├── VERSION ├── AUTHORS ├── README.LDAP.md ├── uif-ipv4-networks.inc ├── uif-ipv6-networks.inc ├── INSTALL.md ├── COPYRIGHT ├── default ├── README.md ├── compare-v4-iptables+nft-results.sh ├── compare-v6-iptables+nft-results.sh ├── uif.spec ├── README.IPv6.md ├── Makefile ├── services ├── docs ├── examples.IPv4.txt ├── uif.conf.IPv4.tmpl └── uif.conf.IPv4+6.tmpl ├── uif.8 ├── uif.schema ├── uif.initscript ├── uif.conf ├── uif.conf.5 ├── ChangeLog └── uif.pl /VERSION: -------------------------------------------------------------------------------- 1 | 1.99.0 2 | -------------------------------------------------------------------------------- /AUTHORS: -------------------------------------------------------------------------------- 1 | Alex Owen 2 | Cajus Pollmeier 3 | klemens 4 | Mike Gabriel 5 | -------------------------------------------------------------------------------- /README.LDAP.md: -------------------------------------------------------------------------------- 1 | # README.LDAP for UIF 1.99.0 2 | 3 | ## Documentation / LDAP 4 | 5 | There is some LDAP support built into UIF, with that you can handle a big 6 | farm of diskles router configurations. Use uif(8) and information 7 | provided in the doc/ directory to configure the firewall fitting your 8 | needs. 9 | 10 | ## Call for help 11 | 12 | The LDAP support in UIF hasn't been tested for quite a while. Most users 13 | of UIF have use cases with local configuration files. If you feel like 14 | contributing, please dive into the LDAP functionality of UIF and test it, 15 | report bugs, give feedback, etc. 16 | -------------------------------------------------------------------------------- /uif-ipv4-networks.inc: -------------------------------------------------------------------------------- 1 | ## IPv4 network name definitions for UIF 2 | # In the network section you're asked to provide informations on all 3 | # IPv4 hosts and/or networks running in your setup. 4 | # 5 | # syntax: net_name [ip-address[=mac-address]] [network] [net_name] 6 | # examples: webserver 192.168.1.5 7 | # intranet 10.1.0.0/16 8 | # dmz 10.5.0.0/255.255.0.0 9 | # some intranet dmz 10.2.1.1 10 | # router 10.1.0.1=0A:32:F2:C7:1A:31 11 | 12 | network { 13 | localhost 127.0.0.1 14 | all 0.0.0.0/0 15 | # trusted 192.168.1.0/24 16 | } 17 | -------------------------------------------------------------------------------- /uif-ipv6-networks.inc: -------------------------------------------------------------------------------- 1 | ## IPv6 network name definitions for UIF 2 | # In the network section you're asked to provide informations on all 3 | # IPv6 hosts and/or networks running in your setup. 4 | # 5 | # syntax: net_name [ip-address[=mac-address]] [network] [net_name] 6 | # examples: webserver 2001:610:1908:b000::148:14 7 | # intranet fd00:0:0:1::/64 8 | # dmz fd00:0:0:5::/64 9 | # some intranet dmz fd00:0:2:1::1 10 | # router fd00:0:0:1::1=0A:32:F2:C7:1A:31 11 | 12 | network { 13 | localhost ::1 14 | all ::/0 15 | # trusted fd00:1:2:3::/64 16 | } 17 | -------------------------------------------------------------------------------- /INSTALL.md: -------------------------------------------------------------------------------- 1 | # Installation Guide for UIF 1.99.0 2 | 3 | This file contains some quick installation hints for 4 | the UIF package. 5 | 6 | ## Download 7 | 8 | You can get the newest version at https://github.com/cajus/uif. 9 | 10 | ## Dependencies 11 | 12 | In order to use the script, you need iptables, ip6tables, Perl, 13 | NetAddr::IP (>=3.0), Socket, Data::Validate::IP and optionally Net::LDAP. 14 | 15 | ## Build 16 | 17 | Well - there's nothing to build. Just change the PREFIX on top of the 18 | Makefile and do a "make install". If you want to start UIF during bootup 19 | you should add the needed links in /etc/rc*. See file "uif.initscript" 20 | for a working init script. 21 | 22 | ## Debian 23 | 24 | The UIF package is regularly released via Debian. Use APT to retrieve 25 | this piece of software directly from the Debian archives: 26 | 27 | ``` 28 | # apt-get install uif 29 | ``` 30 | 31 | ## Documentation 32 | 33 | Use "man uif" and "man uif.conf" to see what's possible. 34 | -------------------------------------------------------------------------------- /COPYRIGHT: -------------------------------------------------------------------------------- 1 | Copyright (C) 2002-2015 Jörg Platte 2 | Copyright (C) 2002-2015 Cajus Pollmeier 3 | Copyright (C) 2013-2015 Alex Owen 4 | Copyright (C) 2013-2022 Mike Gabriel 5 | 6 | All of uif is licensed under the GPL-2.0+ (GPL-2.0 or newer) license: 7 | 8 | This program is free software; you can redistribute it and/or modify 9 | it under the terms of the GNU General Public License as published by 10 | the Free Software Foundation; either version 2 of the License, or 11 | (at your option) any later version. 12 | 13 | This program is distributed in the hope that it will be useful, 14 | but WITHOUT ANY WARRANTY; without even the implied warranty of 15 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 | GNU General Public License for more details. 