\section{Configuring a zone}
In this section the syntax of rules will be presented, and examples
will be given. 

\subsection{Definitions}
All rules are defined by using a keyword and an assignment. Three
categories of keywords exists:

% Mention why different types exist.
\begin{description}
\item [Simple:] These are simple keywords that can only be assigned
  one value. These keywords are used on the form \verb|KEYWORD=value|.
  
\item [Array:] Array keywords defines an array of rules. The keyword
  is indexed by postfixing it with \verb|[n]|, where \verb|n| is the
  position in the array. The first element in the array is one, no
  indexes must be left out in a sequence.  If two rules have the same
  index, there is no guarantee on which rules will be chosen.
  
\item [Sets:] Keyword sets are on the form \verb|KEYWORD_<identifier>=value|,
  where the identifier can be replaced by any string. In sets there is no
  specified order of the rules. If two identical rule names are
  specified, only one will be used in a non-deterministic fashion.

\end{description}
The syntax of all rules will be presented as BNF. Before presenting
the rules, a list of definitions will be given, which will be used
when specifying the syntax of the rules:\\

\begin{grammar}
<zone_name> ::= .string.
<zone> ::= <zone_name> | 'ALL'

<byteint> ::= 0..255

<shortint> ::= 0..65535

<int> ::= 0..4294967295

<hexint> ::= 00..FF

<bool> ::= '0' | '1'

<ip_address> ::= <byteint>.<byteint>.<byteint>.<byteint> <mask>
\alt <name of machine>

<mac_address> ::= <hexint>:<hexint>:<hexint>:<hexint>:<hexint>:<hexint>

<mask> ::= '/' 0..32 | <empty>

<port_name> ::= <shortint> | <service_name>

<port_range> ::= <shortint>':'<shortint> 

<port_opt> ::=  <port_name> | <port_range>
\alt <port_opt> ',' <port_opt>

<port> ::= 'ALL' | <port_opt> 

<icmp_type> ::= <byteint> | <icmp_name> 
\alt <icmp_type> ',' <icmp_type>

<icmp_named_type> ::= 'icmp-net-unreachable' | 'icmp-host-unreachable' 
\alt 'icmp-port-unreachable' | 'icmp-proto-unreachable' 
\alt 'icmp-net-prohibited' | 'icmp-host-prohibited'


<protocol> ::= 'ALL' | <byteint> | 'icmp' <icmp_type>
\alt 'udp' <port> 
\alt 'tcp' <port>

<src_dst_ip> ::= <ip_address>'=>'<ip_address>

<policy> ::= 'ACCEPT' | 'REJECT' | 'DROP' 
\alt 'ACCEPT_LOG' | 'REJECT_NOLOG' | 'DROP_NOLOG'
\alt 'LOG'

<proto_ip> ::= <protocol> <src_dst_ip>

\end{grammar}
A rule consists of an action/policy and a set of matches which must
be fulfilled in order for the action/policy to be applied to the
connection. If this is the case, it is said that the rules
\textit{matches} the connection.

The \verb|<proto_ip>| defines a general connection match used
throughout the configuration files. The first argument <protocol>
matches connections of this type. If the protocol is either \verb|tcp|
or \verb|udp| then the port specifies the destination port. If the
protocol is \verb|icmp| a icmp type is required. The last argument
\verb|<src_dst_ip>| specifies the source and destination ip address of
the connection, i.e. the source ip address must match the initiator of
the connection, and the destination for the endpoint of the
connection.

\subsection{Zone definition}
To setup a zone, several parameters are required in order to identify
the zone. The parameters are all on simple form, and are listed below.

\paragraph{NAME}
This identifies the name of the zone. The name must be unique, and
must be identical to the name as specified in the global configuration
file.

\noindent
Example: \verb|NAME=EXT|

\paragraph{DEV}
This parameter specifies the network interface to which the zone is
connected. 

