Service | Type | Description |
AH |
simple |
Server Ports |
51/any
| Client Ports |
any
|
Notes | IPSec Authentication Header (AH). For more information see the FreeS/WAN documentation and RFC RFC 2402. |
Example | server AH accept |
|
all |
complex |
Server Ports |
all
| Client Ports |
all
|
Notes | Matches all traffic (all protocols, ports, etc) while ensuring that required kernel modules are loaded. This service may indirectly setup a set of other services, if they are required by the kernel modules to be loaded. Currently it activates also ftp, irc and icmp. |
Example | server all accept |
|
amanda |
complex |
Server Ports |
see notes
| Client Ports |
see notes
|
Notes | This implementation of AMANDA, the Advanced Maryland Automatic Network Disk Archiver is based on the notes posted at Amanda's Faq-O-Matic. Based on this, FireHOL allows: - a connection from the server to the client at udp 10080
- connections from the client to the server at tcp & udp ports controlled by the variable FIREHOL_AMANDA_PORTS.
Default: FIREHOL_AMANDA_PORTS="850:859" It has been written in amanda mailing lists that by default amanda chooses ports in the range of 600 to 950. If you don't compile amanda yourself you may have to change the variable FIREHOL_AMANDA_PORTS to accept a wider match (but consider the trust relationship you are building with this). I strongly suggest to use this service in your firewall like: server amanda accept src 1.2.3.4, or client amanda accept dst 5.6.7.8 in order to limit the hosts that have access to the ports controlled by the variable FIREHOL_AMANDA_PORTS. This complex service handles correctly the multi-socket bi-directional environment required. Use the FireHOL server directive on the Amanda server, and FireHOL's client on the Amanda client. The amanda service will break if it is NATed (to work it would require a bi-directional NAT and a modification in the amanda code to allow connections from/to high ports). USE THIS WITH CARE. MISUSE OF THIS SERVICE MAY LEAD TO OPENING PRIVILEGED PORTS TO ANYONE. |
Example | server amanda accept src 1.2.3.4 |
|
any |
complex |
Server Ports |
all
| Client Ports |
all
|
Notes | Matches all traffic (all protocols, ports, etc), but does not care about kernel modules and does not activate any other service indirectly. In combination with the Optional Rule Parameters this service can match unusual traffic (e.g. GRE - protocol 47). |
Example | server any myname accept proto 47 |
|
apcupsd |
simple |
Server Ports |
tcp/6544
| Client Ports |
default
|
Notes | APC UPS Deamon ports. This service must be defined as server apcupsd accept on all machines not directly connected to the UPS (i.e. slaves). Note that the port defined here is not the default port (6666) used if you download and compile APCUPSD, since the default is conflicting with IRC and many distributions (like Debian) have changed this to 6544. You can define port 6544 in APCUPSD, by changing the value of NETPORT in its configuration file, or overwrite this FireHOL service definition using the procedures described in Adding Services. |
Example | server apcupsd accept |
|
apcupsdnis |
simple |
Server Ports |
tcp/3551
| Client Ports |
default
|
Notes | APC UPS Network Information Server. This service allows the remote WEB interfaces APCUPSD has, to connect and get information from the server directly connected to the UPS device. |
Example | server apcupsdnis accept |
|
aptproxy |
simple |
Server Ports |
tcp/9999
| Client Ports |
default
|
Notes | Debian package proxy. |
Example | server aptproxy accept |
|
cups |
simple |
|
custom |
complex |
Server Ports |
defined in the command
| Client Ports |
defined in the command
|
Notes | This service is used by FireHOL to allow you define services it currently does not support. To find more about this service please check the Adding Services section. |
Example | server custom myimap tcp/143 default accept |
|
cvspserver |
simple |
Server Ports |
tcp/2401
| Client Ports |
default
|
Notes | |
Example | server cvspserver accept |
|
daytime |
simple |
Server Ports |
tcp/daytime
| Client Ports |
