Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

firewall: T5729: remove obsolete enable and correct interface name (backport #1437) #1439

Merged
merged 1 commit into from
May 10, 2024
Merged

firewall: T5729: remove obsolete enable and correct interface name (backport #1437) #1439

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions docs/configuration/firewall/ipv4.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

.. cfgcmd:: set firewall ipv4 ...

From main structure defined in :doc:`Firewall Overview</configuration/firewall/index>`

Check warning on line 19 in docs/configuration/firewall/ipv4.rst

View workflow job for this annotation

GitHub Actions / lint 

Line too long: len=86
in this section you can find detailed information only for the next part
of the general structure:

Expand Down Expand Up @@ -820,13 +820,13 @@
set firewall ipv4 input filter rule 13 tcp flags not 'fin'

.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999>
state [established | invalid | new | related] [enable | disable]
state [established | invalid | new | related]
.. cfgcmd:: set firewall ipv4 input filter rule <1-999999>
state [established | invalid | new | related] [enable | disable]
state [established | invalid | new | related]
.. cfgcmd:: set firewall ipv4 output filter rule <1-999999>
state [established | invalid | new | related] [enable | disable]
state [established | invalid | new | related]
.. cfgcmd:: set firewall ipv4 name <name> rule <1-999999>
state [established | invalid | new | related] [enable | disable]
state [established | invalid | new | related]

Match against the state of a packet.

Expand Down Expand Up @@ -935,13 +935,13 @@
********
Synproxy connections

.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> action synproxy

Check warning on line 938 in docs/configuration/firewall/ipv4.rst

View workflow job for this annotation

GitHub Actions / lint 

Line too long: len=86
.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> protocol tcp

Check warning on line 939 in docs/configuration/firewall/ipv4.rst

View workflow job for this annotation

GitHub Actions / lint 

Line too long: len=83
.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> synproxy tcp mss <501-65535>

Check warning on line 940 in docs/configuration/firewall/ipv4.rst

View workflow job for this annotation

GitHub Actions / lint 

Line too long: len=99

Set TCP-MSS (maximum segment size) for the connection

.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> synproxy tcp window-scale <1-14>

Check warning on line 944 in docs/configuration/firewall/ipv4.rst

View workflow job for this annotation

GitHub Actions / lint 

Line too long: len=103

Set the window scale factor for TCP window scaling

Expand All @@ -965,12 +965,12 @@
set firewall global-options syn-cookies 'enable'
set firewall ipv4 input filter rule 10 action 'synproxy'
set firewall ipv4 input filter rule 10 destination port '8080'
set firewall ipv4 input filter rule 10 inbound-interface interface-name 'eth1'
set firewall ipv4 input filter rule 10 inbound-interface name 'eth1'
set firewall ipv4 input filter rule 10 protocol 'tcp'
set firewall ipv4 input filter rule 10 synproxy tcp mss '1460'
set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7'
set firewall ipv4 input filter rule 1000 action 'drop'
set firewall ipv4 input filter rule 1000 state invalid 'enable'
set firewall ipv4 input filter rule 1000 state invalid


***********************
Expand Down Expand Up @@ -1147,7 +1147,7 @@
.. opcmd:: show log firewall ipv4 name <name> rule <rule>

Show the logs of all firewall; show all ipv4 firewall logs; show all logs
for particular hook; show all logs for particular hook and priority; show all logs

Check warning on line 1150 in docs/configuration/firewall/ipv4.rst

View workflow job for this annotation

GitHub Actions / lint 

Line too long: len=85
for particular custom chain; show logs for specific Rule-Set.

Example Partial Config
Expand Down
12 changes: 6 additions & 6 deletions docs/configuration/firewall/ipv6.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@

.. cfgcmd:: set firewall ipv6 ...

From main structure defined in :doc:`Firewall Overview</configuration/firewall/index>`

Check warning on line 19 in docs/configuration/firewall/ipv6.rst

View workflow job for this annotation

GitHub Actions / lint 

Line too long: len=86
in this section you can find detailed information only for the next part
of the general structure:

Expand Down Expand Up @@ -373,20 +373,20 @@
remain valid if the IPv6 prefix changes and the host
portion of systems IPv6 address is static (for example, with SLAAC or
`tokenised IPv6 addresses
<https://datatracker.ietf.org/doc/id/draft-chown-6man-tokenised-ipv6-identifiers-02.txt>`_)

Check warning on line 376 in docs/configuration/firewall/ipv6.rst

View workflow job for this annotation

GitHub Actions / lint 

Line too long: len=94

This functions for both individual addresses and address groups.

