proto\_gre CONFIG\_NF\_CT\_PROTO\_GRE ⟨http://cateee.net/lkddb/web-lkddb/NF\_CT\_PROTO\_GRE.html⟩\\c Netfilter NAT Modules - • nf\_nat\_ftp CONFIG\_NF\_NAT\_FTP ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_FTP.html⟩\\c - • nf\_nat\_irc CONFIG\_NF\_NAT\_IRC ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_IRC.html⟩\\c - • nf\_nat\_sip CONFIG\_NF\_NAT\_SIP ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_SIP.html⟩\\c - • nf\_nat\_pptp CONFIG\_NF\_NAT\_PPTP ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_PPTP.html⟩\\c - • nf\_nat\_proto\_gre CONFIG\_NF\_NAT\_PROTO\_GRE ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_PROTO\_GRE.html⟩\\c Notes Matches all traffic (all protocols, ports, etc.). Note that to provide “connections in one direction with replies” semantics, the kernel connection tracker is still used: this will therefore still not match packets if they are not understood as part of a connection (e.g. some ICMPv6 packets, requests and replies taking different routes, complex protocols with no helper loaded). This service may indirectly setup a set of other services, if they require kernel modules to be loaded. The following complex services are activated: ### service: amanda - Advanced Maryland Automatic Network Disk Archiver Service Type: - • simple Server Ports: - • udp/10080 Client Ports: - • default Netfilter Modules - • nf\_conntrack\_amanda CONFIG\_NF\_CONNTRACK\_AMANDA ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_AMANDA.html⟩\\c Netfilter NAT Modules - • nf\_nat\_amanda CONFIG\_NF\_NAT\_AMANDA ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_AMANDA.html⟩\\c Links - • Homepage ⟨http://www.amanda.org/⟩\\c - • http://en.wikipedia.org/wiki/Advanced\_Maryland\_Automatic\_Network\_Disk\_Archiver Wikipedia ⟨⟩\\c ### service: any - Match all traffic (without modules or indirect) Example: - ``` server any *myname* accept proto 47 ``` Service Type: - • simple Server Ports: - • all Client Ports: - • all Notes Matches all traffic (all protocols, ports, etc), but does not care about kernel modules and does not activate any other service indirectly. In combination with the [firehol-params(5)](/firehol-params/5.md) this service can match unusual traffic (e.g. GRE - protocol 47). Note that you have to supply your own name in addition to “any”. ### service: anystateless - Match all traffic statelessly Example: - ``` server anystateless *myname* accept proto 47 ``` Service Type: - • complex Server Ports: - • all Client Ports: - • all Notes Matches all traffic (all protocols, ports, etc), but does not care about kernel modules and does not activate any other service indirectly. In combination with the [firehol-params(5)](/firehol-params/5.md) this service can match unusual traffic (e.g. GRE - protocol 47). This service is identical to “any” but does not care about the state of traffic. Note that you have to supply your own name in addition to “anystateless”. ### service: apcupsd - APC UPS Daemon Example: - ``` server apcupsd accept ``` Service Type: - • simple Server Ports: - • tcp/6544 Client Ports: - • default Links - • \[Homepage\]\[HOME-apcupsd\] - • \[Wikipedia\]\[WIKI-apcupsd\] Notes This service must be defined as “server apcupsd accept” on all machines not directly connected to the UPS (i.e. slaves). Note that the port defined here is not the default port (6666) used if you download and compile APCUPSD, since the default conflicts with IRC and many distributions (like Debian) have changed this to 6544. You can define port 6544 in APCUPSD, by changing the value of NETPORT in its configuration file, or overwrite this FireHOL service definition using the procedures described in Adding Services in [firehol.conf(5)](/firehol.conf/5.md). \[HOME-apcupsd\]: http://www.apcupsd.com \[WIKI-apcupsd\]: http://en.wikipedia.org/wiki/Apcupsd ### service: apcupsdnis - APC UPS Daemon Network Information Server Example: - ``` server apcupsdnis accept ``` Service Type: - • simple Server Ports: - • tcp/3551 Client Ports: - • default Links - • \[Homepage\]\[HOME-apcupsdnis\] - • \[Wikipedia\]\[WIKI-apcupsdnis\] Notes This service allows the remote WEB interfaces of APCUPSD ⟨http://www.apcupsd.com/⟩\\c , to connect and get information from the server directly connected to the UPS device. \[HOME-apcupsdnis\]: http://www.apcupsd.com \[WIKI-apcupsdnis\]: http://en.wikipedia.org/wiki/Apcupsd ### service: aptproxy - Advanced Packaging Tool Proxy Example: - ``` server aptproxy accept ``` Service Type: - • simple Server Ports: - • tcp/9999 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Apt-proxy⟩\\c ### service: asterisk - Asterisk PABX Example: - ``` server asterisk accept ``` Service Type: - • simple Server Ports: - • tcp/5038 Client Ports: - • default Links - • \[Homepage\]\[HOME-asterisk\] - • \[Wikipedia\]\[WIKI-asterisk\] Notes This service refers only to the manager interface of asterisk. You should normally enable sip, h323, rtp, etc. at the firewall level, if you enable the relative channel drivers of asterisk. \[HOME-asterisk\]: http://www.asterisk.org \[WIKI-asterisk\]: http://en.wikipedia.org/wiki/Asterisk\_PBX ### service: cups - Common UNIX Printing System Example: - ``` server cups accept ``` Service Type: - • simple Server Ports: - • tcp/631 udp/631 Client Ports: - • any Links - • Homepage ⟨http://www.cups.org⟩\\c - • Wikipedia ⟨http://en.wikipedia.org/wiki/Common\_Unix\_Printing\_System⟩\\c ### service: custom - Custom definitions Example: - ``` server custom myimap tcp/143 default accept ``` Service Type: - • custom Server Ports: - • N/A Client Ports: - • N/A Notes The full syntax is: *subcommand* `custom` *name* *svr-proto/ports* *cli-ports* *action* *params* This service is used by FireHOL to allow you create rules for services which do not have a definition. `subcommand`, *action* and *params* have their usual meanings. A *name* must be supplied along with server ports in the form *proto/range* and client ports which takes only a *range*. To define services with the built-in extension mechanism to avoid the need for `custom` services, see Adding Services in [firehol.conf(5)](/firehol.conf/5.md). ### service: cvspserver - Concurrent Versions System Example: - ``` server cvspserver accept ``` Service Type: - • simple Server Ports: - • tcp/2401 Client Ports: - • default Links - • Homepage ⟨http://www.nongnu.org/cvs/⟩\\c - • Wikipedia ⟨http://en.wikipedia.org/wiki/Concurrent\_Versions\_System⟩\\c ### service: darkstat - Darkstat network traffic analyser Example: - ``` server darkstat accept ``` Service Type: - • simple Server Ports: - • tcp/666 Client Ports: - • default Links - • Homepage ⟨https://unix4lyfe.org/darkstat/⟩\\c ### service: daytime - Daytime Protocol Example: - ``` server daytime accept ``` Service Type: - • simple Server Ports: - • tcp/13 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Daytime\_Protocol⟩\\c ### service: dcc - Distributed Checksum Clearinghouse Example: - ``` server dcc accept ``` Service Type: - • simple Server Ports: - • udp/6277 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-dcc\] Notes See also this DCC FAQ ⟨http://www.rhyolite.com/dcc/FAQ.html#firewall-ports⟩\\c . \[WIKI-dcc\]: http://en.wikipedia.org/wiki/Distributed\_Checksum\_Clearinghouse ### service: dcpp - Direct Connect++ P2P Example: - ``` server dcpp accept ``` Service Type: - • simple Server Ports: - • tcp/1412 udp/1412 Client Ports: - • default Links - • Homepage ⟨http://dcplusplus.sourceforge.net⟩\\c ### service: dhcp - Dynamic Host Configuration Protocol Example: - ``` server dhcp accept ``` Service Type: - • complex Server Ports: - • udp/67 Client Ports: - • 68 Links - • \[Wikipedia\]\[WIKI-dhcp\] Notes The dhcp service is implemented as stateless rules. DHCP clients broadcast to the network (src 0.0.0.0 dst 255.255.255.255) to find a DHCP server. If the DHCP service was stateful the iptables connection tracker would not match the packets and deny to send the reply. Note that this change does not affect the security of either DHCP servers or clients, since only the specific ports are allowed (there is no random port at either the server or the client side). Note also that the “server dhcp accept” or “client dhcp accept” commands should placed within interfaces that do not have src and / or dst defined (because of the initial broadcast). You can overcome this problem by placing the DHCP service on a separate interface, without a src or dst but with a policy return. Place this interface before the one that defines the rest of the services. For example: `interface eth0 dhcp` `policy return` `server dhcp accept` `interface eth0 lan src "$mylan" dst "$myip"` `client all accept` For example: interface eth0 dhcp policy return server dhcp accept interface eth0 lan src `"$mylan"` dst `"$myip"` client all accept This service implicitly sets its client or server to ipv4 mode. \[WIKI-dhcp\]: http://en.wikipedia.org/wiki/Dhcp ### service: dhcprelay - DHCP Relay Example: - ``` server dhcprelay accept ``` Service Type: - • simple Server Ports: - • udp/67 Client Ports: - • 67 Links - • \[Wikipedia\]\[WIKI-dhcprelay\] Notes From RFC 1812 section 9.1.2: In many cases, BOOTP clients and their associated BOOTP server(s) do not reside on the same IP (sub)network. In such cases, a third-party agent is required to transfer BOOTP messages between clients and servers. Such an agent was originally referred to as a BOOTP forwarding agent. However, to avoid confusion with the IP forwarding function of a router, the name BOOTP relay agent has been adopted instead. For more information about DHCP Relay see section 9.1.2 of RFC 1812 ⟨http://www.ietf.org/rfc/rfc1812.txt⟩\\c and section 4 of RFC 1542 ⟨http://www.ietf.org/rfc/rfc1542.txt⟩\\c \[WIKI-dhcprelay\]: http://en.wikipedia.org/wiki/Dynamic\_Host\_Configuration\_Protocol#DHCP\_relaying ### service: dhcpv6 - Dynamic Host Configuration Protocol for IPv6 Example: - ``` server dhcpv6 accept client dhcpv6 accept ``` Service Type: - • complex Server Ports: - • udp/547 Client Ports: - • udp/546 Links - • \[Wikipedia\]\[WIKI-dhcpv6\] Notes The dhcp service is implemented as stateless rules. It cannot be stateful as the connection tracker will not match a unicast reply to a broadcast request. Further, if you wish to add src/dst rule parameters, you must account for both the broadcast and link-local network prefixes. Clients broadcast from a link-local address to the multicast address ff02::1:2 on UDP port 547 to find a server. The server sends a unicast reply back to the client which listens on UDP port 546. For a FireHOL interface, creating a client will allow sending to port 547 and receiving on port 546. Creating a server allows sending to port 546 and receiving on port 547. Unlike DHCP for IPv4, the source ports to be used are not defined in DHCPv6 - see section 5.2 of RFC3315 ⟨http://www.ietf.org/rfc/rfc3315.txt⟩\\c . Some servers are known to make use of this to send from arbitrary ports, so FireHOL does not assume a source port. This service implicitly sets its client or server to ipv6 mode. \[WIKI-dhcpv6\]: https://en.wikipedia.org/wiki/DHCPv6 ### service: dict - Dictionary Server Protocol Example: - ``` server dict accept ``` Service Type: - • simple Server Ports: - • tcp/2628 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-dict\] Notes See RFC2229 ⟨http://www.ietf.org/rfc/rfc2229.txt⟩\\c . \[WIKI-dict\]: http://en.wikipedia.org/wiki/DICT ### service: distcc - Distributed CC Example: - ``` server distcc accept ``` Service Type: - • simple Server Ports: - • tcp/3632 Client Ports: - • default Links - • \[Homepage\]\[HOME-distcc\] - • \[Wikipedia\]\[WIKI-distcc\] Notes For distcc security, please check the distcc security design ⟨http://distcc.googlecode.com/svn/trunk/doc/web/security.html⟩\\c . \[HOME-distcc\]: https://code.google.com/p/distcc/ \[WIKI-distcc\]: http://en.wikipedia.org/wiki/Distcc ### service: dns - Domain Name System Example: - ``` server dns accept ``` Service Type: - • simple Server Ports: - • udp/53 tcp/53 Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-dns\] Notes On very busy DNS servers you may see a few dropped DNS packets in your logs. This is normal. The iptables connection tracker will timeout the session and lose unmatched DNS packets that arrive too late to be useful. \[WIKI-dns\]: http://en.wikipedia.org/wiki/Domain\_Name\_System ### service: echo - Echo Protocol Example: - ``` server echo accept ``` Service Type: - • simple Server Ports: - • tcp/7 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Echo\_Protocol⟩\\c ### service: emule - eMule (Donkey network client) Example: - ``` client emule accept src 192.0.2.1 ``` Service Type: - • complex Server Ports: - • many Client Ports: - • many Links - • \[Homepage\]\[HOME-emule\] Notes According to http://www.emule-project.net/home/perl/help.cgi?l=1&rm=show\_topic&topic\_id=122 eMule Port Definitions ⟨⟩\\c , FireHOL defines: - • Accept from any client port to the server at tcp/4661 - • Accept from any client port to the server at tcp/4662 - • Accept from any client port to the server at udp/4665 - • Accept from any client port to the server at udp/4672 - • Accept from any server port to the client at tcp/4662 - • Accept from any server port to the client at udp/4672 Use the FireHOL [firehol-client(5)](/firehol-client/5.md) command