default
|
Notes | |
Example | server daytime accept |
|
dcpp |
simple |
Server Ports |
tcp/1412
,
udp/1412
| Client Ports |
default
|
Notes | Direct Connect++ P2P, can be found here. |
Example | server dcpp accept |
|
dhcp |
simple |
Server Ports |
udp/bootps
| Client Ports |
bootpc
|
Notes | Keep in mind that DHCP clients broadcast the network (src 0.0.0.0 dst 255.255.255.255) to find a DHCP server. This means that if your server dhcp accept command is placed within an interface that has src and / or dst parameters, DHCP broadcasts will not enter this interface. You can overcome this problem by placing the DHCP service on a separate interface, without an src or dst but with a policy return. Place this interface before the one that defines the rest of the services. For example: interface eth0 dhcp policy return server dhcp accept interface eth0 lan src "$mylan" dst "$myip" ... | Note that if you are running a DHCP client and your provider has installed more than one DHCP servers, you may see a few entries in your system log about packets dropped from the IP of some DHCP server to 255.255.255.255 with source port 67 and destination port 68 (protocol UDP). This is normal, since the iptables connection tracker will allow only one reply to match the DHCP client request. All the other replies will not match a request and will be dropped (and logged). |
Example | server dhcp accept |
|
dhcprelay |
simple |
Server Ports |
udp/bootps
| Client Ports |
bootps
|
Notes | DHCP Relay. From RFC 1812 section 9.1.2 In many cases, BOOTP clients and their associated BOOTP server(s) do not reside on the same IP (sub)network. In such cases, a third-party agent is required to transfer BOOTP messages between clients and servers. Such an agent was originally referred to as a BOOTP forwarding agent. However, to avoid confusion with the IP forwarding function of a router, the name BOOTP relay agent has been adopted instead. For more information about DHCP Relay see section 9.1.2 of RFC 1812 and section 4 of RFC 1542 |
Example | server dhcprelay accept |
|
dns |
simple |
Server Ports |
udp/domain
,
tcp/domain
| Client Ports |
any
|
Notes | |
Example | server dns accept |
|
echo |
simple |
Server Ports |
tcp/echo
| Client Ports |
default
|
Notes | |
Example | server echo accept |
|
emule |
complex |
Server Ports |
many
| Client Ports |
many
|
Notes | eMule (Donkey network client). According to eMule Port Definitions, FireHOL defines: - Connection from any client port to the server at tcp/4661
- Connection from any client port to the server at tcp/4662
- Connection from any client port to the server at udp/4665
- Connection from any client port to the server at udp/4672
- Connection from any server port to the client at tcp/4662
- Connection from any server port to the client at udp/4672
Use the FireHOL client command to match the eMule client. Please note that the eMule client is an HTTP client also. |
Example | client emule accept src 1.1.1.1 |
|
ESP |
simple |
Server Ports |
50/any
| Client Ports |
any
|
Notes | IPSec Encapsulated Security Payload (ESP). For more information see the FreeS/WAN documentation and RFC RFC 2406. |
Example | server ESP accept |
|
finger |
simple |
Server Ports |
tcp/finger
| Client Ports |
default
|
Notes | |
Example | server finger accept |
|
ftp |
complex |
Server Ports |
many
| Client Ports |
many
|
Notes | The FTP service matches both active and passive FTP connections by utilizing the FTP connection tracker kernel module. |
Example | server ftp accept |
|
GRE |
simple |
Server Ports |
47/any
| Client Ports |
any
|
Notes | Generic Routing Encapsulation (protocol No 47). For more information see RFC RFC 2784. |
Example | server GRE accept |
|
heartbeat |
simple |
Server Ports |
udp/690:699
| Client Ports |
default
|
Notes | HeartBeat is the Linux clustering solution available http://www.linux-ha.org/. This FireHOL service has been designed such a way that it will allow multiple heartbeat clusters on the same LAN. |
Example | server heartbeat accept |
|
http |
simple |
Server Ports |
tcp/http
| Client Ports |
default
|
Notes | |