17 | 18 | You should have received a copy of the GNU General Public License 19 | along with this program; if not, write to the Free Software 20 | Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 21 | 22 | See the COPYING file for a full text version of the license. 23 | -------------------------------------------------------------------------------- /default: -------------------------------------------------------------------------------- 1 | ## Debian firewall package standard values 2 | # See "man 8 uif" for details. 3 | 4 | ### UIF settings, these need to be exported to the environment 5 | 6 | # 'nft', 'iptables', 'iptables-nft' or 'iptables-legacy'? 7 | export FILTER_COMMAND="nft" 8 | 9 | # the iptables loglevel 10 | export LOGLEVEL="crit" 11 | 12 | # prefix for all logged incidents 13 | export LOGPREFIX="FW" 14 | 15 | # iptables log specific options 16 | export LOGLIMIT="20/minute" 17 | export LOGBURST="5" 18 | 19 | # iptables limit specific options 20 | export LIMIT="20/minute" 21 | export BURST="5" 22 | 23 | # firewall testing timeout 24 | export TIMEOUT=30 25 | 26 | # prefix for accounting rules 27 | export ACCOUNTPREFIX="ACC_" 28 | 29 | ### UIF init script setting, need not be exported to the environment 30 | 31 | # specify modules to load before startup 32 | MODULES="ip_conntrack_ftp" 33 | 34 | # who should get the mails when the script fails 35 | MAILTO="root" 36 | 37 | # IPV6MODE can be set to 0 or 1. By default it is 0 38 | # If set to 1 then both an IPv4 and an IPv6 firewall will be started 39 | # Uncomment below to enable the IPV6MODE 40 | IPV6MODE=1 41 | 42 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # README for UIF 1.99.0 2 | 3 | ## Documentation 4 | 5 | The UIF project has been developed for a diskless router system and provides 6 | a mechanism to create and simplify packet filter rules. It forces you to 7 | provide names for every value you use in order to make firewalls less 8 | confusing. 9 | 10 | Please have a look at the man pages for uif(8) and uif.conf(5). There 11 | are also example configurations in the docs/ directory. 12 | 13 | There is some LDAP support built-in, with that you can handle a big farm 14 | of diskles router configurations. Use uif(8) and information provided in 15 | the doc/ directory to configure the firewall fitting your needs. 16 | 17 | 18 | ## Bugs / Wishlist 19 | 20 | UIF is on Github. If you've found a bug, or have suggestions for future 21 | versions please report it via the project's issue tracker: 22 | https://github.com/cajus/uif/issues 23 | 24 | If you have installed UIF on Debian, you can also use the Debian BTS for 25 | reporting bugs. As the Debian maintainer of UIF is a member of the UIF 26 | upstream development team, the Debian bugs will also reach upstream quickly. 27 | 28 | 29 | Have fun, 30 | -Jörg Platte, Cajus Pollmeier, Mike Gabriel, Alex Owen 31 | -------------------------------------------------------------------------------- /compare-v4-iptables+nft-results.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # Copyright (C) 2022 Mike Gabriel 4 | # 5 | # This program is free software; you can redistribute it and/or modify 6 | # it under the terms of the GNU General Public License as published by 7 | # the Free Software Foundation; either version 2 of the License, or 8 | # (at your option) any later version. 9 | # 10 | # This program is distributed in the hope that it will be useful, 11 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 | # GNU General Public License for more details. 14 | # 15 | # You should have received a copy of the GNU General Public License 16 | # along with this program; if not, write to the Free Software 17 | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 18 | 19 | # this script requires /etc/uif/ to be in place and configured well 20 | 21 | tmpresults_nft="$(mktemp)" 22 | tmpresults_iptables="$(mktemp)" 23 | 24 | sudo nft flush ruleset ip 25 | 26 | sudo FILTER_COMMAND=nft ./uif.pl 27 | sudo nft list ruleset ip 1> "${tmpresults_nft}" 28 | sudo nft flush ruleset ip 29 | 30 | sudo FILTER_COMMAND=iptables-nft ./uif.pl 31 | sudo nft list ruleset ip 1> "${tmpresults_iptables}" 32 | #sudo nft flush ruleset ip 33 | 34 | diff -wu "${tmpresults_iptables}" "${tmpresults_nft}" 35 | -------------------------------------------------------------------------------- /compare-v6-iptables+nft-results.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | # Copyright (C) 2013-2022 Mike Gabriel 4 | # 5 | # This program is free software; you can redistribute it and/or modify 6 | # it under the terms of the GNU General Public License as published by 7 | # the Free Software Foundation; either version 2 of the License, or 8 | # (at your option) any later version. 9 | # 10 | # This program is distributed in the hope that it will be useful, 11 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 12 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 | # GNU General Public License for more details. 