XMLFILTER : an XML structure to configure Netfilter

Description
Document structure
Rules
Download
Contacts
Licence
Home


DESCRIPTION

Features

There is four main ideas behind XMLFILTER :

See the Iptables tutorial for informations about the usual way to configure Netfilter

Below are some of XMLFILTER features :

TODO :

How it works

Synopsis :

xmlfilter -c [netfilter_config.xml]


Document definition

XMLFILTER DTD :

XMLFILTER XSLT transform :

Exemple of what an XMLFILTER config file looks like (edited with JAXE) :


main branch elements

There are three branch elements :

GATEWAY branch

FW_HOST branch

POLICY branch

It contains the following policy elements :


policy elements

Element <ROUTING> has the following attributes :

ip_forwarding : set to "yes" enable routing between interfaces
no_source_routing : set to "yes" tell the kernel to ignore source routed packets
secure_redirects : set to "yes" tell the kernel to ignore ICMP redirects from sources that are not known gateways

Element <INPUT_POLICY> has the folowing attributes :

policy : set the default rule for incoming packets destinated to the firewall host to : "ACCEPT" (accept packet, disadvised ;), "DROP" (silently trash the packet) or "REJECT" (trash packet and send ICMP unreachable information)

Element <OUTPUT_POLICY> has the folowing attributes :

policy : set the default rule for outgoing packets from the firewall host to : "ACCEPT" (accept packet, disadvised ;), "DROP" (silently trash the packet) or "REJECT" (trash packet and send ICMP unreachable information)

Element <FORWARD_POLICY> has the folowing attributes :

policy : set the default rule for forwarded packets to : "ACCEPT" (accept packet, disadvised ;), "DROP" (silently trash the packet) or "REJECT" (trash packet and send ICMP unreachable information)

Element <IDS> has the folowing attributes :

catch_orpheans : set to "yes" drop or log framents of packets that are not related to any tracked connexion
catch_synscan : set to "yes" drop or log synscan attempts
catch_invalid : set to "yes" drop or log invalids packets
catch_invalid : set to "yes" drop or log invalids packets
log : set to "yes" tell if we should log packets before dropping
log_martians : set to "yes" log packets with impossible IP address

Element <ANTISPOOF> has the folowing attributes :

homenet : set the network address and mask of the protected network in the www.xxx.yyy.zzz/mm format
extern_if : set the name of extern interface where to apply antispoofing

Element <STATEFULL> has the folowing attributes :

statefull_inspection : set to "yes" activate connexion tracking
conntrack_max : set the max connexion tracking cache size value (usually 16535 is a good value)


Flow elements

FORWARD element

in : name of the input interface (eth0, ppp0, ...)
out : name of the output interface (eth0, ppp0, ...)

INPUT element

in : name of the input interface (eth0, ppp0, ...)

OUTPUT element

out : name of the output interface (eth0, ppp0, ...) - mandatory
process : process name (ssh, wget, ...) - optional
user : userid (0, 500, ...) - optional
group : groupid (0, 100, ...) - optional


Action elements

Element <FILTER_RULE> has the following attributes :

saddress : source IP address to match
daddress : destination IP address to match
proto : protocol (tcp, udp, icmp,..., or protocol number)
tcp_flag : TCP flag (syn, ack, rst, psh, urg, fin)
icmp_type : icmp type (number or name of icmp type, see IPTABLES documentation)
sport : source port number
dport : destination port number
limit : number of packets per time unit ex : 20/s, 3/minute, ...
burst : initial/burst number of packets
ttl : matches the IP time to live of the packet
tos : matches the TOS option of the packet
action : what to do with packet (ACCEPT, DROP, REJECT) (mandatory)

Element <NAT_RULE> has the following attributes :

saddress : source IP address to match
daddress : destination IP address to match
proto : protocol (tcp, udp, icmp,..., or protocol number)
tcp_flag : TCP flag (syn, ack, rst, psh, urg, fin)
icmp_type : icmp type (number or name of icmp type, see IPTABLES documentation)
sport : source port number
dport : destination port number
nat_to : translated IP, port number, or the www.xxx.yyy.zzz:mm format
action : what to do with packet (SNAT, DNAT, MASQUERADE) (mandatory)

Element <LOG_RULE> has the following attributes :

saddress : source IP address to match
daddress : destination IP address to match
chain : chain (INPUT, OUTPUT, FORWARD) (mandatory)
proto : protocol (tcp, udp, icmp,..., or protocol number)
tcp_flag : TCP flag (syn, ack, rst, psh, urg, fin)
icmp_type : icmp type (number or name of icmp type, see IPTABLES documentation)
sport : source port number
dport : destination port number
limit : number of packets per time unit ex : 20/s, 3/minute, ...
burst : initial/burst number of packets
ttl : matches the IP time to live of the packet
tos : matches the TOS option of the packet
prefix : text to be inserted at the begining of the log line

Element <TOS_RULE> has the following attributes :

saddress : source IP address to match
daddress : destination IP address to match
proto : protocol (tcp, udp, icmp,..., or protocol number)
tcp_flag : TCP flag (syn, ack, rst, psh, urg, fin)
icmp_type : icmp type (number or name of icmp type, see IPTABLES documentation)
sport : source port number
dport : destination port number
ttl : matches the IP time to live of the packet
tos : matches the TOS option of the packet
set_tos : type of service to set to the packet


DOWNLOAD

XMLFILTER can be downloaded here :

Depends on :

Install :

Editor :

JAXE can be downloaded here :


CONTACTS

Author :



LICENCE

Top of the page