Example | server http accept |
|
https |
simple |
Server Ports |
tcp/https
| Client Ports |
default
|
Notes | |
Example | server https accept |
|
hylafax |
complex |
Server Ports |
many
| Client Ports |
many
|
Notes | This complex service allows incomming requests to server port tcp/4559 and outgoing from server port tcp/4558. The correct operation of this service has not been verified. USE THIS WITH CARE. A HYLAFAX CLIENT MAY OPEN ALL TCP UNPRIVILEGED PORTS TO ANYONE (from port tcp/4558). |
Example | server hylafax accept |
|
icmp |
simple |
Server Ports |
icmp/any
| Client Ports |
any
|
Notes | |
Example | server icmp accept |
|
ICMP |
simple |
Server Ports |
icmp/any
| Client Ports |
any
|
Notes | |
Example | server ICMP accept |
|
ident |
simple |
Server Ports |
tcp/auth
| Client Ports |
default
|
Notes | |
Example | server ident reject with tcp-reset |
|
imap |
simple |
Server Ports |
tcp/143
| Client Ports |
default
|
Notes | |
Example | server imap accept |
|
imaps |
simple |
Server Ports |
tcp/imaps
| Client Ports |
default
|
Notes | |
Example | server imaps accept |
|
irc |
simple |
Server Ports |
tcp/ircd
| Client Ports |
default
|
Notes | |
Example | server irc accept |
|
isakmp |
simple |
Server Ports |
udp/500
| Client Ports |
500
|
Notes | IPSec key negotiation (IKE on UDP port 500). For more information see the FreeS/WAN documentation. |
Example | server isakmp accept |
|
jabber |
simple |
Server Ports |
tcp/5222
,
tcp/5223
| Client Ports |
default
|
Notes | Jabber Instant Messenger This definition allows both clear and SSL jabber client - to - jabber server connections, as given in this Jabber FAQ. |
Example | server jabber accept |
|
jabberd |
simple |
Server Ports |
tcp/5222
,
tcp/5223
,
tcp/5269
| Client Ports |
default
|
Notes | Jabberd Instant Messenger Server This definition allows both clear and SSL jabber client - to - jabber server and jabber server - to - server connections, as given in this Jabberd FAQ. Use this service for a jabberd server. In all other cases, use the jabber service. |
Example | server jabberd accept |
|
ldap |
simple |
Server Ports |
tcp/ldap
| Client Ports |
default
|
Notes | |
Example | server ldap accept |
|
ldaps |
simple |
Server Ports |
tcp/ldaps
| Client Ports |
default
|
Notes | |
Example | server ldaps accept |
|
lpd |
simple |
Server Ports |
tcp/printer
| Client Ports |
721:731
,
default
|
Notes | Line Printer Deamon Protocol (LPD) LPD is documented in RFC 1179. Since many operating systems are incorrectly using the default client ports for LPD access, this definition allows the default client ports to access the service (additionally to the RFC defined 721 to 731 inclusive). |
Example | server lpd accept |
|
microsoft_ds |
simple |
Server Ports |
tcp/microsoft-ds
| Client Ports |
default
|
Notes | Direct Hosted (i.e. NETBIOS-less SMB) This is another NETBIOS Session Service with minor differences with netbios_ssn. It is supported only by Windows 2000 and Windows XP and it offers the advantage of being indepedent of WINS for name resolution. It seems that samba supports transparently this protocol on the netbios_ssn ports, so that either direct hosted or traditional SMB can be served simultaneously. Please refer to the netbios_ssn service for more information. |
Example | server microsoft_ds accept |
|
msn |
simple |
Server Ports |
tcp/6891
| Client Ports |
default
|
Notes | Microsoft MSN Messenger Service For a discussion about what works and what is not, please take a look at this technet note. |
Example | server msn accept |
|
multicast |
complex |
Server Ports |
N/A
| Client Ports |
N/A
|
Notes | The multicast service matches all packets send to 224.0.0.0/8 using protocol No 2. |
Example | server multicast reject with proto-unreach |
|
mysql |
simple |
Server Ports |
tcp/mysql
| Client Ports |
default
|
Notes | |
Example | server mysql accept |
|
netbackup |
simple |
Server Ports |
tcp/13701
,
tcp/13711
,
tcp/13720
,
tcp/13721
,
tcp/13724
,
tcp/13782
,
tcp/13783
| Client Ports |
any
|
Notes | This is the Veritas NetBackup service. To use this service you must define it as both client and server in NetBackup clients and NetBackup servers. |