14 | # 15 | # You should have received a copy of the GNU General Public License 16 | # along with this program; if not, write to the Free Software 17 | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 18 | 19 | # this script requires /etc/uif/ to be in place and configured well 20 | 21 | tmpresults_nft="$(mktemp)" 22 | tmpresults_iptables="$(mktemp)" 23 | 24 | sudo nft flush ruleset ip6 25 | 26 | sudo FILTER_COMMAND=nft ./uif.pl -6 27 | sudo nft list ruleset ip6 1> "${tmpresults_nft}" 28 | sudo nft flush ruleset ip6 29 | 30 | sudo FILTER_COMMAND=iptables-nft ./uif.pl -6 31 | sudo nft list ruleset ip6 1> "${tmpresults_iptables}" 32 | #sudo nft flush ruleset ip6 33 | 34 | diff -wu "${tmpresults_iptables}" "${tmpresults_nft}" 35 | -------------------------------------------------------------------------------- /uif.spec: -------------------------------------------------------------------------------- 1 | Summary: Tool for generating optimized packetfilter rules under GPL 2 | Name: uif 3 | Version: 1.99.0 4 | Release: 0 5 | License: GPL 6 | Group: System 7 | Source: https://github.com/cajus/uif/archive/%{version}.zip 8 | URL: https://github.com/cajus/uif 9 | Prereq: perl perl-netaddr-ip perl-ldap iptables 10 | BuildRoot: %{_tmppath}/%{name}-%{version}-root 11 | 12 | %description 13 | UIF is used to generate optimized iptables(8) packetfilter rules, using a 14 | simple description file specified by the user. 15 | 16 | Generated rules are provided in iptables-save(8) style. 17 | 18 | uif can be used to read or write rulesets from or to LDAP servers in your 19 | network, which provides a global storing mechanism. (Note that you need to 20 | include the uif.schema to your slapd configuration in order to use it.) 21 | 22 | %prep 23 | %setup -q -n %{name} 24 | 25 | %build 26 | 27 | %install 28 | rm -rf %{buildroot} 29 | mkdir -p %{buildroot} 30 | 31 | DESTDIR=%{buildroot} make install 32 | 33 | 34 | %clean 35 | rm -rf %{buildroot} 36 | rm -rf %{_builddir}/%{buildsubdir} 37 | 38 | 39 | %files 40 | %defattr(-,root,root) 41 | %defattr(0644,root,root,0755) 42 | /etc/uif/services 43 | /etc/default/uif 44 | /etc/init.d/uif 45 | /etc/ldap/schema/uif.schema 46 | /usr/sbin/uif 47 | /usr/share/man/man8/uif.8.gz 48 | /usr/share/man/man5/uif.conf.5.gz 49 | %doc docs/uif.conf.tmpl 50 | %doc docs/examples.txt 51 | 52 | %changelog 53 | * Thu Jun 13 2002 Andreas Almstadt 54 | - first build 55 | 56 | * Wed Jan 22 2014 Mike Gabriel 57 | - update version, update download source and project URL 58 | 59 | * Sun Jan 15 2017 Mike Gabriel 60 | - bump upstream release to 1.1.8 61 | 62 | * Mon Aug 20 2018 Mike Gabriel 63 | - bump upstream release to 1.1.9 64 | 65 | * Mon Apr 19 2022 Mike Gabriel 66 | - bump upstream release to 1.99.0 67 | -------------------------------------------------------------------------------- /README.IPv6.md: -------------------------------------------------------------------------------- 1 | # IPv6 support for UIF 1.99.0 2 | 3 | Starting with version 1.1.0 UIF is able to handle IPv6 iptables as well 4 | as IPv4 iptables. The IPv6 support was originally provided by Alex Owen 5 | via a patch sent to the Debian bug tracker. Awesome thanks to Alex for 6 | this initial piece of work!!! 7 | 8 | With IPv6 support added, UIF can now also produce IPv6 firewall rules. 9 | The init script can, by setting IPV6MODE=1 in /etc/default/uif, be made 10 | to install the IPv4 rules from /etc/uif/uif.conf and the IPv6 rules from 11 | /etc/uif/uif6.conf. 12 | 13 | Judicious use of the include and include4 and include6 sections of the 14 | config files can mean that the ipv6 and ipv4 rules can be identical 15 | except for including a network section with IPv4 definitions and IPv6 16 | definitions respectivly. 17 | 18 | ## Configuration Examples 19 | 20 | The file uif6.conf can be a sym-link to uif.conf or contain: 21 | 22 | ``` 23 | --uif6.conf-- 24 | include { 25 | "/etc/uif/uif.conf" 26 | } 27 | ------------- 28 | ``` 29 | 30 | The file uif.conf can then be used for a single set of rules but can include 31 | different network definitions as needed: 32 | 33 | ``` 34 | --uif.conf-- 35 | #include common services 36 | include { 37 | "/etc/uif/services" 38 | } 39 | # in IPv4 mode include IPv4 network definitions 40 | include4 { 41 | "/etc/uif/networks4" 42 | } 43 | #In IPv6 mode include IPv6 network defnintions 44 | include6 { 45 | "/etc/uif/networks6" 46 | } 47 | #common filter block for both ipv4 and ipv6 48 | filter { 49 | 50 | #Put your firewall rules here 51 | 52 | } 53 | ------------ 54 | ``` 55 | 56 | 57 | As an addition it is possible to append "(4)" or "(6)" to network names in filtering 58 | rules (e.g.: "in+ s=trusted(4)"). This limits the application of this rule to the 59 | specified IP protocol version only. 60 | 61 | This can be especially helpful, if some of your network names only exist for one IP 62 | protocol version but not for the other. 63 | 64 | ## AUTHORS 65 | 66 | * Alex Owen , Sun, 15 Jul 2012 14:41:22 +0100 67 | * Mike Gabriel , Wed, 22 Jan 2014 13:50:01 +0100 68 | -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- 1 | # uif-1.1.x Installer Makefile 2 | 3 | # Copyright (C) 2002-2015, Cajus Pollmeier 4 | # Copyright (C) 2002-2015, Jörg Platte 5 | # Copyright (C) 2013-2022, Mike Gabriel 6 | # 7 | # This program is free software; you can redistribute it and/or modify 8 | # it under the terms of the GNU General Public License as published by 9 | # the Free Software Foundation; either version 2 of the License, or 10 | # (at your option) any later version. 