NAME

Fwctl::Services::all - Fwctl module to handle any IP traffic.

SYNOPSIS

    accept   all -src INTERNAL_NET -dst INTERNET -masq
    deny    all -src BAD_GUYS_NET       --account
    account all -src PERIM_NET -dst INTERNET

DESCRIPTION

The all module is used to match any IP traffic. It can be used for accounting all traffic between nets or to create bazooka sized hole in our filters.

Needless to say that

    accept   all

is not a really secure use of this module.

CAVEATS

The way Fwctl organizes its rules, the all rules will always be processed after more specific rules. That is to say that if you use

    accept   all -src INTERNAL_NET
    block   ftp

This will result (perhaps unintuitively) in ftp being blocked also for the INTERNAL_NET. This is becaus Fwctl optimizes its rules according to protocol. So it processes rules for ICMP, TCP, UDP, OTHER and than ALL. (Other is if you specify another protocol, but not any). This optimization has only effects on rules matching without a protocol specified.

To fix the previous problem use :

    accept all -src INTERNAL_NET
    accept ftp -src INTERNAL_NET # Optimization work around
    block ftp

AUTHOR

Copyright (c) 1999 Francis J. Lacoste and iNsu Innovations Inc. All rights reserved.

This program is free software; you can redistribute it and/or modify it under the terms as perl itself.

SEE ALSO

fwctl(8) Fwctl(3) Fwctl::RuleSet(3)