Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Fetching contributors…

Cannot retrieve contributors at this time

112 lines (98 sloc) 4.616 kb
#
###########################################################################
#
# This is the configuration file for fwsnort. There are some similarities
# between this file and the configuration file for Snort.
#
###########################################################################
#
# $Id$
#
### Fwsnort treats all traffic directed to / originating from the local
### machine as going to / coming from the HOME_NET in Snort rule parlance.
### If there is only one interface on the local system, then there will be
### no rules processed via the FWSNORT_FORWARD chain because no traffic
### would make it into the iptables FORWARD chain.
HOME_NET any;
EXTERNAL_NET any;
### List of servers. Fwsnort supports the same variable resolution as
### Snort.
HTTP_SERVERS $HOME_NET;
SMTP_SERVERS $HOME_NET;
DNS_SERVERS $HOME_NET;
SQL_SERVERS $HOME_NET;
TELNET_SERVERS $HOME_NET;
### AOL AIM server nets
AIM_SERVERS [64.12.24.0/24, 64.12.25.0/24, 64.12.26.14/24, 64.12.28.0/24, 64.12.29.0/24, 64.12.161.0/24, 64.12.163.0/24, 205.188.5.0/24, 205.188.9.0/24];
### Configurable port numbers
SSH_PORTS 22;
HTTP_PORTS 80;
SHELLCODE_PORTS !80;
ORACLE_PORTS 1521;
### define average packet lengths and maximum frame length. This is
### used for iptables length match emulation of the Snort dsize option.
AVG_IP_HEADER_LEN 20; ### IP options are not usually used.
AVG_TCP_HEADER_LEN 30; ### Include 10 bytes for options (which
### accompany ACK packets).
MAX_FRAME_LEN 1500;
### define the max length of the content (null terminated string) that
### can be passed to either the --hex-string or --string iptables matches.
### Note that as of fwsnort-1.5, the max string length supported by the
### local iptables instance is automatically determined, so this variable
### is not really needed, and just allows a max value to be set
### independently of what iptables supports.
MAX_STRING_LEN 1024;
### Use the WHITELIST variable to define a list of hosts/networks
### that should be completely ignored by fwsnort. For example, if you
### want to whitelist the IP 192.168.10.1 and the network 10.1.1.0/24,
### you would use (note that you can also specify multiple WHITELIST
### variables, one per line):
#WHITELIST 192.168.10.1, 10.1.1.0/24;
WHITELIST NONE;
### Use the BLACKLIST variable to define a list of hosts/networks
### that for which fwsnort should DROP or REJECT all traffic. For
### example, to DROP all traffic from the 192.168.10.0/24 network, you
### can use:
### BLACKLIST 192.168.10.0/24 DROP;
### To have fwsnort REJECT all traffic from 192.168.10.0/24, you would
### use:
### BLACKLIST 192.168.10.0/24 REJECT;
BLACKLIST NONE;
### define the jump position in the built-in chains to jump to the
### fwsnort chains
FWSNORT_INPUT_JUMP 1;
FWSNORT_OUTPUT_JUMP 1;
FWSNORT_FORWARD_JUMP 1;
### iptables chains (these do not normally need to be changed).
FWSNORT_INPUT FWSNORT_INPUT;
FWSNORT_INPUT_ESTAB FWSNORT_INPUT_ESTAB;
FWSNORT_OUTPUT FWSNORT_OUTPUT;
FWSNORT_OUTPUT_ESTAB FWSNORT_OUTPUT_ESTAB;
FWSNORT_FORWARD FWSNORT_FORWARD;
FWSNORT_FORWARD_ESTAB FWSNORT_FORWARD_ESTAB;
### fwsnort library path
CONF_DIR /etc/fwsnort;
RULES_DIR $CONF_DIR/snort_rules;
ARCHIVE_DIR $CONF_DIR/archive;
QUEUE_RULES_DIR $CONF_DIR/snort_rules_queue;
LOG_DIR /var/log/fwsnort;
LIBS_DIR /usr/lib/fwsnort;
CONF_FILE $CONF_DIR/fwsnort.conf;
LOG_FILE $LOG_DIR/fwsnort.log;
FWSNORT_SCRIPT $CONF_DIR/fwsnort_iptcmds.sh; ### slow version
FWSNORT_SAVE_EXEC_FILE $CONF_DIR/fwsnort.sh; ### main fwsnort.sh script
FWSNORT_SAVE_FILE $CONF_DIR/fwsnort.save; ### main fwsnort.save file
IPT_BACKUP_SAVE_FILE $CONF_DIR/iptables.save; ### iptables policy backup
### system binaries
shCmd /bin/sh;
echoCmd /bin/echo;
tarCmd /bin/tar;
wgetCmd /usr/bin/wget;
unameCmd /usr/bin/uname;
ifconfigCmd /sbin/ifconfig;
iptablesCmd /sbin/iptables;
iptables-saveCmd /sbin/iptables-save;
iptables-restoreCmd /sbin/iptables-restore;
ip6tablesCmd /sbin/ip6tables;
ip6tables-saveCmd /sbin/ip6tables-save;
ip6tables-restoreCmd /sbin/ip6tables-restore;
Jump to Line
Something went wrong with that request. Please try again.