11 | # 12 | # This program is distributed in the hope that it will be useful, 13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 15 | # GNU General Public License for more details. 16 | # 17 | # You should have received a copy of the GNU General Public License 18 | # along with this program; if not, write to the Free Software 19 | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 20 | 21 | # Change here to install to different location 22 | DESTDIR ?= 23 | PREFIX ?= /usr/local 24 | 25 | VERSION = `cat VERSION | head -1` 26 | 27 | all: 28 | 29 | install: 30 | @echo "Installing uif script..." 31 | 32 | @# create directories 33 | install -o root -g root -m 700 -d $(DESTDIR)/etc/uif 34 | install -o root -g root -m 700 -d $(DESTDIR)/etc/uif/uif.conf.d 35 | install -o root -g root -m 700 -d $(DESTDIR)/etc/uif/uif-ipv4-networks.inc.d 36 | install -o root -g root -m 700 -d $(DESTDIR)/etc/uif/uif-ipv6-networks.inc.d 37 | install -o root -g root -m 755 -d $(DESTDIR)/etc/default 38 | install -o root -g root -m 755 -d $(DESTDIR)/etc/init.d 39 | install -o root -g root -m 755 -d $(DESTDIR)/etc/ldap/schema 40 | install -o root -g root -m 755 -d $(DESTDIR)$(PREFIX)/sbin 41 | install -o root -g root -m 755 -d $(DESTDIR)$(PREFIX)/share/doc/uif 42 | install -o root -g root -m 755 -d $(DESTDIR)$(PREFIX)/share/man/man8 43 | install -o root -g root -m 755 -d $(DESTDIR)$(PREFIX)/share/man/man5 44 | 45 | @# install files 46 | install -o root -g root -m 700 uif.pl $(DESTDIR)$(PREFIX)/sbin/uif 47 | install -o root -g root -m 600 default $(DESTDIR)/etc/default/uif 48 | install -o root -g root -m 600 services $(DESTDIR)/etc/uif 49 | if [ ! -e $(DESTDIR)/etc/uif/uif.conf ]; then install -o root -g root -m 600 uif.conf $(DESTDIR)/etc/uif; fi 50 | if [ ! -e $(DESTDIR)/etc/uif/uif-ipv4-networks.inc ]; then install -o root -g root -m 600 uif-ipv4-networks.inc $(DESTDIR)/etc/uif; fi 51 | if [ ! -e $(DESTDIR)/etc/uif/uif-ipv6-networks.inc ]; then install -o root -g root -m 600 uif-ipv6-networks.inc $(DESTDIR)/etc/uif; fi 52 | install -o root -g root -m 755 uif.initscript $(DESTDIR)/etc/init.d 53 | mv $(DESTDIR)/etc/init.d/uif.initscript $(DESTDIR)/etc/init.d/uif 54 | install -o root -g root -m 644 uif.schema $(DESTDIR)/etc/ldap/schema 55 | 56 | @# install documentation 57 | install -o root -g root -m 644 docs/uif.conf.IPv4.tmpl $(DESTDIR)$(PREFIX)/share/doc/uif 58 | install -o root -g root -m 644 docs/uif.conf.IPv4+6.tmpl $(DESTDIR)$(PREFIX)/share/doc/uif 59 | install -o root -g root -m 644 docs/examples.IPv4.txt $(DESTDIR)$(PREFIX)/share/doc/uif 60 | install -o root -g root -m 644 uif.8 $(DESTDIR)$(PREFIX)/share/man/man8 61 | install -o root -g root -m 644 uif.conf.5 $(DESTDIR)$(PREFIX)/share/man/man5 62 | -------------------------------------------------------------------------------- /services: -------------------------------------------------------------------------------- 1 | ## UIF 1.0 sample services file 2 | 3 | # Copyright (C) 2002-2015, Cajus Pollmeier 4 | # Copyright (C) 2002-2015, Jörg Platte 5 | # Copyright (C) 2013-2015, Alex Owen 6 | # Copyright (C) 2013-2022, Mike Gabriel 7 | # 8 | # This program is free software; you can redistribute it and/or modify 9 | # it under the terms of the GNU General Public License as published by 10 | # the Free Software Foundation; either version 2 of the License, or 11 | # (at your option) any later version. 12 | # 13 | # This program is distributed in the hope that it will be useful, 14 | # but WITHOUT ANY WARRANTY; without even the implied warranty of 15 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 | # GNU General Public License for more details. 17 | # 18 | # You should have received a copy of the GNU General Public License 19 | # along with this program; if not, write to the Free Software 20 | # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA 21 | 22 | service { 23 | # ICMP & Routing 24 | traceroute udp(32769:65535/33434:33523) 25 | 26 | # ICMP protocol: IPv4 and IPv6 ICMP types 27 | ping icmp(echo-request) ipv6-icmp(echo-request) 28 | pong icmp(echo-reply) ipv6-icmp(echo-reply) 29 | noroute icmp(destination-unreachable) ipv6-icmp(destination-unreachable) 30 | router-advertisement icmp(router-advertisement) ipv6-icmp(router-advertisement) 31 | router-solicitation icmp(router-solicitation) ipv6-icmp(router-solicitation) 32 | 33 | # ICMP protocol: IPv4-only ICMP types 34 | host-unreachable icmp(host-unreachable) 35 | ttl-exceeded icmp(ttl-exceeded) 36 | source-quench icmp(source-quench) 37 | 38 | # ICMP protocol: IPv6-only ICMP types 39 | packet-too-big ipv6-icmp(packet-too-big) 40 | time-exceeded ipv6-icmp(time-exceeded) 41 | parameter-problem ipv6-icmp(parameter-problem) 42 | neighbor-advertisement ipv6-icmp(neighbor-advertisement) 43 | neighbor-solicitation ipv6-icmp(neighbor-solicitation) 44 | 45 | # Most common services you may want to filter 46 | ftp tcp(/21) 47 | ssh