
#!/etc/init.d/firehol
# ------------------------------------------------------------------------------
# This feature is under construction -- use it with care.
#             *** NEVER USE THIS CONFIG AS-IS ***
# 
# : firehol.sh,v 1.226 2005/01/25 21:28:19 ktsaou Exp $
# (C) Copyright 2003, Costa Tsaousis <costa@tsaousis.gr>
# FireHOL is distributed under GPL.
# Home Page: http://firehol.sourceforge.net
# 
# ------------------------------------------------------------------------------
# FireHOL controls your firewall. You should want to get updates quickly.
# Subscribe (at the home page) to get notified of new releases.
# ------------------------------------------------------------------------------
#
# This config will have the same effect as NO PROTECTION!
# Everything that found to be running, is allowed.
# 
# Date: Sat Jul 29 13:50:53 PHT 2006 on host santol.cts.edu.ph
# 
# The TODOs bellow, are YOUR to-dos!

### DEBUG: Processing interface 'eth0'
### DEBUG: Processing IP 202.163.195.157/32 of interface 'eth0'
### DEBUG: Is 202.163.195.157/32 part of network 169.254.0.0/16? no
### DEBUG: Is 202.163.195.157/32 part of network 202.163.195.152/29? yes

# Interface No 1.
# The purpose of this interface is to control the traffic
# on the eth0 interface with IP 202.163.195.157/32 (net: "202.163.195.152/29").
# TODO: Change "interface1" to something with meaning to you.
# TODO: Check the optional rule parameters (src/dst).
# TODO: Remove 'dst 202.163.195.157/32' if this is dynamically assigned.
interface eth0 interface1 src "202.163.195.152/29" dst 202.163.195.157/32

	# The default policy is DROP. You can be more polite with REJECT.
	# Prefer to be polite on your own clients to prevent timeouts.
	policy drop

	# If you don't trust the clients behind eth0 (net "202.163.195.152/29"),
	# add something like this.
	# > protection strong

	# Here are the services listening on eth0.
	# TODO: Normally, you will have to remove those not needed.
	server ICMP accept
	server imap accept
	server imaps accept
#	server mysql accept
	server pop3 accept
	server pop3s accept
	server smtp accept
#	server webmin accept
	server "http https" accept
#	server dns accept

	# The following eth0 server ports are not known by FireHOL:
	#  tcp/6000 udp/10000 udp/32768 
	# TODO: If you need any of them, you should define new services.
	#       (see Adding Services at the web site - http://firehol.sf.net).

	# The following means that this machine can REQUEST anything via eth0.
	# TODO: On production servers, avoid this and allow only the
	#       client services you really need.
	client all accept

### DEBUG: Is 202.163.195.153/32  part of network 202.163.195.152/29? yes
### DEBUG: Default gateway 202.163.195.153/32  is part of network 202.163.195.152/29

# Interface No 2.
# The purpose of this interface is to control the traffic
# from/to unknown networks behind the default gateway 202.163.195.153/32 .
# TODO: Change "interface2" to something with meaning to you.
# TODO: Check the optional rule parameters (src/dst).
# TODO: Remove 'dst 202.163.195.157/32' if this is dynamically assigned.
interface eth0 interface2 src not "${UNROUTABLE_IPS} 202.163.195.152/29" dst 202.163.195.157/32

	# The default policy is DROP. You can be more polite with REJECT.
	# Prefer to be polite on your own clients to prevent timeouts.
	policy drop

	# If you don't trust the clients behind eth0 (net not "${UNROUTABLE_IPS} 202.163.195.152/29"),
	# add something like this.
	# > protection strong

	# Here are the services listening on eth0.
	# TODO: Normally, you will have to remove those not needed.
	server ICMP accept
	server imap accept
	server imaps accept
	server mysql accept
	server pop3 accept
	server pop3s accept
	server smtp accept
	server webmin accept

	# The following eth0 server ports are not known by FireHOL:
	#  tcp/6000 udp/10000 udp/32768 
	# TODO: If you need any of them, you should define new services.
	#       (see Adding Services at the web site - http://firehol.sf.net).

	# The following means that this machine can REQUEST anything via eth0.
	# TODO: On production servers, avoid this and allow only the
	#       client services you really need.
	client all accept

### DEBUG: Processing interface 'sit0'

# Ignoring interface 'sit0' because does not have an IP or route.


# The above 2 interfaces were found active at this moment.
# Add more interfaces that can potentially be activated in the future.
# FireHOL will not complain if you setup a firewall on an interface that is
# not active when you activate the firewall.
# If you don't setup an interface, FireHOL will drop all traffic from or to
# this interface, if and when it becomes available.
# Also, if an interface name dynamically changes (i.e. ppp0 may become ppp1)
# you can use the plus (+) character to match all of them (i.e. ppp+).



# No router statements have been produced, because your server
# is not configured for forwarding traffic.