\noindent
Example: \verb|DEV=eth0|

\paragraph{DYNAMIC}
If the interface as specified by the \verb|DEV| parameter obtains its
ip address from a dhcp server, or can have its ip address changed
dynamically, DYNAMIC must be enabled.

\begin{grammar}
<dynamic> ::= <bool>
\end{grammar}

\noindent
Example: \verb|DYNAMIC=0|

\paragraph{DHCP_SERVER}
To specify that the firewall also acts as a dhcp server, this
parameter should be set to one, in order for dhcp queries to be
accepted from machines in the current zone.

\begin{grammar}
<dhcp_server> ::= <bool>
\end{grammar}

\noindent
Example: \verb|DHCP_SERVER=1|

\paragraph{GLOBAL}
The global parameter specifies if the interface connects the firewall
to the Internet. If the interface does connect the firewall to the
Internet then global should be set to one.

\begin{grammar}
<global> ::= <bool>
\end{grammar}

\noindent
Example: \verb|GLOBAL=1|\\

\noindent
The following parameters are only required if the zone is specified as
non-dynamic, that is \verb|DYNAMIC=0|.

\paragraph{IP}
The \verb|IP| should be set the primary ip of the interface of the current
zone. 

\noindent
Example: \verb|IP=1.2.3.4|

\paragraph{NET}
Specifies the address of the network to which this zone is connected.

\noindent
Example: \verb|IP=1.2.3.2|

\paragraph{MASK}
Specifies the network mask of the address in dotted notation.

\noindent
Example: \verb|IP=255.255.255.252|

\paragraph{BCAST}
Specifies the broadcast address of the network for this zone.

\noindent
Example: \verb|IP=1.2.3.6|

\subsection{Zone access}
The access rules are the central rules in the zone. These defines
access between other zones and the firewall itself. All zone access
rules are arrays, which are processed sequentially. It is highly
recommended to have an \textit{catch all} rule as the last rule,
specifying a default policy for packets not covered by previous rules.

\subsubsection{Input rules} 
The input rules control access from machines located in the zone to
the firewall itself. Input rules are specified as an array named
\verb|INPUT|:
\begin{grammar}
<input> ::= <policy> <proto_ip> 
\end{grammar}
The policy defines whether to drop, reject or accept connections that
matches this rule. 

\paragraph{Example}
\begin{verbatim}
INPUT[0]="ACCEPT tcp 25,80,443,22 0.0.0.0/0=>0.0.0.0/0"
INPUT[1]="DROP ALL 0.0.0.0/0=>0.0.0.0/0"
\end{verbatim}
This will accept only http, https, smtp (mail transfer) and ssh access
to the firewall itself. Any other packet originating from the zone
destined to the firewall itself will be discarded.

\subsubsection{Output rules}
The output rules determines access from the firewall to machines
located in the zone. Output rules are specified as an array named
\verb|FORWARD|:
\begin{grammar}
<output> ::= <policy> <proto_ip>
\end{grammar}
The policy defines whether to drop, reject or accept connections that
matches this rule. 

\paragraph{Example}
\begin{verbatim}
OUTPUT[0]="ACCEPT tcp 22 0.0.0.0/0=>0.0.0.0/0"
OUTPUT[1]="REJECT ALL 0.0.0.0/0=>0.0.0.0/0"
\end{verbatim}
This will allow the firewall only to initiate ssh communication to
machines located within the zone. All other communication initiated by
the firewall to machines in this zone is prohibited, and packets are
blocked.

\subsubsection{Forward rules}
The forward rules restricts access from machines located in other
zones to this zone. Forward rules are specified as an array named
\verb|FORWARD|:
\begin{grammar}
<forward> ::= <zone> <policy> <proto_ip>
\end{grammar}
The first argument specifies the source zone of the connection. The
policy defines whether to drop, reject or accept connections that
matches this rule.

\paragraph{Example}
\begin{verbatim}
FORWARD[0]="ALL ACCEPT tcp 22 0.0.0.0/0=>0.0.0.0/0"
FORWARD[1]="DROP ALL 0.0.0.0/0=>0.0.0.0/0"
\end{verbatim}
Machines located in other zones are only allowed to initiate ssh
communication to machines located in this zone. Any other
communication initiated by machines in zones different from this zone
to machines in the present zone are silently dropped.