tcp(/22) 48 | telnet tcp(/23) 49 | smtp tcp(/25) 50 | whois tcp(/43) 51 | dns tcp(/53) udp(/53) 52 | bootp tcp(68/67) udp(68/67) 53 | http tcp(/80) 54 | kerberos5 tcp(/88) 55 | pop3 tcp(/110) 56 | sunrpc udp(/111) tcp(/111) 57 | ident tcp(/113) 58 | ntp udp(/123) 59 | nntp tcp(/119) 60 | smb tcp(/137:139) udp(/137:139) tcp(/445) udp(/445) 61 | imap tcp(/143) 62 | xdmcp udp(/177) 63 | ldap tcp(/389) 64 | https tcp(/443) 65 | ssmtp tcp(/465) 66 | syslog udp(/514) 67 | route udp(/520) icmp(9) 68 | uucp tcp(/540) 69 | real tcp(/554) 70 | ipp tcp(/631) udp(/631) 71 | mount udp(/635) 72 | ldaps tcp(/636) 73 | kerberos4 tcp(/750) 74 | kerberos-master tcp(/751) 75 | passwd-server tcp(/752) 76 | krb-prop tcp(/754) 77 | krbupdate tcp(/760) 78 | swat tcp(/901) 79 | imaps tcp(/993) 80 | pop3s tcp(/995) 81 | openvpn udp(/1194) tcp(/1194) 82 | nfs udp(/2049) tcp(/2049) 83 | cvspserver tcp(/2401) 84 | squid tcp(/3128) 85 | mysql tcp(/3306) 86 | rdp tcp(/3389) 87 | munin tcp(/4949) 88 | cfengine tcp(/5308) 89 | xmpp-client tcp(/5222) udp(/5222) 90 | xmpp-server tcp(/5223) udp(/5223) 91 | icinga2 tcp(/5665) 92 | vnc-support tcp(/5500:5509) 93 | x11 tcp(/6000:6063) 94 | proxy tcp(/8080) 95 | puppet tcp(/8140) 96 | webmin tcp(/10000) 97 | dhis udp(/58800) 98 | 99 | # ipsec 100 | ipsec esp(/) udp(/500) 101 | 102 | # some proprietary protocols 103 | arkeia tcp(/617) 104 | pcanywhere udp(/5632) tcp(/5631) 105 | msterminal tcp(/3389) udp(/3389) 106 | 107 | # some protocols 108 | igmp igmp() 109 | pim pim() 110 | tcp tcp(0:65535/0:65535) 111 | udp udp(0:65535/0:65535) 112 | 113 | # some useful definitions 114 | lowports udp(/1:1023) tcp(/1:1023) 115 | highports udp(/1024:65535) tcp(/1024:65535) 116 | } 117 | -------------------------------------------------------------------------------- /docs/examples.IPv4.txt: -------------------------------------------------------------------------------- 1 | EXAMPLES for UIF 2 | ================ 3 | 4 | These sample configurations are fully virtual setups but may contain valid 5 | ip addresses. 6 | 7 | 8 | 1) Simple router/proxy setup 9 | 10 | Imagine the following scenario with one packet filter and masquerading: 11 | 12 | ppp0 eth0 13 | internet-----------filter-------------proxy---------intranet 14 | 193.174.71.23 192.168.0.1 192.168.0.2 192.168.0.0/24 15 | 16 | The filter masquerades the proxy address and rejects all other internal 17 | traffic to the internet. 18 | 19 | Don't forget to enable forwarding (sysctl -w net.ipv4.ip_forward=1), 20 | respectivly adding it to /etc/sysctl.conf. 21 | 22 | 23 | 8<--------------------------------------------------------------------- 24 | include { 25 | # include the basic service definitions 26 | "/etc/uif/services" 27 | } 28 | 29 | service { 30 | # define all valid services from the proxy into the internet 31 | proxytraffic http https ntp pop3s imaps smtp ssh ftp 32 | } 33 | 34 | network { 35 | # define all networks and hosts 36 | proxy 192.168.0.2 37 | intern 192.168.0.0/24 38 | 39 | gonicus 21.8.6.9 40 | ds 129.27.18.16 41 | 42 | # accept external ssh connections from gonicus and ds 43 | sshok ds gonicus 44 | } 45 | 46 | interface { 47 | # define all local interfaces 48 | loop lo 49 | extern ppp0 50 | intern eth0 51 | } 52 | 53 | input { 54 | # permit all loopback traffic 55 | in+ i=loop 56 | 57 | # accept local ssh logins 58 | in+ i=intern s=intern p=ssh 59 | 60 | # accept external ssh connections from gonicus and ds 61 | in+ i=extern s=sshok p=ssh 62 | 63 | # accept pings 64 | in+ i=extern p=ping 65 | 66 | # reject and log all other incoming connentions 67 | in- f=log(incoming),reject 68 | } 69 | 70 | output { 71 | # permit all loopback traffic 72 | out+ o=loop 73 | 74 | # permit all outgoing traffic to the internal network 75 | out+ o=intern 76 | 77 | # permit outgoing ntp and ssh connections 78 | out+ o=extern p=ntp,ssh 79 | 80 | # reject all and log all other outgoing connentions 81 | out- f=log(outgoing),reject 82 | } 83 | 84 | forward { 85 | # in case of an pppoe dsl line the following line may be useful 86 | # it sets the mss of every forwarded packet to a smaller value 87 | fw> o=extern 88 | 89 | # forward previously defined proxy traffic to external hosts 90 | fw+ o=extern s=proxy p=proxytraffic 91 | 92 | # reject all and log all other outgoing connentions 93 | fw- f=log(forwarding),reject 94 | } 95 | 96 | masquerade { 97 | # masquerade proxy traffic 98 | masq+ o=extern s=proxy 99 | } 100 | --------------------------------------------------------------------->8 101 | 102 | 103 | 2) Router doing nat and transparent proxys 104 | 105 | Imagine the following (not really usable) scenario: 106 | 107 | eth0 eth1 108 | Internet---------filter------------switch 109 | 80.67.1.53 10.10.0.1 | 110 | +--gatekeeper 10.10.0.15 111 | | 112 | +--[intranet] 113 | 114 | Imagine "filter" is running squid as a transparent proxy and "gatekeeper" 115 | is your ssh gateway to the intranet. No other connections to the intranet 116 | are allowed. "filter" is acting as nameserver, no additional connections 117 | from the inside to the outside are allowed. 