.\" Automatically generated by Pandoc 3.1.3
.nh
.\"
.\" Define V font for inline verbatim, using C font in formats
.\" that render this, and otherwise B font.
.ie "\f[CB]x\f[]"x" \{\
. ftr V B
. ftr VI BI
. ftr VB B
. ftr VBI BI
.\}
.el \{\
. ftr V CR
. ftr VI CI
. ftr VB CB
. ftr VBI CBI
.\}
.TH "firehol" "1" "Built 30 Mar 2024" "FireHOL Reference" "3.1.7"
.hy
.SH NAME
.PP
firehol - an easy to use but powerful iptables stateful firewall
.SH SYNOPSIS
.PP
firehol
.PP
sudo -E firehol panic [ \f[I]IP\f[R] ]
.PP
firehol \f[I]command\f[R] [ \[en] \f[I]conf-arg\f[R]\&...
]
.PP
firehol \f[I]CONFIGFILE\f[R] [start|debug|try] [\[en]
\f[I]conf-arg\f[R]\&...
]
.SH DESCRIPTION
.PP
Running \f[V]firehol\f[R] invokes iptables(8) to manipulate your
firewall.
.PP
Run without any arguments, \f[V]firehol\f[R] will present some help on
usage.
.PP
When given \f[I]CONFIGFILE\f[R], \f[V]firehol\f[R] will use the named
file instead of \f[V]/etc/firehol/firehol.conf\f[R] as its
configuration.
If no \f[I]command\f[R] is given, \f[V]firehol\f[R] assumes
\f[V]try\f[R].
.PP
It is possible to pass arguments for use by the configuration file
separating any conf-arg values from the rest of the arguments with
\f[V]--\f[R].
The arguments are accessible in the configuration using standard bash(1)
syntax e.g.\ $1, $2, etc.
.SS PANIC
.PP
To block all communication, invoke \f[V]firehol\f[R] with the
\f[V]panic\f[R] command.
.PP
FireHOL removes all rules from the running firewall and then DROPs all
traffic on all iptables(8) tables (mangle, nat, filter) and pre-defined
chains (PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING).
.PP
DROPing is not done by changing the default policy to DROP, but by
adding one rule per table/chain to drop all traffic.
This allows systems which do not reset all the chains to ACCEPT when
starting to function correctly.
.PP
When activating panic mode, FireHOL checks for the existence of the
SSH_CLIENT shell environment variable, which is set by ssh(1).
If it finds this, then panic mode will allow the established SSH
connection specified in this variable to operate.
.RS
.PP
\f[B]Note\f[R]
.PP
In order for FireHOL to see the environment variable you must ensure
that it is preserved.
For sudo(8) use the \f[V]-E\f[R] and for su(1) omit the \f[V]-\f[R]
(minus sign).
.RE
.PP
If SSH_CLIENT is not set, the \f[I]IP\f[R] after the panic argument
allows you to give an IP address for which all established connections
between the IP address and the host in panic will be allowed to
continue.
.SH COMMANDS
.TP
start; restart
Activates the firewall using \f[V]/etc/firehol/firehol.conf\f[R].
.RS
.PP
Use of the term \f[V]restart\f[R] is allowed for compatibility with
common init implementations.
.RE
.TP
try
Activates the firewall, waiting for the user to type the word
\f[V]commit\f[R].
If this word is not typed within 30 seconds, the previous firewall is
restored.
.TP
stop
Stops a running iptables(8) firewall by clearing all of the tables and
chains and setting the default policies to ACCEPT.
This will allow all traffic to pass unchecked.
.TP
condrestart
Restarts the FireHOL firewall only if it is already active.
This is the generally expected behaviour (but opposite to FireHOL prior
to 2.0.0-pre4).
.TP
status
Shows the running firewall, using \f[V]/sbin/iptables -nxvL | less\f[R].
.TP
save
Start the firewall and then save it using iptables-save(8) to the
location given by FIREHOL_AUTOSAVE.
See firehol-defaults.conf(5) for more information.
.RS
.PP
The required kernel modules are saved to an executable shell script
\f[V]/var/spool/firehol/last_save_modules.sh\f[R], which can be called
during boot if a firewall is to be restored.
.RS
.PP
\f[B]Note\f[R]
.PP
External changes may cause a firewall restored after a reboot to not
work as intended where starting the firewall with FireHOL will work.
.PP
This is because as part of starting a firewall, FireHOL checks some
changeable values.
For instance the current kernel configuration is checked (for client
port ranges), and RPC servers are queried (to allow correct functioning
of the NFS service).
.RE
.RE
.TP
debug
Parses the configuration file but instead of activating it, FireHOL
shows the generated iptables(8) statements.
.TP
explain
Enters an interactive mode where FireHOL accepts normal configuration
commands and presents the generated iptables(8) commands for each of
them, together with some reasoning for its purpose.
.RS
.PP
Additionally, FireHOL automatically generates a configuration script
based on the successful commands given.
.PP
Some extra commands are available in \f[V]explain\f[R] mode.
.TP
help
Present some help
.TP
show
Present the generated configuration
.TP
quit
Exit interactive mode and quit
.RE
.TP
helpme; wizard
Tries to guess the FireHOL configuration needed for the current machine.
.RS
.PP
FireHOL will not stop or alter the running firewall.
The configuration file is given in the standard output of firehol, thus
\f[V]firehol helpme > /tmp/firehol.conf\f[R] will produce the output in
\f[V]/tmp/firehol.conf\f[R].
.PP
The generated FireHOL configuration \f[I]must\f[R] be edited before use
on your systems.
You are required to take a number of decisions; the comments in the
generated file will instruct you in the choices you must make.
.RE
.SH FILES
.PP
\f[V]/etc/firehol/firehol.conf\f[R]
.SH SEE ALSO
.IP \[bu] 2
firehol.conf(5) - FireHOL configuration
.IP \[bu] 2
firehol-defaults.conf(5) - control variables
.IP \[bu] 2
FireHOL Website (http://firehol.org/)
.IP \[bu] 2
FireHOL Online PDF Manual (http://firehol.org/firehol-manual.pdf)
.IP \[bu] 2
FireHOL Online Documentation (http://firehol.org/documentation/)
.SH AUTHORS
FireHOL Team; Original man page by Marc Brockschmidt.