\subsubsection{Reply rules}
Reply rules specifies a special response to connection attempts to the
firewall itself, before dropping the connection. The responses usually
mean that a port or protocol is not available on the system. 

\begin{grammar}

<reply> ::= <zone> <icmp_type> <proto_ip>  
\alt <zone> 'tcp-reset' 'tcp' <port> <src_dst_ip>
\end{grammar}
The first argument specifies the response to the connection
attempt. The 2. argument serves as conditions of the rule. A special 
'tcp-reset' can be used, only if the protocol is specified as tcp.

\paragraph{Example}
\begin{verbatim}
REPLY_AUTH="EXT tcp-reset tcp auth 0.0.0.0/0=>0.0.0.0/0"
\end{verbatim}
This example specifies that queries to the auth
daemon should be responded by \verb|tcp-reset|. Many services on the
Internet makes an auth request on hosts that makes use of the
services. The first line speeds this process up by resetting the
connection, instead of silently dropping packets. 

\subsubsection{Limit rules}
Limit rules serves as an supplement to input and forward rules. Linux
rules allows only limited acceptance of packets, used in order to
avoid \textit{Denial of service} attacks.  The rules are on the form
\verb|<limit>|, as given below.

\begin{grammar}
<rate> ::= <int> <rate_opt> 

<rate_opt> ::= '/second' | '/minute' | '/hour' | '/day' | <empty>

<burst> ::= <int>

<limit> ::= <zone> <policy> <rate> <burst> <proto_ip>
\end{grammar}
The \verb|<rate>| and \verb|<policy>| specifies the maximum average
matching rate, and the initial packets to match. The \verb|<zone>|
specifies the source zone for packets that can be matched by this
rule. If the source zone equals that zone for which the rule is
specified, then the rule is applied for requests to the firewall
itself. 

\paragraph{Example}

\begin{verbatim}
LIMIT_PING="EXT DROP 1/second 3 icmp echo-request \
0.0.0.0/0=>0.0.0.0/0"
\end{verbatim}
This example will drop ping's arriving faster than one per second,
with a maximum of three. 

\subsection{Network address translation rules}
The network address translation rules are used to alter either the
source or the destination of a packet. This can be used to redirect
requests and for masquerading.

\subsubsection{Redirect}
Redirect rules can alter the destination of connection attempts. These
rules only apply packets originating from the current zone. Redirect
rules are sets of rules on the form \verb|redirect| as given below.

\begin{grammar}

<address_opt> ::= ',' <ip_address> <address_opt>
\alt <empty>

<redir_dest> ::= <ip_address> <address_opt>

<redirect> ::= <proto_ip> <redir_dest> <port>
\end{grammar}
If packets originating from the current zone matches
\verb|<proto_ip>|, then the destination of the packets are
changed to the destination as specified by \verb|<redir_dest> <port>|. If a
range of ip addresses is specified for the new destination, then
redirection will be done to each ip in a round robin fashion. This is
often used to load balance servers.

\paragraph{Example}
\begin{verbatim}
REDIRECT_SSH="tcp :22 10.0.0.1:22"
\end{verbatim}
This will redirect any ssh queries to be redirect to address 10.0.0.1.

\subsubsection{Masquerading/SNAT}
Masquerading is used when no public network is available. It changes
the source ip and source port of any packet coming from this
zone. The rules are sets on the form \verb|<snat>| as given below.

\begin{grammar}

<snat> ::= ( <zone name> | <ip> ) <proto_port_ip>
\end{grammar}
The \verb|<zone name>| specifies the destination zone of the packets.
All packets originating from the current zone toward the specified
zone are masqueraded, and will have their source address changed to
the ip address of the zone specified, in a round robin manner.
\paragraph{Example}
\begin{verbatim}
SNAT[0]="EXT ALL 0.0.0.0/0=>0.0.0.0/0"
\end{verbatim}

In this example, all packets send from the current zone to zone
\verb|EXT| will be masqueraded, and the source of the packets will be
changed to the ip of zone \verb|EXT|. The source ports will be changed
to be with in the range $[32768-65535]$. 

