<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="1.0.1" id="root">
  <AnyNetwork comment="Any Network" id="sysid0" library="Standard" name="Any" address="0.0.0.0" netmask="0.0.0.0"/>
  <AnyIPService comment="Any IP Service" id="sysid1" library="Standard" name="Any" protocol_num="0"/>
  <AnyInterval comment="Any Interval" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" id="sysid2" library="Standard" name="Any" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
  <ObjectGroup id="sysid3" library="Standard" name="ScratchPad"/>
  <ObjectGroup id="stdid01" library="Standard" name="Objects">
    <ObjectGroup id="stdid04" library="Standard" name="Groups"/>
    <ObjectGroup id="stdid02" library="Standard" name="Hosts">
      <Host comment="" id="host-hostA" name="mail server">
        <Interface dyn="False" id="host-hostA-i" label="" name="unknown" security_level="0" unnum="False">
          <IPv4 address="192.168.1.10" id="host-hostA-i-ipv4" name="hostA" netmask="255.255.255.0"/>
        </Interface>
        <Management address="192.168.1.10">
          <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <HostOptions>
          <Option name="snmp_contact"></Option>
          <Option name="snmp_description"></Option>
          <Option name="snmp_location"></Option>
          <Option name="use_mac_addr_filter">False</Option>
        </HostOptions>
      </Host>
      <Host comment="" id="host-hostB" name="web server">
        <Interface dyn="False" id="host-hostB-i" label="" name="unknown" security_level="0" unnum="False">
          <IPv4 address="192.168.1.20" id="host-hostB-i-ipv4" name="hostB" netmask="255.255.255.0"/>
        </Interface>
        <Management address="192.168.1.20">
          <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <HostOptions>
          <Option name="snmp_contact"></Option>
          <Option name="snmp_description"></Option>
          <Option name="snmp_location"></Option>
          <Option name="use_mac_addr_filter">False</Option>
        </HostOptions>
      </Host>
      <Host comment="" id="host-secondary1.com" name="secondary1">
        <Interface dyn="False" id="host-secondary1.com-i" label="" name="unknown" security_level="0" unnum="False">
          <IPv4 address="211.11.11.11" id="host-secondary1.com-i-ipv4" name="secondary1.com" netmask="255.255.255.0"/>
        </Interface>
        <Management address="211.11.11.11">
          <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <HostOptions>
          <Option name="snmp_contact"></Option>
          <Option name="snmp_description"></Option>
          <Option name="snmp_location"></Option>
          <Option name="use_mac_addr_filter">False</Option>
        </HostOptions>
      </Host>
      <Host comment="" id="host-secondary2.com" name="secondary2">
        <Interface dyn="False" id="host-secondary2.com-i" label="" name="unknown" security_level="0" unnum="False">
          <IPv4 address="211.22.22.22" id="host-secondary2.com-i-ipv4" name="secondary2.com" netmask="255.255.255.0"/>
        </Interface>
        <Management address="211.22.22.22">
          <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <HostOptions>
          <Option name="snmp_contact"></Option>
          <Option name="snmp_description"></Option>
          <Option name="snmp_location"></Option>
          <Option name="use_mac_addr_filter">False</Option>
        </HostOptions>
      </Host>
    </ObjectGroup>
    <ObjectGroup id="stdid03" library="Standard" name="Networks">
      <Network comment="" id="net-Internal_net" name="Internal_net" address="192.168.1.0" netmask="255.255.255.0"/>
    </ObjectGroup>
    <ObjectGroup id="stdid15" library="Standard" name="Address Ranges"/>
  </ObjectGroup>
  <ServiceGroup id="stdid05" library="Standard" name="Services">
    <CustomService comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually statefule firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." id="stdid14" library="Standard" name="ESTABLISHED">
      <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
      <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
      <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
    </CustomService>
    <ServiceGroup id="stdid10" library="Standard" name="Groups">
      <ServiceGroup comment="" id="sg-DHCP" library="Standard" name="DHCP">
        <ServiceRef ref="udp-bootpc"/>
        <ServiceRef ref="udp-bootps"/>
      </ServiceGroup>
      <ServiceGroup comment="" id="sg-NETBIOS" library="Standard" name="NETBIOS">
        <ServiceRef ref="udp-netbios-dgm"/>
        <ServiceRef ref="udp-netbios-ns"/>
        <ServiceRef ref="udp-netbios-ssn"/>
      </ServiceGroup>
      <ServiceGroup comment="" id="sg-Useful_ICMP" library="Standard" name="Useful_ICMP">