Example | server netbackup accept client netbackup accept |
|
netbios_dgm |
simple |
Server Ports |
udp/netbios-dgm
| Client Ports |
default
,
netbios-dgm
|
Notes | NETBIOS Datagram Service See also the samba service. Keep in mind that this service broadcasts (to the broadcast address of your LAN) UDP packets. If you place this service within an interface that has a dst parameter, remember to include (in the dst parameter) the broadcast address of your LAN too. |
Example | server netbios_dgm accept |
|
netbios_ns |
simple |
Server Ports |
udp/netbios-ns
| Client Ports |
default
,
netbios-ns
|
Notes | NETBIOS Name Service See also the samba service. |
Example | server netbios_ns accept |
|
netbios_ssn |
simple |
Server Ports |
tcp/netbios-ssn
| Client Ports |
default
|
Notes | NETBIOS Session Service See also the samba service. Newer NETBIOS clients prefer to use port 445 (microsoft_ds) for the NETBIOS session service, and when this is not available they fall back to port 139 (netbios_ssn). If your policy on an interface or router is DROP, clients trying to access port 445 will have to timeout before falling back to port 139. This timeout can be up to several minutes. To overcome this problem either explicitly REJECT the microsoft_ds service with a tcp-reset message (server microsoft_ds reject with tcp-reset), or redirect port 445 to port 139 using the following rule (put it all-in-one-line at the top of your FireHOL config): iptables -t nat -A PREROUTING -i eth0 -p tcp -s 1.1.1.1/24 --dport 445 -d 2.2.2.2 -j REDIRECT --to-port 139 or redirect to 139 inface eth0 src 1.1.1.1/24 proto tcp dst 2.2.2.2 dport 445 where: - eth0 is the network interface your NETBIOS server uses
- 1.1.1.1/24 is the subnet matching all the clients IP addresses
- 2.2.2.2 is the IP of your linux server on eth0 (or whatever you set the first one above)
|
Example | server netbios_ssn accept |
|
nfs |
complex |
Server Ports |
many
| Client Ports |
500:65535
|
Notes | The NFS service queries the RPC service on the NFS server host to find out the ports nfsd and mountd are listening. Then, according to these ports it sets up rules on all the supported protocols (as reported by RPC) in order the clients to be able to reach the server. For this reason, the NFS service requires that: - the firewall is restarted if the NFS server is restarted
- the NFS server must be specified on all nfs statements (only if it is not the localhost)
Since NFS queries the remote RPC server, it is required to also be allowed to do so, by allowing the portmap service too. Take care, that this is allowed by the running firewall when FireHOL tries to query the RPC server. So you might have to setup NFS in two steps: First add the portmap service and activate the firewall, then add the NFS service and restart the firewall. To avoid this you can setup your NFS server to listen on pre-defined ports, as it is well documented in http://nfs.sourceforge.net/nfs-howto/security.html#FIREWALLS. If you do this then you will have to define the the ports using the procedure described in Adding Services. |
Example | client nfs accept dst 1.2.3.4 |
|
nntp |
simple |
Server Ports |
tcp/nntp
| Client Ports |
default
|
Notes | |
Example | server nntp accept |
|
ntp |
simple |
Server Ports |
udp/ntp
,
tcp/ntp
| Client Ports |
ntp
,
default
|
Notes | |
Example | server ntp accept |
|
ping |
complex |
Server Ports |
N/A
| Client Ports |
N/A
|
Notes | This services matches requests of protocol ICMP and type echo-request (TYPE=8) and their replies of type echo-reply (TYPE=0). The ping service is stateful. |
Example | server ping accept |
|
pop3 |
simple |
Server Ports |
tcp/110
| Client Ports |
default
|
Notes | |
Example | server pop3 accept |
|
pop3s |
simple |
Server Ports |
tcp/pop3s
| Client Ports |
default
|
Notes | |
Example | server pop3s accept |
|
portmap |
simple |
Server Ports |
udp/sunrpc
,
tcp/sunrpc
| Client Ports |
500:65535
|
Notes | |
Example | server portmap accept |
|
postgres |
simple |
Server Ports |
tcp/5432
| Client Ports |
