cthelper documentation

[ktsaou]

We have to write it...

[nick4u]

Still no cthelper manual and FIREHOL_CONNTRACK_HELPERS_ASSIGNMENT="manual" does not work?

using firehol-3.0.1
my firehol.conf contains :

version 6
FIREHOL_CONNTRACK_HELPERS_ASSIGNMENT="manual"

compiled iptables include "-m helper --helper" entries

# iptables-save |grep help
-A in_net0 -m conntrack --ctstate RELATED,ESTABLISHED -m helper --helper ftp -j ACCEPT
-A in_net0 -m conntrack --ctstate RELATED,ESTABLISHED -m helper --helper irc -j ACCEPT
-A in_net0 -m conntrack --ctstate RELATED,ESTABLISHED -m helper --helper sip -j ACCEPT
-A in_net0 -m conntrack --ctstate RELATED,ESTABLISHED -m helper --helper pptp -j ACCEPT
-A in_net0 -m conntrack --ctstate RELATED,ESTABLISHED -m helper --helper proto_gre -j ACCEPT
-A out_net0 -m conntrack --ctstate RELATED,ESTABLISHED -m helper --helper ftp -j ACCEPT
-A out_net0 -m conntrack --ctstate RELATED,ESTABLISHED -m helper --helper irc -j ACCEPT
-A out_net0 -m conntrack --ctstate RELATED,ESTABLISHED -m helper --helper sip -j ACCEPT
-A out_net0 -m conntrack --ctstate RELATED,ESTABLISHED -m helper --helper pptp -j ACCEPT
-A out_net0 -m conntrack --ctstate RELATED,ESTABLISHED -m helper --helper proto_gre -j ACCEPT
root@frgra1:~/download/firehol-3.0.1# iptables-save |grep CT
-A FORWARD -d 10.0.0.0/8 -o net0 -j REJECT --reject-with icmp-net-prohibited
-A FORWARD -d 172.16.0.0/12 -o net0 -j REJECT --reject-with icmp-net-prohibited
-A FORWARD -d 192.168.0.0/16 -o net0 -j REJECT --reject-with icmp-net-prohibited

no -j CT rules
firehol debug outputs at end :

# Commands to execute:
/sbin/sysctl -w net.ipv4.ip_forward=1
/sbin/sysctl -w net.netfilter.nf_conntrack_helper=0

so looking at source FIREHOL_CONNTRACK_HELPERS_ASSIGNMENT is respected

do I miss sthing?

[ktsaou]

Hi,

I added the manual page for cthelper: https://github.com/firehol/firehol/blob/master/doc/firehol/firehol-cthelper.5.md

If you need help, just reply.