        <ServiceRef ref="icmp-Time_exceeded"/>
        <ServiceRef ref="icmp-Time_exceeded_in_transit"/>
        <ServiceRef ref="icmp-ping_reply"/>
        <ServiceRef ref="icmp-Unreachables"/>
      </ServiceGroup>
    </ServiceGroup>
    <ServiceGroup id="stdid07" library="Standard" name="ICMP">
      <ICMPService code="1" comment="" id="icmp-Host_unreach" library="Standard" name="Host_unreach" type="3"/>
      <ICMPService code="3" comment="Port unreachable" id="icmp-Port_unreach" library="Standard" name="Port_unreach" type="3"/>
      <ICMPService code="0" comment="" id="icmp-Time_exceeded" library="Standard" name="Time_exceeded" type="11"/>
      <ICMPService code="1" comment="" id="icmp-Time_exceeded_in_transit" library="Standard" name="Time_exceeded_in_transit" type="11"/>
      <ICMPService code="0" comment="" id="icmp-ping_reply" library="Standard" name="ping_reply" type="0"/>
      <ICMPService code="0" comment="" id="icmp-ping_request" library="Standard" name="ping_request" type="8"/>
      <ICMPService code="-1" comment="all icmp &quot;unreachables&quot;" id="icmp-Unreachables" library="Standard" name="all_icmp_unreachables" type="3"/>
    </ServiceGroup>
    <ServiceGroup id="stdid06" library="Standard" name="IP">
      <IPService comment="" fragm="False" id="ip-IPSEC" library="Standard" lsrr="False" name="IPSEC" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False"/>
      <IPService comment="'Short' fragments" fragm="False" id="ip-IP_Fragments" library="Standard" lsrr="False" name="ip_fragments" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False"/>
      <IPService comment="Route recording packets" fragm="False" id="ip-RR" library="Standard" lsrr="False" name="RR" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False"/>
      <IPService comment="All sorts of Source Routing Packets" fragm="False" id="ip-SRR" library="Standard" lsrr="True" name="SRR" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False"/>
    </ServiceGroup>
    <ServiceGroup id="stdid09" library="Standard" name="TCP">
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="False" id="tcp-ALL_TCP_Masqueraded" library="Standard" name="ALL_TCP_Masqueraded" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="65095" src_range_start="61000" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="False" id="tcp-All_TCP" library="Standard" name="All_TCP" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="113" dst_range_start="113" fin_flag="False" fin_flag_mask="False" id="tcp-Auth" library="Standard" name="auth" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="53" dst_range_start="53" fin_flag="False" fin_flag_mask="False" id="tcp-DNS_zone_transf" library="Standard" name="dns-tcp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="21" dst_range_start="21" fin_flag="False" fin_flag_mask="False" id="tcp-FTP" library="Standard" name="ftp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="65535" dst_range_start="1024" fin_flag="False" fin_flag_mask="False" id="tcp-FTP_data" library="Standard" name="ftp_data" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="20" src_range_start="20" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="80" dst_range_start="80" fin_flag="False" fin_flag_mask="False" id="tcp-HTTP" library="Standard" name="http" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="6667" dst_range_start="6667" fin_flag="False" fin_flag_mask="False" id="tcp-IRC" name="irc" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="119" dst_range_start="119" fin_flag="False" fin_flag_mask="False" id="tcp-NNTP" library="Standard" name="nntp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="25" dst_range_start="25" fin_flag="False" fin_flag_mask="False" id="tcp-SMTP" library="Standard" name="smtp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="22" dst_range_start="22" fin_flag="False" fin_flag_mask="False" id="tcp-SSH" library="Standard" name="ssh" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="True" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="True" id="tcp-TCP-SYN" library="Standard" name="tcp-syn" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="23" dst_range_start="23" fin_flag="False" fin_flag_mask="False" id="tcp-Telnet" library="Standard" name="telnet" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="540" dst_range_start="540" fin_flag="False" fin_flag_mask="False" id="tcp-uucp" library="Standard" name="uucp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
    </ServiceGroup>
    <ServiceGroup id="stdid08" library="Standard" name="UDP">
      <UDPService comment="" dst_range_end="0" dst_range_start="0" id="udp-ALL_UDP_Masqueraded" library="Standard" name="ALL_UDP_Masqueraded" src_range_end="65095" src_range_start="61000"/>