to match the eMule client. Please note that the eMule client is an HTTP client also. \[HOME-emule\]: http://www.emule-project.com ### service: eserver - eDonkey network server Example: - ``` server eserver accept ``` Service Type: - • simple Server Ports: - • tcp/4661 udp/4661 udp/4665 Client Ports: - • any Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Eserver⟩\\c ### service: ESP - IPSec Encapsulated Security Payload (ESP) Example: - ``` server ESP accept ``` Service Type: - • simple Server Ports: - • 50/any Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-ESP\] Notes For more information see this http://web.archive.org/web/20100918134143/http://www.freeswan.org/freeswan\_trees/freeswan-1.99/doc/ipsec.html#ESP.ipsec Archive of the FreeS/WAN documentation ⟨⟩\\c RFC 2406 ⟨http://www.ietf.org/rfc/rfc2406.txt⟩\\c . \[WIKI-ESP\]: http://en.wikipedia.org/wiki/IPsec#Encapsulating\_Security\_Payload ### service: finger - Finger Protocol Example: - ``` server finger accept ``` Service Type: - • simple Server Ports: - • tcp/79 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Finger\_protocol⟩\\c ### service: ftp - File Transfer Protocol Example: - ``` server ftp accept ``` Service Type: - • simple Server Ports: - • tcp/21 Client Ports: - • default Netfilter Modules - • nf\_conntrack\_ftp CONFIG\_NF\_CONNTRACK\_FTP ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_FTP.html⟩\\c Netfilter NAT Modules - • nf\_nat\_ftp CONFIG\_NF\_NAT\_FTP ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_FTP.html⟩\\c Links - • \[Wikipedia\]\[WIKI-ftp\] Notes The FTP service matches both active and passive FTP connections. \[WIKI-ftp\]: http://en.wikipedia.org/wiki/Ftp ### service: gift - giFT Internet File Transfer Example: - ``` server gift accept ``` Service Type: - • simple Server Ports: - • tcp/4302 tcp/1214 tcp/2182 tcp/2472 Client Ports: - • any Links - • \[Homepage\]\[HOME-gift\] - • \[Wikipedia\]\[WIKI-gift\] Notes The gift FireHOL service supports: - • Gnutella listening at tcp/4302 - • FastTrack listening at tcp/1214 - • OpenFT listening at tcp/2182 and tcp/2472 The above ports are the defaults given for the corresponding giFT modules. To allow access to the user interface ports of giFT, use the giftui. \[HOME-gift\]: http://gift.sourceforge.net \[WIKI-gift\]: http://en.wikipedia.org/wiki/GiFT ### service: giftui - giFT Internet File Transfer User Interface Example: - ``` server giftui accept ``` Service Type: - • simple Server Ports: - • tcp/1213 Client Ports: - • default Links - • \[Homepage\]\[HOME-giftui\] - • \[Wikipedia\]\[WIKI-giftui\] Notes This service refers only to the user interface ports offered by giFT. To allow gift accept P2P requests, use the gift. \[HOME-giftui\]: http://gift.sourceforge.net \[WIKI-giftui\]: http://en.wikipedia.org/wiki/GiFT ### service: gkrellmd - GKrellM Daemon Example: - ``` server gkrellmd accept ``` Service Type: - • simple Server Ports: - • tcp/19150 Client Ports: - • default Links - • Homepage ⟨http://gkrellm.net/⟩\\c - • Wikipedia ⟨http://en.wikipedia.org/wiki/Gkrellm⟩\\c ### service: GRE - Generic Routing Encapsulation Example: - ``` server GRE accept ``` Service Type: - • simple Server Ports: - • 47/any Client Ports: - • any Netfilter Modules - • nf\_conntrack\_proto\_gre CONFIG\_NF\_CT\_PROTO\_GRE ⟨http://cateee.net/lkddb/web-lkddb/NF\_CT\_PROTO\_GRE.html⟩\\c Netfilter NAT Modules - • nf\_nat\_proto\_gre CONFIG\_NF\_NAT\_PROTO\_GRE ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_PROTO\_GRE.html⟩\\c Links - • \[Wikipedia\]\[WIKI-GRE\] Notes Protocol No 47. For more information see RFC RFC 2784 ⟨http://www.ietf.org/rfc/rfc2784.txt⟩\\c . \[WIKI-GRE\]: http://en.wikipedia.org/wiki/Generic\_Routing\_Encapsulation ### service: h323 - H.323 VoIP Example: - ``` server h323 accept ``` Service Type: - • simple Server Ports: - • udp/1720 tcp/1720 Client Ports: - • default Netfilter Modules - • nf\_conntrack\_h323 CONFIG\_NF\_CONNTRACK\_H323 ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_H323.html⟩\\c Netfilter NAT Modules - • nf\_nat\_h323 CONFIG\_NF\_NAT\_H323 ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_H323.html⟩\\c Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/H323⟩\\c ### service: heartbeat - HeartBeat Example: - ``` server heartbeat accept ``` Service Type: - • simple Server Ports: - • udp/690:699 Client Ports: - • default Links - • \[Homepage\]\[HOME-heartbeat\] Notes This FireHOL service has been designed such a way that it will allow multiple heartbeat clusters on the same LAN. \[HOME-heartbeat\]: http://www.linux-ha.org/ ### service: http - Hypertext Transfer Protocol Example: - ``` server http accept ``` Service Type: - • simple Server Ports: - • tcp/80 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Http⟩\\c ### service: httpalt - HTTP alternate port Example: - ``` server httpalt accept ``` Service Type: - • simple Server Ports: - • tcp/8080 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-httpalt\] Notes This port is commonly used by web servers, web proxies and caches where the standard http port is not available or can or should not be used. \[WIKI-httpalt\]: http://en.wikipedia.org/wiki/Http ### service: https - Secure Hypertext Transfer Protocol Example: - ``` server https accept ``` Service Type: - • simple Server Ports: - • tcp/443 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Https⟩\\c ### service: hylafax - HylaFAX Example: - ``` server hylafax accept ``` Service Type: - • complex Server Ports: - • many Client Ports: - • many Links - • \[Homepage\]\[HOME-hylafax\] - • \[Wikipedia\]\[WIKI-hylafax\] Notes This service allows incoming requests to server port tcp/4559 and outgoing from server port tcp/4558. The correct operation of this service has not been verified. USE THIS WITH CARE. A HYLAFAX CLIENT MAY OPEN ALL TCP UNPRIVILEGED PORTS TO ANYONE (from port tcp/4558). \[HOME-hylafax\]: http://www.hylafax.org/ \[WIKI-hylafax\]: http://en.wikipedia.org/wiki/Hylafax ### service: iax - Inter-Asterisk eXchange Example: - ``` server iax accept ``` Service Type: - • simple Server Ports: - • udp/5036 Client Ports: - • default Links - • \[Homepage\]\[HOME-iax\] - • \[Wikipedia\]\[WIKI-iax\] Notes This service refers to IAX version 1. There is also iax2. \[HOME-iax\]: http://www.asterisk.org \[WIKI-iax\]: http://en.wikipedia.org/wiki/Iax ### service: iax2 - Inter-Asterisk eXchange v2 Example: - ``` server iax2 accept ``` Service Type: - • simple Server Ports: - • udp/5469 udp/4569 Client Ports: - • default Links - • \[Homepage\]\[HOME-iax2\] - • \[Wikipedia\]\[WIKI-iax2\] Notes This service refers to IAX version 2. There is also iax. \[HOME-iax2\]: http://www.asterisk.org \[WIKI-iax2\]: http://en.wikipedia.org/wiki/Iax ### service: ICMP - Internet Control Message Protocol Example: - ``` server ICMP accept ``` Service Type: - • simple Server Ports: - • icmp/any Client Ports: - • any Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Internet\_Control\_Message\_Protocol⟩\\c ### service: icmp - Internet Control Message Protocol Alias for ICMP ### service: ICMPV6 - Internet Control Message Protocol v6 Example: - ``` server ICMPV6 accept ``` Service Type: - • simple Server Ports: - • icmpv6/any Client Ports: - • any Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/ICMPv6⟩\\c ### service: icmpv6 - Internet Control Message Protocol v6 Alias for ICMPV6 ### service: icp - Internet Cache Protocol Example: - ``` server icp accept ``` Service Type: - • simple Server Ports: - • udp/3130 Client Ports: - • 3130 Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Internet\_Cache\_Protocol⟩\\c ### service: ident - Identification Protocol Example: - ``` server ident reject with tcp-reset ``` Service Type: - • simple Server Ports: - • tcp/113 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Ident\_protocol⟩\\c ### service: imap - Internet Message Access Protocol Example: - ``` server imap accept ``` Service Type: - • simple Server Ports: - • tcp/143 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Imap⟩\\c ### service: imaps - Secure Internet Message Access Protocol Example: - ``` server imaps accept ``` Service Type: - • simple Server Ports: - • tcp/993 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Imap⟩\\c ### service: ipsecnatt - NAT traversal and IPsec Service Type: - • simple Server Ports: - • udp/4500 Client Ports: - • any Links - • http://en.wikipedia.org/wiki/NAT\_traversal#IPsec\_traversal\_across\_NAT Wikipedia ⟨⟩\\c ### service: ipv6error - ICMPv6 Error Handling Example: - ``` server ipv6error accept ``` Service Type: - • complex Server Ports: - • N/A Client Ports: - • N/A Notes This service is not needed from 3.0.0. It will do nothing but issue a warning from 3.1.0; it will be removed in 4.0.0. The linux connection tracker ensures that ICMPv6 errors are marked as RELATED. Since 3.0.0, these are automatically accepted by FireHOL, making a separate command redundant. ### service: ipv6mld - IPv6 Multicast Listener Discovery for IPv6 Example: - ``` client ipv6mld accept ``` Service Type: - • complex Server Ports: - • N/A Client Ports: - • N/A Links - • \[Wikipedia\]\[WIKI-ipv6mld\] Notes IPv6 uses Multicast Listener Discovery to discover multicast listeners and what they are listening for. In practice all IPv6 nodes are multicast listeners since multicast is used in the neighbour discovery protocol which replaces ARP in IPv4. These rules are stateless since reports can happen automatically as well as on query. Unless multicast snooping is disabled across the network, MLD should be enabled for any clients: `client ipv6mld accept` MLD should also be enabled as a server on any hosts acting as a router: `server ipv6mld accept` The rules should generally not be used to pass packets across a firewall (e.g. in a router definition) unless the firewall is for a bridge. This service implicitly sets its client or server to ipv6 mode. \[WIKI-ipv6mld\]: https://en.wikipedia.org/wiki/Multicast\_Listener\_Discovery ### service: ipv6neigh - IPv6 Neighbour discovery Example: - ``` client ipv6neigh accept server ipv6neigh accept ``` Service Type: - • complex Server Ports: - • N/A Client Ports: - • N/A Links - • \[Wikipedia\]\[WIKI-ipv6neigh\] Notes IPv6 uses the Neighbour Discovery Protocol to do automatic configuration of routes and to replace ARP. To allow this functionality the network neighbour and router solicitation/advertisement messages should be enabled on each interface. These rules are stateless since advertisement can happen automatically as well as on solicitation. Neighbour discovery (incoming) should always be enabled: `server ipv6neigh accept` Neighbour advertisement (outgoing) should always be enabled: `client ipv6neigh accept` The rules should not be used to pass packets across a firewall (e.g. in a router definition) unless the firewall is for a bridge. This service implicitly sets its client or server to ipv6 mode. \[WIKI-ipv6neigh\]: https://en.wikipedia.org/wiki/Neighbor\_Discovery\_Protocol ### service: ipv6router - IPv6 Router discovery Example: - ``` client ipv6router accept ``` Service Type: - • complex Server Ports: - • N/A Client Ports: - • N/A Links - • \[Wikipedia\]\[WIKI-ipv6router\] Notes IPv6 uses the Neighbour Discovery Protocol to do automatic configuration of routes and to replace ARP. To allow this functionality the network neighbour and router solicitation/advertisement messages should be enabled on each interface. These rules are stateless since advertisement can happen automatically as well as on solicitation. Router discovery (incoming) should always be enabled: `client ipv6router accept` Router advertisement (outgoing) should be enabled on a host that routes: `server ipv6router accept` The rules should not be used to pass packets across a firewall (e.g. in a router definition) unless the firewall is for a bridge. This service implicitly sets its client or server to ipv6 mode. \[WIKI-ipv6router\]: https://en.wikipedia.org/wiki/Neighbor\_Discovery\_Protocol ### service: irc - Internet Relay Chat Example: - ``` server irc accept ``` Service Type: - • simple Server Ports: - • tcp/6667 Client Ports: - • default Netfilter Modules - • nf\_conntrack\_irc CONFIG\_NF\_CONNTRACK\_IRC ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_IRC.html⟩\\c Netfilter NAT Modules - • nf\_nat\_irc CONFIG\_NF\_NAT\_IRC ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_IRC.html⟩\\c Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Internet\_Relay\_Chat⟩\\c ### service: isakmp - Internet Security Association and Key Management Protocol (IKE) Example: - ``` server isakmp accept ``` Service Type: - • simple Server Ports: - • udp/500 Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-isakmp\] Notes For more information see the http://web.archive.org/web/20100918134143/http://www.freeswan.org/freeswan\_trees/freeswan-1.99/doc/ipsec.html#IKE.ipsec Archive of the FreeS/WAN documentation ⟨⟩\\c \[WIKI-isakmp\]: http://en.wikipedia.org/wiki/ISAKMP ### service: jabber - Extensible Messaging and Presence Protocol Example: - ``` server jabber accept ``` Service Type: - • simple Server Ports: - • tcp/5222 tcp/5223 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-jabber\] Notes Allows clear and SSL client-to-server connections. \[WIKI-jabber\]: http://en.wikipedia.org/wiki/Jabber ### service: jabberd - Extensible Messaging and Presence Protocol (Server) Example: - ``` server jabberd accept ``` Service Type: - • simple Server Ports: - • tcp/5222 tcp/5223 tcp/5269 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-jabberd\] Notes Allows clear and SSL client-to-server and server-to-server connections. Use this service for a jabberd server. In all other cases, use the jabber. \[WIKI-jabberd\]: http://en.wikipedia.org/wiki/Jabber ### service: l2tp - Layer 2 Tunneling Protocol Service Type: - • simple Server Ports: - • udp/1701 Client Ports: - • any Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/L2tp⟩\\c ### service: ldap - Lightweight Directory Access Protocol Example: - ``` server ldap accept ``` Service Type: - • simple Server Ports: - • tcp/389 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Ldap⟩\\c ### service: ldaps - Secure Lightweight Directory Access Protocol Example: - ``` server ldaps accept ``` Service Type: - • simple Server Ports: - • tcp/636 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Ldap⟩\\c ### service: lpd - Line Printer Daemon Protocol Example: - ``` server lpd accept ``` Service Type: - • simple Server Ports: - • tcp/515 Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-lpd\] Notes LPD is documented in RFC 1179 ⟨http://www.ietf.org/rfc/rfc1179.txt⟩\\c . Since many operating systems incorrectly use the non-default client ports for LPD access, this definition allows any client port to access the service (in addition to the RFC defined 721 to 731 inclusive). \[WIKI-lpd\]: http://en.wikipedia.org/wiki/Line\_Printer\_Daemon\_protocol ### service: microsoft\_ds - Direct Hosted (NETBIOS-less) SMB Example: - ``` server microsoft_ds accept ``` Service Type: - • simple Server Ports: - • tcp/445 Client Ports: - • default Notes Direct Hosted (i.e. NETBIOS-less SMB) This is another NETBIOS Session Service with minor differences with netbios\_ssn. It is supported only by Windows 2000 and Windows XP and it offers the advantage of being independent of WINS for name resolution. It seems that samba supports transparently this protocol on the netbios\_ssn ports, so that either direct hosted or traditional SMB can be served simultaneously. Please refer to the netbios\_ssn for more information. ### service: mms - Microsoft Media Server Example: - ``` server mms accept ``` Service Type: - • simple Server Ports: - • tcp/1755 udp/1755 Client Ports: - • default Netfilter Modules - • See http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-5.html#ss5.5 here ⟨⟩\\c . Netfilter NAT Modules - • See http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO-5.html#ss5.5 here ⟨⟩\\c . Links - • \[Wikipedia\]\[WIKI-mms\] Notes Microsoft’s proprietary network streaming protocol used to transfer unicast data in Windows Media Services (previously called NetShow Services). \[WIKI-mms\]: http://en.wikipedia.org/wiki/Microsoft\_Media\_Server ### service: msn - Microsoft MSN Messenger Service Example: - ``` server msn accept ``` Service Type: - • simple Server Ports: - • tcp/1863 udp/1863 Client Ports: - • default ### service: msnp - msnp Example: - ``` server msnp accept ``` Service Type: - • simple Server Ports: - • tcp/6891 Client Ports: - • default ### service: ms\_ds - Direct Hosted (NETBIOS-less) SMB Alias for microsoft\_ds ### service: multicast - Multicast Example: - ``` server multicast reject with proto-unreach ``` Service Type: - • complex Server Ports: - • N/A Client Ports: - • N/A Links - • \[Wikipedia\]\[WIKI-multicast\] Notes The multicast service matches all packets sent to the $MULTICAST\_IPS addresses using IGMP or UDP. For IPv4 that means 224.0.0.0/4 and for IPv6 FF00::/16. \[WIKI-multicast\]: http://en.wikipedia.org/wiki/Multicast ### service: mysql - MySQL Example: - ``` server mysql accept ``` Service Type: - • simple Server Ports: - • tcp/3306 Client Ports: - • default Links - • Homepage ⟨http://www.mysql.com/⟩\\c - • Wikipedia ⟨http://en.wikipedia.org/wiki/Mysql⟩\\c ### service: netbackup - Veritas NetBackup service Example: - ``` server netbackup accept client netbackup accept ``` Service Type: - • simple Server Ports: - • tcp/13701 tcp/13711 tcp/13720 tcp/13721 tcp/13724 tcp/13782 tcp/13783 Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-netbackup\] Notes To use this service you must define it as both client and server in NetBackup clients and NetBackup servers. \[WIKI-netbackup\]: http://en.wikipedia.org/wiki/Netbackup ### service: netbios\_dgm - NETBIOS Datagram Distribution Service Example: - ``` server netbios_dgm accept ``` Service Type: - • simple Server Ports: - • udp/138 Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-netbios\_dgm\] Notes See also the samba. Keep in mind that this service broadcasts (to the broadcast address of your LAN) UDP packets. If you place this service within an interface that has a dst parameter, remember to include (in the dst parameter) the broadcast address of your LAN too. \[WIKI-netbios\_dgm\]: http://en.wikipedia.org/wiki/Netbios#Datagram\_distribution\_service ### service: netbios\_ns - NETBIOS Name Service Example: - ``` server netbios_ns accept ``` Service Type: - • simple Server Ports: - • udp/137 Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-netbios\_ns\] Notes See also the samba. \[WIKI-netbios\_ns\]: http://en.wikipedia.org/wiki/Netbios#Name\_service ### service: netbios\_ssn - NETBIOS Session Service Example: - ``` server netbios_ssn accept ``` Service Type: - • simple Server Ports: - • tcp/139 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-netbios\_ssn\] Notes See also the samba. Please keep in mind that newer NETBIOS clients prefer to use port 445 (microsoft\_ds) for the NETBIOS session service, and when this is not available they fall back to port 139 (netbios\_ssn). Versions of samba above 3.x bind automatically to ports 139 and 445. If you have an older samba version and your policy on an interface or router is DROP, clients trying to access port 445 will have to timeout before falling back to port 139. This timeout can be up to several minutes. To overcome this problem you can explicitly REJECT the microsoft\_ds with a tcp-reset message: server microsoft\_ds reject with tcp-reset \[WIKI-netbios\_ssn\]: http://en.wikipedia.org/wiki/Netbios#Session\_service ### service: nfs - Network File System Example: - ``` client nfs accept dst 192.0.2.1 ``` Service Type: - • complex Server Ports: - • many Client Ports: - • N/A Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Network\_File\_System\_%28protocol%29⟩\\c Notes The NFS service queries the RPC service on the NFS server host to find out the ports