Firehol : Outil de simplification à la mise en place d'Iptables

From / Bloc Notes Informatique
Jump to: navigation, search

1 Introduction

FireHOL is a stateful iptables packet filtering firewall configurator. It is abstracted, extensible, easy and powerful. It can handle any kind of firewall, but most importantly, it gives you the means to configure it, the same way you think of it.

Everybody, who tried to configure an iptables firewall knows, that it can be quite a PITA. firehol is a tool that helps us to configure iptables according to our needs. In this How-To, I will discribe how to set up an iptables firewal using firehol that only allows SSH and ICMP (the protocol responsible for ping and traceroute). Also, only incoming connections are filtered, and outgoing connections are allowed. Here we go:

2 Installing firehol

Installing firehol is quite easy, as it is in the official repositories. Just open a terminal and do a

sudo aptitude install firehol

and you're all ready. Don't close your terminal, because we will need it some more.

3 Setting firehol up

We have to edit two files. First, we have to enable firehol. Open and edit the file /etc/default/firehol, e.g. with VIM:

sudo vim /etc/default/firehol

Change the first line from

Configuration File /etc/default/firehol


Configuration File /etc/default/firehol

save and exit (in VIM, hit [ESC] and then ':wq').

Then we have to define the Firewall rules themselves:

Configuration File /etc/firehol/firehol.conf
sudo vim /etc/firehol/firehol.conf

Paste this part into the file:

Configuration File /etc/firehol/firehol.conf
version 5
# Accept all client traffic on any interface
interface any internet
        protection strong
        server "icmp ping ICMP ssh" accept
        client all accept

This filters all incoming connetions that are not related to SSH or ICMP. If you want to be less polite, you can drop them by adding

Configuration File /etc/firehol/firehol.conf
policy drop

after 'protection strong'.

4 Starting and Fixing firehol

To start firehol just enter

sudo /etc/init.d/firehol start

and DON'T panic if you get a rather long error message. That is related to a bug currently in Ubuntu. To fix it, just enter the following sequence of commmands:

sudo sed 's/%q/%b/g' /lib/firehol/firehol > TMPFILE
sudo cp /lib/firehol/firehol /lib/firehol/firehol.backup
sudo mv TMPFILE /lib/firehol/firehol
sudo chmod 744 /lib/firehol/firehol

and now try it again:


sudo /etc/init.d/firehol start

And now your computer won't accept connections from the outside unless it's a ping request, traceroute or ssh. Have fun!