118 | 119 | 8<--------------------------------------------------------------------- 120 | include { 121 | # include the basic service definitions 122 | "/etc/uif/services" 123 | } 124 | 125 | network { 126 | # define all networks and hosts 127 | proxy 10.10.0.1 128 | intern 10.10.0.0/16 129 | gate 10.10.0.5 130 | } 131 | 132 | interface { 133 | # define all local interfaces 134 | loop lo 135 | extern eth0 136 | intern eth1 137 | } 138 | 139 | filter { 140 | # permit all loopback traffic 141 | in+ i=loop 142 | out+ o=loop 143 | 144 | # permit all outgoing traffic for "filter" 145 | out+ o=intern,extern 146 | 147 | # accept pings 148 | in+ i=extern p=ping 149 | 150 | # accept local ssh logins, dns, http 151 | in+ i=intern s=intern p=ssh,dns,http 152 | 153 | # redirect port 80 to 10.10.0.1:3128 154 | nat+ i=intern s=intern p=http D=proxy P=squid 155 | 156 | # redirect incomming ssh connections to gatekeeper 157 | nat+ i=extern p=ssh D=gatekeeper 158 | 159 | # reject and log all other connentions 160 | in- f=log(incoming),reject 161 | out- f=log(outgoing),reject 162 | fw- f=log(forward),reject 163 | } 164 | 165 | --------------------------------------------------------------------->8 166 | 167 | -------------------------------------------------------------------------------- /docs/uif.conf.IPv4.tmpl: -------------------------------------------------------------------------------- 1 | ## Debian GNU Linux Firewall Package 2 | ## This file has been automatically generated by debconf. It will be overwritten 3 | ## the next time you configure firewall without choosing "don't touch". 4 | 5 | 6 | ## Sysconfig definitions 7 | # These entries define the global behaviour of the firewall package. Normally 8 | # they are preset in /etc/default/uif and may be overwritten by this 9 | # section. 10 | # 11 | # syntax: LogLevel : set the kernel loglevel for iptables rules 12 | # LogPrefix: prepend this string to all iptables logs 13 | # LogLimit: set packet log limit per time interval (times/interval) 14 | # LogBurst: set packet log burst 15 | # Limit: set packet limit per time interval (times/interval) 16 | # Burst: set packet burst 17 | # example: 18 | # sysconfig { 19 | # LogLevel debug 20 | # LogPrefix FW 21 | # LogLimit 20/minute 22 | # LogBurst 5 23 | # Limit 20/minute 24 | # Burst 5 25 | # AccountPrefix ACC_ 26 | # } 27 | 28 | 29 | ## Include predefined services 30 | # The include section takes a bunch of files and includes them into this 31 | # configuration file. 32 | # 33 | # syntax: "filename" 34 | #include { 35 | # "/etc/uif/services" 36 | #} 37 | 38 | 39 | ## Services needed for workstation setup 40 | # The service section provides the protocol definitions you're 41 | # using in the rules. You're forced to declare everything you 42 | # need for your setup. 43 | # 44 | # syntax: service_name [tcp([source:range]/[dest:range])] [udp([source:range]/[dest:range])] 45 | # [protocol_name([source:range][/][dest:range])] [service_name] ... 46 | # examples: http tcp(/80) 47 | # dns tcp(/53) udp(/53) 48 | # group http dns tcp(/443) 49 | # ipsec esp(/) udp(/500) 50 | service { 51 | traceroute udp(32769:65535/33434:33523) icmp(11) 52 | ping icmp(8) 53 | } 54 | 55 | ## Network definitions needed for simple workstation setup 56 | # In the network section you're asked to provide informations on all 57 | # hosts and/or networks running in your setup. 58 | # 59 | # syntax: net_name [ip-address[:mac-address]] [network] [net_name] 60 | # examples: webserver 192.168.1.5 61 | # intranet 10.1.0.0/16 62 | # dmz 10.5.0.0/255.255.0.0 63 | # some intranet dmz 10.2.1.1 64 | # router 10.1.0.1=0A:32:F2:C7:1A:31 65 | network { 66 | localhost 127.0.0.1 67 | all 0.0.0.0/0 68 | trusted 192.168.1.0/24 69 | } 70 | 71 | ## Interface definitions 72 | # Since all definitions used in the filter section are symbolic, 73 | # you've to specify symbolic names for all your interfaces you're 74 | # going to use. 75 | # 76 | # syntax: interface_name [unix network interface] [interface_name] 77 | # examples: internal eth0 78 | # external ippp0 ipsec0 79 | # allppp ppp+ 80 | # group external allppp eth3 81 | interface { 82 | loop lo 83 | } 84 | 85 | ## Filter definitions 86 | # The filter section defines the rules for in, out, forward, masquerading 87 | # and nat. All rules make use of the symbolic names defined above. This 88 | # section can be used multiple times in one config file. This makes more 89 | # senese when using one of these alias names: 90 | # filter, nat, input, output, forward, masquerade 91 | # 92 | # syntax: in[-/+] [i=interface] [s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n] 93 | # out[-/+] [o=interface] [s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n] 94 | # fw[>/-/+] [i/o=interface][s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n] 95 | # masq[-/+][i/o=interface][s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n] 96 | # nat[-/+] additionally allows [S=from source] [D=to destination] [P=to port:[range]] 97 | # additional: 98 | # All keys mentioned in the syntax section (in/out/...) can be prefixed with "sl", which 99 | # causes the creation of a stateless rule. 100 | # flags: limit([count/time[,burst]]) 101 | # reject([reject type]) 102 | # log([name]) 103 | # account(name) 104 | # examples: 105 | # masq+ o=extern s=intranet 106 | # nat+ s=intranet p=http D=relayintern P=squid 107 | # in+ s=trusted p=ssh,ping,traceroute,http 108 | # out- s=intranet p=smb f=reject 109 | # fw- d=microsoft f=reject,log(ms-alert) 110 | # slin+ s=testnet 111 | # slout- d=testnet 112 | # fw> o=extern 113 | # fw+ p=myhttp f=account(HTTP) 114 | # Take an attention about the protocol for your accounting rules. If you 115 | # want to count user http traffice, you may need a "myhttp tcp(80/)". 