dirwall - v0.10
---------------

## ABOUT:

    I wrote this because I wanted to have the ability to have useful
  iptables rules described in a concice and (hopefully) sane format.
    I separated the rules from the script logic to make it easier to
  update the script without touching the actual rules.  This also
  makes it easy for other packages to manage the rules.


## CONFIG:

  Configuration settings are stored in the /etc/dirwall/config/* files.
Other configuration is done by the /etc/dirwall/scripts/* scripts.


## RULES:

  The iptables rules are stored in rule files located in 
/etc/dirwall/{ACCEPT,FORWARD,MASQ,NAT,NOLOG}/* .  There may be more than
one rule per file.  The rule filenames in the ACCEPT dir are reserved for
packages with that name.  i.e. the "ssh" package has the ability to manage
the /etc/dirwall/ACCEPT/ssh rule file.  Local ACCEPT rule files should (but
are not required to) begin with "local-".


## RULE SYNTAX:

  rule      = [ hostlist ] [ ">" hostlist ] [ "<" proto ] [ "=" extra ]
  hostlist  = [ host [ "," host [...] ] ] [ ":" portlist ]
  host      = [ [ ip [ "/" mask ] ]
  ip        = ( ipv4 dotted decimal address | dns host address )
  mask      = ( ipv4 dotted decimal bitmask | integer bitmask )
  portlist  = [ portrange [ "," portrange [...] ] ]
  portrange = [ port [ "-" port ] ]
  port      = ( ipv4 port integer )
  proto     = "tcp" | "udp" | "icmp" | "all" | ( other from /etc/protocols )
  extra     = [ host ]


-Thor Kooda
 tkooda-dirwall@devsec.org
 2004-06-24