.. code-block:: none

# Match any IPv6 address with the suffix ::0000:0000:0000:beef

Check failure on line 382 in docs/configuration/firewall/ipv6.rst

View workflow job for this annotation

GitHub Actions / lint 

Use IPv6 reserved for Documentation (RFC 3849) or private Space: ::beef
set firewall ipv6 forward filter rule 100 destination address ::beef

Check failure on line 383 in docs/configuration/firewall/ipv6.rst

View workflow job for this annotation

GitHub Actions / lint 

Use IPv6 reserved for Documentation (RFC 3849) or private Space: ::beef
set firewall ipv6 forward filter rule 100 destination address-mask ::ffff:ffff:ffff:ffff

Check failure on line 384 in docs/configuration/firewall/ipv6.rst

View workflow job for this annotation

GitHub Actions / lint 

Use IPv6 reserved for Documentation (RFC 3849) or private Space: ::ffff:ffff:ffff:ffff
# Address groups
set firewall group ipv6-address-group WEBSERVERS address ::1000

Check failure on line 386 in docs/configuration/firewall/ipv6.rst

View workflow job for this annotation

GitHub Actions / lint 

Use IPv6 reserved for Documentation (RFC 3849) or private Space: ::1000
set firewall group ipv6-address-group WEBSERVERS address ::2000

Check failure on line 387 in docs/configuration/firewall/ipv6.rst

View workflow job for this annotation

GitHub Actions / lint 

Use IPv6 reserved for Documentation (RFC 3849) or private Space: ::2000
set firewall ipv6 forward filter rule 200 source group address-group WEBSERVERS
set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:ffff

Check failure on line 389 in docs/configuration/firewall/ipv6.rst

View workflow job for this annotation

GitHub Actions / lint 

Use IPv6 reserved for Documentation (RFC 3849) or private Space: ::ffff:ffff:ffff:ffff

.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
source fqdn <fqdn>
Expand Down Expand Up @@ -829,13 +829,13 @@
set firewall ipv6 input filter rule 13 tcp flags not 'fin'

.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999>
state [established | invalid | new | related] [enable | disable]
state [established | invalid | new | related]
.. cfgcmd:: set firewall ipv6 input filter rule <1-999999>
state [established | invalid | new | related] [enable | disable]
state [established | invalid | new | related]
.. cfgcmd:: set firewall ipv6 output filter rule <1-999999>
state [established | invalid | new | related] [enable | disable]
state [established | invalid | new | related]
.. cfgcmd:: set firewall ipv6 name <name> rule <1-999999>
state [established | invalid | new | related] [enable | disable]
state [established | invalid | new | related]

Match against the state of a packet.

Expand Down Expand Up @@ -920,8 +920,8 @@
********
Synproxy connections

.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> action synproxy

Check warning on line 923 in docs/configuration/firewall/ipv6.rst

View workflow job for this annotation

GitHub Actions / lint 

Line too long: len=86
.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> protocol tcp

Check warning on line 924 in docs/configuration/firewall/ipv6.rst

View workflow job for this annotation

GitHub Actions / lint 

Line too long: len=83
.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> synproxy tcp mss <501-65535>

Set TCP-MSS (maximum segment size) for the connection
Expand Down Expand Up @@ -950,12 +950,12 @@
set firewall global-options syn-cookies 'enable'
set firewall ipv6 input filter rule 10 action 'synproxy'
set firewall ipv6 input filter rule 10 destination port '8080'
set firewall ipv6 input filter rule 10 inbound-interface interface-name 'eth1'
set firewall ipv6 input filter rule 10 inbound-interface name 'eth1'
set firewall ipv6 input filter rule 10 protocol 'tcp'
set firewall ipv6 input filter rule 10 synproxy tcp mss '1460'
set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7'
set firewall ipv6 input filter rule 1000 action 'drop'
set firewall ipv6 input filter rule 1000 state invalid 'enable'
set firewall ipv6 input filter rule 1000 state invalid

***********************
Operation-mode Firewall
Expand Down
Loading