      <UDPService comment="" dst_range_end="0" dst_range_start="0" id="udp-All_UDP" library="Standard" name="All_UDP" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="53" dst_range_start="53" id="udp-DNS" library="Standard" name="DNS" src_range_end="" src_range_start=""/>
      <UDPService comment="" dst_range_end="161" dst_range_start="161" id="udp-SNMP" library="Standard" name="SNMP" src_range_end="" src_range_start=""/>
      <UDPService comment="" dst_range_end="68" dst_range_start="68" id="udp-bootpc" library="Standard" name="bootpc" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="67" dst_range_start="67" id="udp-bootps" library="Standard" name="bootps" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="138" dst_range_start="138" id="udp-netbios-dgm" library="Standard" name="netbios-dgm" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="137" dst_range_start="137" id="udp-netbios-ns" library="Standard" name="netbios-ns" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="139" dst_range_start="139" id="udp-netbios-ssn" library="Standard" name="netbios-ssn" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="123" dst_range_start="123" id="udp-ntp" library="Standard" name="ntp" src_range_end="0" src_range_start="0"/>
    </ServiceGroup>
    <ServiceGroup id="stdid13" library="Standard" name="Custom_Services">
      <CustomService comment="works in iptables and requires patch-o-matic" id="id3B64EEA8" library="Standard" name="rpc">
        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
        <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
      </CustomService>
      <CustomService comment="IRC connection tracker, supports DCC. Works with iptables and requires patch-o-matic" id="id3B64EF4E" library="Standard" name="irc-conn">
        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
        <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
      </CustomService>
      <CustomService comment="Port scan detector, works only with iptables and  requires patch-o-matic " id="id3B64EF50" library="Standard" name="psd">
        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
        <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
      </CustomService>
      <CustomService comment="Matches a string in a whole packet, works with iptables and requires patch-o-matic" id="id3B64EF52" library="Standard" name="string">
        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
        <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
      </CustomService>
      <CustomService comment="Talk protocol support. Works with iptables and requires patch-o-matic" id="id3B64EF54" library="Standard" name="talk">
        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
        <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
      </CustomService>
    </ServiceGroup>
  </ServiceGroup>
  <ObjectGroup id="stdid12" library="Standard" name="Firewalls">
    <Firewall comment="example #2  created  01/24/2001 converted to v0.9 format 04/26/2001" host_OS="linux24" id="fw-firewall2" name="firewall" platform="iptables" version="">
      <NAT id="nat-firewall2">
        <NATRule comment="" disabled="False" id="nat-firewall2-0" position="0">
          <OSrc neg="False">
            <ObjectRef ref="net-Internal_net"/>
          </OSrc>
          <ODst neg="False">
            <ObjectRef ref="sysid0"/>
          </ODst>
          <OSrv neg="False">
            <ServiceRef ref="sysid1"/>
          </OSrv>
          <TSrc neg="False">
            <ObjectRef ref="fw-firewall2"/>
          </TSrc>
          <TDst neg="False">
            <ObjectRef ref="sysid0"/>
          </TDst>
          <TSrv neg="False">
            <ServiceRef ref="sysid1"/>
          </TSrv>
          <NATRuleOptions/>
        </NATRule>
        <NATRule comment="" disabled="False" id="nat-firewall2-1" position="1">
          <OSrc neg="False">
            <ObjectRef ref="sysid0"/>
          </OSrc>
          <ODst neg="False">
            <ObjectRef ref="fw-firewall2"/>
          </ODst>
          <OSrv neg="False">
            <ServiceRef ref="tcp-SMTP"/>
            <ServiceRef ref="udp-DNS"/>
            <ServiceRef ref="tcp-DNS_zone_transf"/>
          </OSrv>
          <TSrc neg="False">
            <ObjectRef ref="sysid0"/>
          </TSrc>
          <TDst neg="False">
            <ObjectRef ref="host-hostA"/>
          </TDst>
          <TSrv neg="False">
            <ServiceRef ref="sysid1"/>
          </TSrv>
          <NATRuleOptions/>
        </NATRule>
        <NATRule comment="dual translation for connections\nfrom internal net to the mapped\naddress of the web server" disabled="False" id="id3EAAD29C" position="2">
          <OSrc neg="False">
