\section{Example setup}
When FIAIF is started, it reads \verb|/etc/fiaif/fiaif.conf|. This is
the global configuration file.  It defines the zones available, and a
number of other global settings, such as \textit{type of service}
(TOS) settings, references to reserved and private networks.
 
The default (the sample configuration files, see \appref{app:default})
sets up an external zone EXT, which is your Internet connection. Two
additional zone configuration files are provided: an internal zone,
\textit{INT}, to describe your private network, and a demilitarized
zone, \textit{DMZ}, to describe a zone in which servers accessable
from the internet are located. In the default configuration neither are
used.

\paragraph{The default setup of the External zone}
\begin{itemize}
\item Accepts dns queries, ssh, http, https and icmp-ping.
\item Limits ping to 1 per sec, with a start-value of 3.
\item Close communication with \textit{TCP-RESET} on authorization
  requests.
\end{itemize}

\paragraph{The default setup of the internal zone}
\begin{itemize}
\item Allows all connections from this zone to the firewall.
\item Redirects all http requests to a transparent proxy.
\item Adds Masquerading/NAT for all connections going out on the
  external interface.
\item Disallows any new packets from any other zones (already
  established connections are automatically let though)
\end{itemize}

\paragraph{The default setup of the demilitarized zone}
\begin{itemize}
\item Accept www and https requests from the external zone (Internet).
\item No communication with the firewall itself is allowed. The idea
  being that a cracker's gaining access to a machine in the DMZ, does
  not pose a security risk for any other zones or for the firewall
  itself.  
\item Accept only ssh from the internal zone. This way machines in the
  DMZ can be administered.

\end{itemize}