default
|
Notes | |
Example | server postgres accept |
|
pptp |
complex |
Server Ports |
tcp/1723
| Client Ports |
default
|
Notes | Additionally to the above the PPTP service allows stateful GRE traffic (protocol 47) to flow between the PPTP server and the client. |
Example | server pptp accept |
|
privoxy |
simple |
Server Ports |
tcp/8118
| Client Ports |
default
|
Notes | |
Example | server privoxy accept |
|
radius |
simple |
Server Ports |
udp/radius
,
udp/radius-acct
| Client Ports |
default
|
Notes | |
Example | server radius accept |
|
radiusold |
simple |
Server Ports |
udp/1645
,
udp/1646
| Client Ports |
default
|
Notes | |
Example | server radiusold accept |
|
rndc |
simple |
Server Ports |
tcp/rndc
| Client Ports |
default
|
Notes | |
Example | server rndc accept |
|
rsync |
simple |
Server Ports |
tcp/rsync
,
udp/rsync
| Client Ports |
default
|
Notes | |
Example | server rsync accept |
|
samba |
complex |
Server Ports |
many
| Client Ports |
default
|
Notes | The samba service automatically sets all the rules for netbios_ns, netbios_dgm and netbios_ssn. Please refer to the notes of the above services for more information. |
Example | server samba accept |
|
smtp |
simple |
Server Ports |
tcp/smtp
| Client Ports |
default
|
Notes | |
Example | server smtp accept |
|
smtps |
simple |
Server Ports |
tcp/smtps
| Client Ports |
default
|
Notes | |
Example | server smtps accept |
|
snmp |
simple |
Server Ports |
udp/snmp
| Client Ports |
default
|
Notes | |
Example | server snmp accept |
|
snmptrap |
simple |
Server Ports |
udp/snmptrap
| Client Ports |
any
|
Notes | |
Example | server snmptrap accept |
|
socks |
simple |
Server Ports |
tcp/socks
,
udp/socks
| Client Ports |
default
|
Notes | |
Example | server socks accept |
|
squid |
simple |
Server Ports |
tcp/3128
| Client Ports |
default
|
Notes | |
Example | server squid accept |
|
ssh |
simple |
Server Ports |
tcp/ssh
| Client Ports |
default
|
Notes | |
Example | server ssh accept |
|
submission |
simple |
Server Ports |
tcp/587
| Client Ports |
default
|
Notes | |
Example | server submission accept |
|
sunrpc |
simple |
Server Ports |
udp/sunrpc
,
tcp/sunrpc
| Client Ports |
500:65535
|
Notes | |
Example | server sunrpc accept |
|
swat |
simple |
Server Ports |
tcp/swat
| Client Ports |
default
|
Notes | |
Example | server swat accept |
|
syslog |
simple |
Server Ports |
udp/syslog
| Client Ports |
syslog
,
default
|
Notes | |
Example | server syslog accept |
|
telnet |
simple |
Server Ports |
tcp/telnet
| Client Ports |
default
|
Notes | |
Example | server telnet accept |
|
tftp |
complex |
Server Ports |
many
| Client Ports |
many
|
Notes | The TFTP service matches UDP TFTP connections by utilizing the TFTP connection tracker kernel module. |
Example | server tftp accept |
|
time |
simple |
Server Ports |
tcp/time
,
udp/time
| Client Ports |
default
|
Notes | |
Example | server time accept |
|
uucp |
simple |
Server Ports |
tcp/uucp
| Client Ports |
default
|
Notes | |
Example | server uucp accept |
|
vmware |
simple |
Server Ports |
tcp/902
| Client Ports |
default
|
Notes | |
Example | server vmware accept |
|
vmwareauth |
simple |
Server Ports |
tcp/903
| Client Ports |
default
|
Notes | |
Example | server vmwareauth accept |
|
vmwareweb |
simple |
Server Ports |
tcp/8222
| Client Ports |
default
|
Notes | |
Example | server vmwareweb accept |
|
vnc |
simple |
Server Ports |
tcp/5900:5903
| Client Ports |
default
|
Notes | |
Example | server vnc accept |
|
webcache |
simple |
Server Ports |
tcp/webcache
| Client Ports |
default
|
Notes | |
Example | server webcache accept |
|
webmin |
simple |
Server Ports |
tcp/10000
| Client Ports |
default
|
Notes | Webmin is a web-based interface for system administration for Unix. |
Example | server webmin accept |
|
xdmcp |
simple |
Server Ports |
udp/177
| Client Ports |
default
|
Notes | X Display Manager Control Protocol See http://www.jirka.org/gdm-documentation/x70.html for a discussion about XDMCP and firewalls (this is about Gnome Display Manager, a replacement of XDM). |
Example | server xdmcp accept |
|