116 | filter { 117 | in+ i=loop s=localhost 118 | out+ o=loop d=localhost 119 | 120 | in+ p=ping,traceroute 121 | in+ s=trusted 122 | out+ d=all 123 | 124 | in- f=log(input),reject 125 | out- f=log(output),reject 126 | fw- f=log(forward),reject 127 | } 128 | -------------------------------------------------------------------------------- /docs/uif.conf.IPv4+6.tmpl: -------------------------------------------------------------------------------- 1 | ## Debian GNU Linux Firewall Package 2 | ## This file has been automatically generated by debconf. It will be overwritten 3 | ## the next time you configure firewall without choosing "don't touch". 4 | 5 | 6 | ## Sysconfig definitions 7 | # These entries define the global behaviour of the firewall package. Normally 8 | # they are preset in /etc/default/uif and may be overwritten by this 9 | # section. 10 | # 11 | # syntax: LogLevel : set the kernel loglevel for iptables rules 12 | # LogPrefix: prepend this string to all iptables logs 13 | # LogLimit: set packet log limit per time interval (times/interval) 14 | # LogBurst: set packet log burst 15 | # Limit: set packet limit per time interval (times/interval) 16 | # Burst: set packet burst 17 | # example: 18 | # sysconfig { 19 | # LogLevel debug 20 | # LogPrefix FW 21 | # LogLimit 20/minute 22 | # LogBurst 5 23 | # Limit 20/minute 24 | # Burst 5 25 | # AccountPrefix ACC_ 26 | # } 27 | 28 | 29 | ## Include predefined services 30 | # The include section takes a bunch of files and includes them into this 31 | # configuration file. 32 | # 33 | # syntax: "filename" 34 | #include { 35 | # "/etc/uif/services" 36 | #} 37 | 38 | 39 | ## Services needed for workstation setup 40 | # The service section provides the protocol definitions you're 41 | # using in the rules. You're forced to declare everything you 42 | # need for your setup. 43 | # 44 | # syntax: service_name [tcp([source:range]/[dest:range])] [udp([source:range]/[dest:range])] 45 | # [protocol_name([source:range][/][dest:range])] [service_name] ... 46 | # examples: http tcp(/80) 47 | # dns tcp(/53) udp(/53) 48 | # group http dns tcp(/443) 49 | # ipsec esp(/) udp(/500) 50 | service { 51 | traceroute udp(32769:65535/33434:33523) icmp(11) 52 | ping icmp(8) 53 | } 54 | 55 | ## Network definitions needed for simple workstation setup 56 | # In the network section you're asked to provide informations on all 57 | # hosts and/or networks running in your setup. 58 | # 59 | # syntax: net_name [ip-address[:mac-address]] [network] [net_name] 60 | # examples: webserver 192.168.1.5 61 | # intranet 10.1.0.0/16 62 | # dmz 10.5.0.0/255.255.0.0 63 | # some intranet dmz 10.2.1.1 64 | # router 10.1.0.1=0A:32:F2:C7:1A:31 65 | network { 66 | localhost 127.0.0.1 67 | all 0.0.0.0/0 68 | trusted4 192.168.1.0/24 69 | trusted6 fd00:1:2:3::/64 70 | } 71 | 72 | ## Interface definitions 73 | # Since all definitions used in the filter section are symbolic, 74 | # you've to specify symbolic names for all your interfaces you're 75 | # going to use. 76 | # 77 | # syntax: interface_name [unix network interface] [interface_name] 78 | # examples: internal eth0 79 | # external ippp0 ipsec0 80 | # allppp ppp+ 81 | # group external allppp eth3 82 | interface { 83 | loop lo 84 | } 85 | 86 | ## Filter definitions 87 | # The filter section defines the rules for in, out, forward, masquerading 88 | # and nat. All rules make use of the symbolic names defined above. This 89 | # section can be used multiple times in one config file. This makes more 90 | # senese when using one of these alias names: 91 | # filter, nat, input, output, forward, masquerade 92 | # 93 | # syntax: in[-/+] [i=interface] [s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n] 94 | # out[-/+] [o=interface] [s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n] 95 | # fw[>/-/+] [i/o=interface][s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n] 96 | # masq[-/+][i/o=interface][s=source_net] [d=dest_net] [p=protocol] [f=flag_1,..,flag_n] 97 | # nat[-/+] additionally allows [S=from source] [D=to destination] [P=to port:[range]] 98 | # additional: 99 | # All keys mentioned in the syntax section (in/out/...) can be prefixed with "sl", which 100 | # causes the creation of a stateless rule. 101 | # flags: limit([count/time[,burst]]) 102 | # reject([reject type]) 103 | # log([name]) 104 | # account(name) 105 | # examples: 106 | # masq+ o=extern s=intranet 107 | # nat+ s=intranet p=http D=relayintern P=squid 108 | # in+ s=trusted p=ssh,ping,traceroute,http 109 | # out- s=intranet p=smb f=reject 110 | # fw- d=microsoft f=reject,log(ms-alert) 111 | # slin+ s=testnet 112 | # slout- d=testnet 113 | # fw> o=extern 114 | # fw+ p=myhttp f=account(HTTP) 115 | # Take an attention about the protocol for your accounting rules. If you 116 | # want to count user http traffice, you may need a "myhttp tcp(80/)". 