            <ObjectRef ref="net-Internal_net"/>
          </OSrc>
          <ODst neg="False">
            <ObjectRef ref="if-FW-firewall2-eth1"/>
          </ODst>
          <OSrv neg="False">
            <ServiceRef ref="tcp-HTTP"/>
          </OSrv>
          <TSrc neg="False">
            <ObjectRef ref="if-FW-firewall2-eth0"/>
          </TSrc>
          <TDst neg="False">
            <ObjectRef ref="host-hostB"/>
          </TDst>
          <TSrv neg="False">
            <ServiceRef ref="sysid1"/>
          </TSrv>
          <NATRuleOptions/>
        </NATRule>
        <NATRule comment="NAT access to the web server for\nclients coming from the Internet\n\n" disabled="False" id="id3EAAD2C8" position="3">
          <OSrc neg="False">
            <ObjectRef ref="sysid0"/>
          </OSrc>
          <ODst neg="False">
            <ObjectRef ref="if-FW-firewall2-eth1"/>
          </ODst>
          <OSrv neg="False">
            <ServiceRef ref="tcp-HTTP"/>
          </OSrv>
          <TSrc neg="False">
            <ObjectRef ref="sysid0"/>
          </TSrc>
          <TDst neg="False">
            <ObjectRef ref="host-hostB"/>
          </TDst>
          <TSrv neg="False">
            <ServiceRef ref="sysid1"/>
          </TSrv>
          <NATRuleOptions/>
        </NATRule>
      </NAT>
      <Policy id="pol-firewall2">
        <PolicyRule action="Accept" comment="" disabled="False" id="pol-firewall2-2" log="False" position="0">
          <Src neg="False">
            <ObjectRef ref="sysid0"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="host-hostA"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="tcp-SMTP"/>
            <ServiceRef ref="udp-DNS"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
        <PolicyRule action="Accept" comment="" disabled="False" id="id3F176955" log="False" position="1">
          <Src neg="False">
            <ObjectRef ref="host-secondary1.com"/>
            <ObjectRef ref="host-secondary2.com"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="host-hostA"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="tcp-DNS_zone_transf"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
        <PolicyRule action="Accept" disabled="False" id="id3EAAD3CF" log="False" position="2">
          <Src neg="False">
            <ObjectRef ref="sysid0"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="host-hostB"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="tcp-HTTP"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
        <PolicyRule action="Accept" comment="need this for traceroute" disabled="False" id="id3C23933D" log="False" position="3">
          <Src neg="False">
            <ObjectRef ref="fw-firewall2"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="net-Internal_net"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="icmp-Time_exceeded"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions>
            <Option name="action_on_reject"></Option>
            <Option name="limit_burst">0</Option>
            <Option name="limit_suffix"></Option>
            <Option name="limit_value">0</Option>
            <Option name="log_level"></Option>
            <Option name="log_prefix"></Option>
            <Option name="stateless">True</Option>
          </PolicyRuleOptions>
        </PolicyRule>
        <PolicyRule action="Accept" comment="" disabled="False" id="pol-firewall2-4" log="False" position="4">
          <Src neg="False">
            <ObjectRef ref="sysid0"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="net-Internal_net"/>
            <ObjectRef ref="fw-firewall2"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="sg-Useful_ICMP"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
        <PolicyRule action="Reject" comment="send TCP RST to reject connections to IDENT daemon" disabled="False" id="id3C239480" log="False" position="5">
          <Src neg="False">
            <ObjectRef ref="sysid0"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="fw-firewall2"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="tcp-Auth"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions>
            <Option name="action_on_reject">TCP RST</Option>
            <Option name="limit_burst">0</Option>
            <Option name="limit_suffix"></Option>
            <Option name="limit_value">0</Option>
            <Option name="log_level"></Option>
            <Option name="log_prefix"></Option>
            <Option name="stateless">False</Option>
          </PolicyRuleOptions>
        </PolicyRule>
        <PolicyRule action="Accept" comment="Automatically generated 'masquerading' rule" disabled="False" id="pol-firewall2-5" log="False" position="6">
          <Src neg="False">
