interface eth0 dst-privateip dst 192.168.0.144/32
# The default policy is DROP. You can be more polite with REJECT.
# Prefer to be polite on your own clients to prevent timeouts.
policy drop
# If you don't trust the clients behind eth0 (net not "${UNROUTABLE_IPS} 192.168.0.0/24"),
# add something like this.
# > protection strong
# Here are the services listening on eth0.
# TODO: Normally, you will have to remove those not needed.
server ftp accept
server ICMP accept
server ntp accept
server webmin accept
server ssh accept
server dns accept
client ssh accept
client dns accept
client smtp accept
client http accept
# above line is needed for OUTGOING email
# The following eth0 server ports are not known by FireHOL:
# udp/10000 udp/32810 udp/32812 udp/5353
# TODO: If you need any of them, you should define new services.
# (see Adding Services at the web site - http://firehol.sf.net).
# The following means that this machine can REQUEST anything via eth0.
# TODO: On production servers, avoid this and allow only the
# client services you really need.
#client all accept
interface eth0 dst-outside dst not 192.168.0.144/32
# The default policy is DROP. You can be more polite with REJECT.
# Prefer to be polite on your own clients to prevent timeouts.
policy drop
# If you don't trust the clients behind eth0 (net not "${UNROUTABLE_IPS} 192.168.0.0/24"),
# add something like this.
# > protection strong
# Here are the services listening on eth0.
# TODO: Normally, you will have to remove those not needed.
server ftp accept
server ICMP accept
server ntp accept
server webmin accept
server ssh accept
server dns accept
client ssh accept
client dns accept
client smtp accept
client http accept
# above line is needed for OUTGOING email
# The following eth0 server ports are not known by FireHOL:
# udp/10000 udp/32810 udp/32812 udp/5353
# TODO: If you need any of them, you should define new services.
# (see Adding Services at the web site - http://firehol.sf.net).
# The following means that this machine can REQUEST anything via eth0.
# TODO: On production servers, avoid this and allow only the
# client services you really need.
#client all accept