117 | filter { 118 | in+ i=loop s=localhost 119 | out+ o=loop d=localhost 120 | 121 | 122 | # allow incoming pings for IPv4 123 | in+ s=all(4) p=ping 124 | # these IPv6-ICMP types are a MUST for IPv6 125 | in+ s=all(6) p=ping,pong,noroute,packet-too-big,time-exceeded,parameter-problem,neighbor-advertisement,neighbor-solicitation 126 | 127 | in+ p=traceroute 128 | 129 | in+ s=trusted4(4) 130 | in+ s=trusted6(6) 131 | 132 | out+ d=all 133 | 134 | in- f=log(input),reject 135 | out- f=log(output),reject 136 | fw- f=log(forward),reject 137 | } 138 | -------------------------------------------------------------------------------- /uif.8: -------------------------------------------------------------------------------- 1 | .TH uif 8 "Apr 19th, 2022" "Version 1.99.0" "Universal Internet Firewall" 2 | .SH NAME 3 | uif \- Universal Internet Firewall 4 | .SH SYNOPSIS 5 | 'nh 6 | .fi 7 | .ad l 8 | \fBuif\fR \kx 9 | .if (\nx>(\n(.l/2)) .nr x (\n(.l/5) 10 | 'in \n(.iu+\nxu 11 | [-c \fI\fR] [-n] [-p [-l]] [\fI-6\fR] 12 | 'in \n(.iu-\nxu 13 | \fBuif\fR \kx 14 | .if (\nx>(\n(.l/2)) .nr x (\n(.l/5) 15 | 'in \n(.iu+\nxu 16 | -d [\fI-6\fR] 17 | 'in \n(.iu-\nxu 18 | \fBuif\fR \kx 19 | .if (\nx>(\n(.l/2)) .nr x (\n(.l/5) 20 | 'in \n(.iu+\nxu 21 | [] 22 | 'in \n(.iu-\nxu 23 | .ad b 24 | 'hy 25 | 26 | .SH DESCRIPTION 27 | .PP 28 | This manual page documents the \fBuif\fR command. It is used to generate 29 | optimized 30 | .BR nft (8) 31 | or 32 | .BR iptables (8) 33 | packetfilter rules, using a simple description file specified by the 34 | user. Generated rules are provided in 35 | .BR nft (8) 36 | (with option \fI-f \fR) or 37 | .BR iptables\-save 8 38 | style. \fBuif\fR can be used to read or write rulesets from or to LDAP 39 | servers in your network, which provides a global storing mechanism (LDAP 40 | support hasn't been tested for a long time). Note that you need to 41 | include the \fIuif.schema\fR to your slapd configuration in order to use it. 42 | .PP 43 | .BR uif.conf (5) 44 | provides an easy way to specify rules, without exact knowledge of the nft 45 | / iptables syntax. It provides groups and aliases to make your 46 | packetfilter human readable. 47 | .PP 48 | Keep in mind that \fBuif\fR uif is intended to assist you when designing 49 | firewalls, but will not tell you what to filter. 50 | 51 | .SH OPTIONS 52 | The options are as follows: 53 | .TP 54 | \fI\-6\fR 55 | Turn on IPv6 mode so as to manipulate IPv6 rules. Default configuration 56 | file is changed to /etc/uif/uif6.conf see \-c below. It should be noted 57 | that nat rules are silently ignored if \-6 is used. 58 | .TP 59 | \fI\-b \fR 60 | Specify the base DN to act on when using LDAP based firewall 61 | configuration. \fBuif\fR will look in the subtree 62 | ou=filter,ou=sysconfig, for your rulesets. 63 | .TP 64 | \fI\-c \fR 65 | This option specifies the configuration file to be read by 66 | \fBuif\fR\. 67 | See 68 | .BR uif.conf (5) 69 | for detailed information on the fileformat. It defaults to /etc/uif/uif.conf. 70 | .TP 71 | \fI\-C \fR 72 | When reading configuration data from other sources than specified with 73 | \-c you may want to convert this information into a textual 74 | configuration file. This options writes the parsed config back to the 75 | file specified by . 76 | .TP 77 | \fI\-d\fR 78 | Clears all firewall rules immediately. 79 | .TP 80 | \fI\-D \fR 81 | If a special account is needed to bind to the LDAP database, the 82 | account's DN can be specified at this point. Note: you should use this 83 | when writing an existing configuration to the LDAP. Reading the 84 | configuration may be done with an anonymous bind. 85 | .TP 86 | \fI\-p\fR 87 | Prints rules specified in the configuration to stdout. This option is 88 | mainly used for debugging the rule simplifier. 89 | .TP 90 | \fI\-l\fR 91 | If printing rules (see \-p) prepend line numbers to the print-out. 92 | .TP 93 | \fI\-r \fR 94 | Specifies the name of the ruleset to load from the LDAP database. 95 | Remember to use the \-b option to set the base. Rulesets are stored using 96 | the following dn: \fIcn=, ou=rulesets, ou=filter, ou=sysconfig, 97 | basedn\fR, where will be replaced by the ruleset specified. 98 | .TP 99 | \fI\-R \fR 100 | Specifies the name of the ruleset to write to the LDAP database. This 101 | option can be used to convert i.e. a textual configuration to an LDAP 102 | based ruleset. Like with using \-r you've to specify the LDAP base to 103 | use. Target is \fIcn=, ou=rulesets, ou=filter, ou=sysconfig, 104 | \fR, where will be replaced by the ruleset specified. 105 | .TP 106 | \fI\-s \fR 107 | This option specifies the LDAP server to be used. 108 | .TP 109 | \fI\-t\fR 110 | This option is used to validate the packetfilter configuration without applying 111 | any rules. Mainly used for debugging. 112 | .TP 113 | \fI\-T