%\subsection{Traffic shaping}
%Besides firewalling, FIAIF has the ability of shaping traffic. Traffic
%can be shaped to be with in specified limits.\\

%The options for traffic shaping is given in the table below

%\paragraph{TC_ENABLE}
%\paragraph{TC_TYPE}
%\paragraph{TC_DOWNLINK}
%\paragraph{TC_UPLINK}

\subsection{Miscellaneous rules}

\subsubsection{Packet marking}
Packet marking is used to mark packets going through the
firewall. This can be used by external programs such as traffic
shaping. 

Rules for marking is specified through an array \verb|MARK|. 
The syntax of mark rules are specified below as
\verb|<mark>|.

\begin{grammar}
<mark_value> ::= <int>

<mark> ::= <zone> <mark_value> <proto_ip>
\end{grammar}

Packets originating from the current zone destined for the specified
zone, and that matches the \verb|proto_ip| are marked with the value
\verb|<mark_value>|.

\paragraph{Example}
\begin{verbatim}
MARK[0]="ALL 1 tcp ALL 0.0.0.0/0=>0.0.0.0/0"
\end{verbatim}
This rule will mark any packets leaving the current zone with
mark value '1'.

\subsubsection{Traffic monitoring}
This rule is used to monitor traffic going into or leaving the current
zone. Monitored packets are logged to the system log for later inspection.

Monitoring is done on a per ip basis. Only one entry can exist and is
called \verb|WATCH_IP|. The grammar is specified as \verb|<watch_ip>|.

\begin{grammar}
<watch_ip> ::= <ip_address> <watch_ip> | <empty> 

\end{grammar}

\paragraph{Example}

\begin{verbatim}
WATCH_IP=''10.0.0.1 10.0.0.2''
\end{verbatim}
Any packet going into or leaving the current zone either destined or
originating from ip address \verb|10.0.0.1| or ip address
\verb|10.0.0.2| are logged to the system log.  
 
\subsubsection{Denying communication to MAC addresses}
Communication with machines having a specific MAC address can be
prohibited. Due to the nature of Ethernet, only packets received from
the offending machine can be prohibited. 

To prohibit communication from a list of MAC addresses, a single
variable \verb|MAC_DROP| is used. The grammar is specified as
\verb|mac_drop| below.

\begin{grammar}
<mac_drop> ::= <mac_address> <mac_drop> | <empty>
\end{grammar}

\paragraph{Example}

\begin{verbatim}
MAC_DROP=''12:23:34:45:56:67''
\end{verbatim}
This will drop all packets originating from the internal zone from the
machine with MAC address \verb|12:23:34:45:56:67|.

\subsubsection{Denying communication to IP addresses}
To deny communication to and from a machine in the zone, it is
possible to specify a list of ip addresses whose packets are to be
dropped. 

This is specified by the variable \verb|IP_DROP|. The grammar is
specified below as \verb|<ip_drop>|.

\begin{grammar}
<ip_drop_alt> ::= <ip_address> <ip_drop>

<ip_drop> ::= <ip_drop_alt> | <empty>
\end{grammar}

\paragraph{Example}
\begin{verbatim}
IP_DROP=''10.0.0.10''
\end{verbatim}
This will drop all communication to and from a machine with ip
address \verb|10.0.0.10|.

\subsubsection{Clearing ECN bits from packets}
Eexplicit congestion notification, RFC3168, was defined as an
internet standard in September 2001. Unfortunatly many servers still
drops all packets with the ECN bits set. As a work-arround for this
problem, this option allows the specification of a list of servers
that does not accept packets with the ECN bits set, and clears the
bits.

The list of servers is specified by the variable \verb|ECN_REMOVE|.
The grammar is specified below as \verb|<ecn_remove>|.

\begin{grammar}
<ip_drop_alt> ::= <ip_address> <ip_drop>

<ecn_remove> ::= <ip_drop_alt> | <empty>
\end{grammar}

\paragraph{Example}
\begin{verbatim}
ECN_REMOVE=''10.0.0.10''
\end{verbatim}
This will strip off the ECN bits in all packets destined to the machine with ip
address \verb|10.0.0.10|.