nfsd, mountd, lockd and rquotad are listening. Then, according to these ports it sets up rules on all the supported protocols (as reported by RPC) in order the clients to be able to reach the server. For this reason, the NFS service requires that: - • the firewall is restarted if the NFS server is restarted - • the NFS server must be specified on all nfs statements (only if it is not the localhost) Since NFS queries the remote RPC server, it is required to also be allowed to do so, by allowing the portmap too. Take care that this is allowed by the running firewall when FireHOL tries to query the RPC server. So you might have to setup NFS in two steps: First add the portmap service and activate the firewall, then add the NFS service and restart the firewall. To avoid this you can setup your NFS server to listen on pre-defined ports, as documented in NFS Howto ⟨http://nfs.sourceforge.net/nfs-howto/ar01s06.html#nfs\_firewalls⟩\\c . If you do this then you will have to define the the ports using the procedure described in Adding Services in [firehol.conf(5)](/firehol.conf/5.md). ### service: nis - Network Information Service Example: - ``` client nis accept dst 192.0.2.1 ``` Service Type: - • complex Server Ports: - • many Client Ports: - • N/A Links - • \[Wikipedia\]\[WIKI-nis\] Notes The nis service queries the RPC service on the nis server host to find out the ports ypserv and yppasswdd are listening. Then, according to these ports it sets up rules on all the supported protocols (as reported by RPC) in order the clients to be able to reach the server. For this reason, the nis service requires that: - • the firewall is restarted if the nis server is restarted - • the nis server must be specified on all nis statements (only if it is not the localhost) Since nis queries the remote RPC server, it is required to also be allowed to do so, by allowing the portmap too. Take care that this is allowed by the running firewall when FireHOL tries to query the RPC server. So you might have to setup nis in two steps: First add the portmap service and activate the firewall, then add the nis service and restart the firewall. This service was added to FireHOL by Carlos Rodrigues ⟨http://sourceforge.net/p/firehol/feature-requests/20/⟩\\c . His comments regarding this implementation, are: These rules work for client access only! Pushing changes to slave servers won’t work if these rules are active somewhere between the master and its slaves, because it is impossible to predict the ports where yppush will be listening on each push. Pulling changes directly on the slaves will work, and could be improved performance-wise if these rules are modified to open fypxfrd. This wasn’t done because it doesn’t make that much sense since pushing changes on the master server is the most common, and recommended, way to replicate maps. \[WIKI-nis\]: http://en.wikipedia.org/wiki/Network\_Information\_Service ### service: nntp - Network News Transfer Protocol Example: - ``` server nntp accept ``` Service Type: - • simple Server Ports: - • tcp/119 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Nntp⟩\\c ### service: nntps - Secure Network News Transfer Protocol Example: - ``` server nntps accept ``` Service Type: - • simple Server Ports: - • tcp/563 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Nntp⟩\\c ### service: nrpe - Nagios NRPE Service Type: - • simple Server Ports: - • tcp/5666 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Nagios#NRPE⟩\\c ### service: ntp - Network Time Protocol Example: - ``` server ntp accept ``` Service Type: - • simple Server Ports: - • udp/123 tcp/123 Client Ports: - • any Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Network\_Time\_Protocol⟩\\c ### service: nut - Network UPS Tools Example: - ``` server nut accept ``` Service Type: - • simple Server Ports: - • tcp/3493 udp/3493 Client Ports: - • default Links - • Homepage ⟨http://www.networkupstools.org/⟩\\c ### service: nxserver - NoMachine NX Server Example: - ``` server nxserver accept ``` Service Type: - • simple Server Ports: - • tcp/5000:5200 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-nxserver\] Notes Default ports used by NX server for connections without encryption. Note that nxserver also needs the ssh to be enabled. This information has been extracted from this The TCP ports used by nxserver are 4000 + DISPLAY\_BASE to 4000 + DISPLAY\_BASE + DISPLAY\_LIMIT. DISPLAY\_BASE and DISPLAY\_LIMIT are set in /usr/NX/etc/node.conf and the defaults are DISPLAY\_BASE=1000 and DISPLAY\_LIMIT=200. For encrypted nxserver sessions, only ssh is needed. \[WIKI-nxserver\]: http://en.wikipedia.org/wiki/NX\_Server ### service: openvpn - OpenVPN Service Type: - • simple Server Ports: - • tcp/1194 udp/1194 Client Ports: - • default Links - • Homepage ⟨http://openvpn.net/⟩\\c - • Wikipedia ⟨http://en.wikipedia.org/wiki/OpenVPN⟩\\c ### service: oracle - Oracle Database Example: - ``` server oracle accept ``` Service Type: - • simple Server Ports: - • tcp/1521 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Oracle\_db⟩\\c ### service: OSPF - Open Shortest Path First Example: - ``` server OSPF accept ``` Service Type: - • simple Server Ports: - • 89/any Client Ports: - • any Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Ospf⟩\\c ### service: ping - Ping (ICMP echo) Example: - ``` server ping accept ``` Service Type: - • complex Server Ports: - • N/A Client Ports: - • N/A Links - • \[Wikipedia\]\[WIKI-ping\] Notes This services matches requests of protocol ICMP and type echo-request (TYPE=8) and their replies of type echo-reply (TYPE=0). The ping service is stateful. \[WIKI-ping\]: http://en.wikipedia.org/wiki/Ping ### service: pop3 - Post Office Protocol Example: - ``` server pop3 accept ``` Service Type: - • simple Server Ports: - • tcp/110 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Pop3⟩\\c ### service: pop3s - Secure Post Office Protocol Example: - ``` server pop3s accept ``` Service Type: - • simple Server Ports: - • tcp/995 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Pop3⟩\\c ### service: portmap - Open Network Computing Remote Procedure Call - Port Mapper Example: - ``` server portmap accept ``` Service Type: - • simple Server Ports: - • udp/111 tcp/111 Client Ports: - • any Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Portmap⟩\\c ### service: postgres - PostgreSQL Example: - ``` server postgres accept ``` Service Type: - • simple Server Ports: - • tcp/5432 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Postgres⟩\\c ### service: pptp - Point-to-Point Tunneling Protocol Example: - ``` server pptp accept ``` Service Type: - • simple Server Ports: - • tcp/1723 Client Ports: - • default Netfilter Modules - • nf\_conntrack\_pptp CONFIG\_NF\_CONNTRACK\_PPTP ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_PPTP.html⟩\\c - • nf\_conntrack\_proto\_gre CONFIG\_NF\_CT\_PROTO\_GRE ⟨http://cateee.net/lkddb/web-lkddb/NF\_CT\_PROTO\_GRE.html⟩\\c Netfilter NAT Modules - • nf\_nat\_pptp CONFIG\_NF\_NAT\_PPTP ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_PPTP.html⟩\\c - • nf\_nat\_proto\_gre CONFIG\_NF\_NAT\_PROTO\_GRE ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_PROTO\_GRE.html⟩\\c Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Pptp⟩\\c ### service: privoxy - Privacy Proxy Example: - ``` server privoxy accept ``` Service Type: - • simple Server Ports: - • tcp/8118 Client Ports: - • default Links - • Homepage ⟨http://www.privoxy.org/⟩\\c ### service: radius - Remote Authentication Dial In User Service (RADIUS) Example: - ``` server radius accept ``` Service Type: - • simple Server Ports: - • udp/1812 udp/1813 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/RADIUS⟩\\c ### service: radiusold - Remote Authentication Dial In User Service (RADIUS) Example: - ``` server radiusold accept ``` Service Type: - • simple Server Ports: - • udp/1645 udp/1646 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/RADIUS⟩\\c ### service: radiusoldproxy - Remote Authentication Dial In User Service (RADIUS) Example: - ``` server radiusoldproxy accept ``` Service Type: - • simple Server Ports: - • udp/1647 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/RADIUS⟩\\c ### service: radiusproxy - Remote Authentication Dial In User Service (RADIUS) Example: - ``` server radiusproxy accept ``` Service Type: - • simple Server Ports: - • udp/1814 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/RADIUS⟩\\c ### service: rdp - Remote Desktop Protocol Example: - ``` server rdp accept ``` Service Type: - • simple Server Ports: - • tcp/3389 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-rdp\] Notes Remote Desktop Protocol is also known also as Terminal Services. \[WIKI-rdp\]: http://en.wikipedia.org/wiki/Remote\_Desktop\_Protocol ### service: rndc - Remote Name Daemon Control Example: - ``` server rndc accept ``` Service Type: - • simple Server Ports: - • tcp/953 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Rndc⟩\\c ### service: rsync - rsync protocol Example: - ``` server rsync accept ``` Service Type: - • simple Server Ports: - • tcp/873 udp/873 Client Ports: - • default Links - • Homepage ⟨http://rsync.samba.org/⟩\\c - • Wikipedia ⟨http://en.wikipedia.org/wiki/Rsync⟩\\c ### service: rtp - Real-time Transport Protocol Example: - ``` server rtp accept ``` Service Type: - • simple Server Ports: - • udp/10000:20000 Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-rtp\] Notes RTP ports are generally all the UDP ports. This definition narrows down RTP ports to UDP 10000 to 20000. \[WIKI-rtp\]: http://en.wikipedia.org/wiki/Real-time\_Transport\_Protocol ### service: samba - Samba Example: - ``` server samba accept ``` Service Type: - • complex Server Ports: - • many Client Ports: - • default Links - • \[Homepage\]\[HOME-samba\] - • \[Wikipedia\]\[WIKI-samba\] Notes The samba service automatically sets all the rules for netbios\_ns, netbios\_dgm, netbios\_ssn and microsoft\_ds. Please refer to the notes of the above services for more information. NETBIOS initiates based on the broadcast address of an interface (request goes to broadcast address) but the server responds from its own IP address. This makes the “server samba accept” statement drop the server reply, because of the way the iptables connection tracker works. This service definition includes a hack, that allows a Linux samba server to respond correctly in such situations, by allowing new outgoing connections from the well known netbios\_ns port to the clients high ports. However, for clients and routers this hack is not applied because it would open all unprivileged ports to the samba server. The only solution to overcome the problem in such cases (routers or clients) is to build a trust relationship between the samba servers and clients. \[HOME-samba\]: http://www.samba.org/ \[WIKI-samba\]: http://en.wikipedia.org/wiki/Samba\_(software) ### service: sane - SANE Scanner service Service Type: - • simple Server Ports: - • tcp/6566 Client Ports: - • default Netfilter Modules - • nf\_conntrack\_sane CONFIG\_NF\_CONNTRACK\_SANE ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_SANE.html⟩\\c Netfilter NAT Modules - • N/A Links - • Homepage ⟨http://www.sane-project.org/⟩\\c ### service: sip - Session Initiation Protocol Example: - ``` server sip accept ``` Service Type: - • simple Server Ports: - • tcp/5060 udp/5060 Client Ports: - • 5060 default Netfilter Modules - • nf\_conntrack\_sip CONFIG\_NF\_CONNTRACK\_SIP ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_SIP.html⟩\\c Netfilter NAT Modules - • nf\_nat\_sip CONFIG\_NF\_NAT\_SIP ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_SIP.html⟩\\c Links - • \[Wikipedia\]\[WIKI-sip\] Notes SIP ⟨http://www.voip-info.org/wiki/view/SIP⟩\\c is an IETF standard protocol (RFC 2543) for initiating interactive user sessions involving multimedia elements such as video, voice, chat, gaming, etc. SIP works in the application layer of the OSI communications model. \[WIKI-sip\]: http://en.wikipedia.org/wiki/Session\_Initiation\_Protocol ### service: smtp - Simple Mail Transport Protocol Example: - ``` server smtp accept ``` Service Type: - • simple Server Ports: - • tcp/25 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Simple\_Mail\_Transfer\_Protocol⟩\\c ### service: smtps - Secure Simple Mail Transport Protocol Example: - ``` server smtps accept ``` Service Type: - • simple Server Ports: - • tcp/465 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/SMTPS⟩\\c ### service: snmp - Simple Network Management Protocol Example: - ``` server snmp accept ``` Service Type: - • simple Server Ports: - • udp/161 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Simple\_Network\_Management\_Protocol⟩\\c ### service: snmptrap - SNMP Trap Example: - ``` server snmptrap accept ``` Service Type: - • simple Server Ports: - • udp/162 Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-snmptrap\] Notes An SNMP trap is a notification from an agent to a manager. \[WIKI-snmptrap\]: http://en.wikipedia.org/wiki/Simple\_Network\_Management\_Protocol#Trap ### service: socks - SOCKet Secure Example: - ``` server socks accept ``` Service Type: - • simple Server Ports: - • tcp/1080 udp/1080 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-socks\] Notes See also RFC 1928 ⟨http://www.ietf.org/rfc/rfc1928.txt⟩\\c . \[WIKI-socks\]: http://en.wikipedia.org/wiki/SOCKS ### service: squid - Squid Web Cache Example: - ``` server squid accept ``` Service Type: - • simple Server Ports: - • tcp/3128 Client Ports: - • default Links - • Homepage ⟨http://www.squid-cache.org/⟩\\c - • Wikipedia ⟨http://en.wikipedia.org/wiki/Squid\_(software)⟩\\c ### service: ssh - Secure Shell Protocol Example: - ``` server ssh accept ``` Service Type: - • simple Server Ports: - • tcp/22 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Secure\_Shell⟩\\c ### service: stun - Session Traversal Utilities for NAT Example: - ``` server stun accept ``` Service Type: - • simple Server Ports: - • udp/3478 udp/3479 Client Ports: - • any Links - • \[Wikipedia\]\[WIKI-stun\] Notes STUN ⟨http://www.voip-info.org/wiki/view/STUN⟩\\c is a protocol for assisting devices behind a NAT firewall or router with their packet routing. \[WIKI-stun\]: http://en.wikipedia.org/wiki/STUN ### service: submission - SMTP over SSL/TLS submission Example: - ``` server submission accept ``` Service Type: - • simple Server Ports: - • tcp/587 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-submission\] Notes Submission is essentially normal SMTP with an SSL/TLS negotiation. \[WIKI-submission\]: http://en.wikipedia.org/wiki/Simple\_Mail\_Transfer\_Protocol ### service: sunrpc - Open Network Computing Remote Procedure Call - Port Mapper Alias for portmap ### service: swat - Samba Web Administration Tool Example: - ``` server swat accept ``` Service Type: - • simple Server Ports: - • tcp/901 Client Ports: - • default Links - • Homepage ⟨http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/SWAT.html⟩\\c ### service: syslog - Syslog Remote Logging Protocol Example: - ``` server syslog accept ``` Service Type: - • simple Server Ports: - • udp/514 Client Ports: - • 514 default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Syslog⟩\\c ### service: telnet - Telnet Example: - ``` server telnet accept ``` Service Type: - • simple Server Ports: - • tcp/23 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Telnet⟩\\c ### service: tftp - Trivial File Transfer Protocol Example: - ``` server tftp accept ``` Service Type: - • simple Server Ports: - • udp/69 Client Ports: - • default Netfilter Modules - • nf\_conntrack\_tftp CONFIG\_NF\_CONNTRACK\_TFTP ⟨http://cateee.net/lkddb/web-lkddb/NF\_CONNTRACK\_TFTP.html⟩\\c Netfilter NAT Modules - • nf\_nat\_tftp CONFIG\_NF\_NAT\_TFTP ⟨http://cateee.net/lkddb/web-lkddb/NF\_NAT\_TFTP.html⟩\\c Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Trivial\_File\_Transfer\_Protocol⟩\\c ### service: time - Time Protocol Example: - ``` server time accept ``` Service Type: - • simple Server Ports: - • tcp/37 udp/37 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Time\_Protocol⟩\\c ### service: timestamp - ICMP Timestamp Example: - ``` server timestamp accept ``` Service Type: - • complex Server Ports: - • N/A Client Ports: - • N/A Links - • \[Wikipedia\]\[WIKI-timestamp\] Notes This services matches requests of protocol ICMP and type timestamp-request (TYPE=13) and their replies of type timestamp-reply (TYPE=14). The timestamp service is stateful. \[WIKI-timestamp\]: http://en.wikipedia.org/wiki/Internet\_Control\_Message\_Protocol#Timestamp ### service: tomcat - HTTP alternate port Alias for httpalt ### service: upnp - Universal Plug and Play Example: - ``` server upnp accept ``` Service Type: - • simple Server Ports: - • udp/1900 tcp/2869 Client Ports: - • default Links - • \[Homepage\]\[HOME-upnp\] - • \[Wikipedia\]\[WIKI-upnp\] Notes For a Linux implementation see: Linux IGD ⟨http://linux-igd.sourceforge.net/⟩\\c . \[HOME-upnp\]: http://upnp.sourceforge.net/ \[WIKI-upnp\]: http://en.wikipedia.org/wiki/Universal\_Plug\_and\_Play ### service: uucp - Unix-to-Unix Copy Example: - ``` server uucp accept ``` Service Type: - • simple Server Ports: - • tcp/540 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/UUCP⟩\\c ### service: vmware - vmware Example: - ``` server vmware accept ``` Service Type: - • simple Server Ports: - • tcp/902 Client Ports: - • default Notes Used from VMWare 1 and up. See the http://kb.vmware.com/selfservice/microsites/search.do?language=en\_US&cmd=displayKC&externalId=1012382 VMWare KnowledgeBase ⟨⟩\\c . ### service: vmwareauth - vmwareauth Example: - ``` server vmwareauth accept ``` Service Type: - • simple Server Ports: - • tcp/903 Client Ports: - • default Notes Used from VMWare 1 and up. See the http://kb.vmware.com/selfservice/microsites/search.do?language=en\_US&cmd=displayKC&externalId=1012382 VMWare KnowledgeBase ⟨⟩\\c . ### service: vmwareweb - vmwareweb Example: - ``` server vmwareweb accept ``` Service Type: - • simple Server Ports: - • tcp/8222 tcp/8333 Client Ports: - • default Notes Used from VMWare 2 and up. See http://www.vmware.com/support/server2/doc/releasenotes\_vmserver2.html VMWare Server 2.0 release notes ⟨⟩\\c and the http://kb.vmware.com/selfservice/microsites/search.do?language=en\_US&cmd=displayKC&externalId=1012382 VMWare KnowledgeBase ⟨⟩\\c . ### service: vnc - Virtual Network Computing Example: - ``` server vnc accept ``` Service Type: - • simple Server Ports: - • tcp/5900:5903 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-vnc\] Notes VNC is a graphical desktop sharing protocol. \[WIKI-vnc\]: http://en.wikipedia.org/wiki/Virtual\_Network\_Computing ### service: webcache - HTTP alternate port Alias for httpalt ### service: webmin - Webmin Administration System Example: - ``` server webmin accept ``` Service Type: - • simple Server Ports: - • tcp/10000 Client Ports: - • default Links - • Homepage ⟨http://www.webmin.com/⟩\\c ### service: whois - WHOIS Protocol Example: - ``` server whois accept ``` Service Type: - • simple Server Ports: - • tcp/43 Client Ports: - • default Links - • Wikipedia ⟨http://en.wikipedia.org/wiki/Whois⟩\\c ### service: xbox - Xbox Live Example: - ``` client xbox accept ``` Service Type: - • complex Server Ports: - • many Client Ports: - • default Notes Definition for the Xbox live service. See program source for contributor details. ### service: xdmcp - X Display Manager Control Protocol Example: - ``` server xdmcp accept ``` Service Type: - • simple Server Ports: - • udp/177 Client Ports: - • default Links - • \[Wikipedia\]\[WIKI-xdmcp\] Notes See Gnome Display Manager ⟨http://www.jirka.org/gdm-documentation/x70.html⟩\\c for a discussion about XDMCP and firewalls (Gnome Display Manager is a replacement for XDM). \[WIKI-xdmcp\]: http://en.wikipedia.org/wiki/X\_display\_manager\_(program\_type)#X\_Display\_Manager\_Control\_Protocol ## AUTHORS FireHOL Team.