            <ObjectRef ref="net-Internal_net"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="sysid0"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="sysid1"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
        <PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" disabled="False" id="pol-firewall2-7" log="True" position="7">
          <Src neg="False">
            <ObjectRef ref="sysid0"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="sysid0"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="sysid1"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
      </Policy>
      <Interface dyn="False" id="if-FW-firewall2-eth1" name="eth1" security_level="0" unnum="False">
        <IPv4 address="192.0.2.1" comment="" id="if-FW-firewall2-eth1-ipv4" name="firewall" netmask="255.255.255.0"/>
        <InterfacePolicy id="pol-firewall2-eth1">
          <PolicyRule action="Deny" comment="Automatically generated anti-spoofing rule" direction="Inbound" disabled="False" id="pol-firewall2-1" log="True" position="0">
            <Src neg="False">
              <ObjectRef ref="net-Internal_net"/>
              <ObjectRef ref="fw-firewall2"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" comment="an example of the rule using custom service\nPSD is a patch-o-matic module used for\nport scan detection. This rule will only work\nif the firewall's platform is iptables" direction="Inbound" disabled="False" id="id3B6C77D2" log="True" position="1">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="id3B64EF50"/>
            </Srv>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="action_on_reject"></Option>
              <Option name="limit_burst">0</Option>
              <Option name="limit_suffix"></Option>
              <Option name="limit_value">0</Option>
              <Option name="log_level"></Option>
              <Option name="log_limit_suffix"></Option>
              <Option name="log_prefix"></Option>
              <Option name="stateless">False</Option>
            </PolicyRuleOptions>
          </PolicyRule>
        </InterfacePolicy>
      </Interface>
      <Interface dyn="False" id="if-FW-firewall2-eth0" name="eth0" security_level="100" unnum="False">
        <IPv4 address="192.168.1.1" id="if-FW-firewall2-eth0-ipv4" name="firewall" netmask="255.255.255.0"/>
      </Interface>
      <Interface comment="" dyn="False" id="id3EAAD0C1" label="" mgmt="False" name="lo" security_level="100" unnum="False">
        <IPv4 address="127.0.0.1" comment="" id="id3EAAD0C3" name="firewall:lo(ip)" netmask="255.0.0.0"/>
        <InterfacePolicy id="id3EAAD0C2">
          <PolicyRule action="Accept" direction="Both" disabled="False" id="id3EAAD0C6" log="False" position="0">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
        </InterfacePolicy>
      </Interface>
      <Management address="222.222.222.222">
        <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
        <FWBDManagement enabled="False" identity="" port="-1"/>
        <PolicyInstallScript arguments="" command="" enabled="False"/>
      </Management>
      <FirewallOptions>
        <Option name="accept_established">True</Option>
        <Option name="accept_new_tcp_with_no_syn">True</Option>
        <Option name="action_on_reject">ICMP net unreachable</Option>
        <Option name="check_shading">true</Option>
        <Option name="clamp_mss_to_mtu">False</Option>
        <Option name="cmdline"></Option>
        <Option name="compiler"></Option>
        <Option name="debug">False</Option>
        <Option name="dyn_addr">False</Option>
        <Option name="firewall_is_part_of_any_and_networks">True</Option>
        <Option name="inst_cmdline"></Option>
        <Option name="inst_script"></Option>
        <Option name="limit_suffix">/day</Option>
        <Option name="limit_value">0</Option>
        <Option name="linux24_ip_forward">1</Option>
        <Option name="linux24_tcp_fin_timeout">30</Option>
        <Option name="linux24_tcp_keepalive_interval">1800</Option>
        <Option name="load_modules">False</Option>
        <Option name="log_all_dropped">True</Option>
        <Option name="log_ip_opt">False</Option>
        <Option name="log_level">warning</Option>
        <Option name="log_limit_suffix">/second</Option>
        <Option name="log_limit_value">0</Option>
        <Option name="log_prefix"></Option>
        <Option name="log_tcp_opt">False</Option>
        <Option name="log_tcp_seq">False</Option>
        <Option name="manage_virtual_addr">True</Option>
        <Option name="no_iochains_for_any">False</Option>
        <Option name="no_optimisation">False</Option>
        <Option name="platform">iptables</Option>
        <Option name="script_env_path"></Option>
        <Option name="snmp_contact"></Option>
        <Option name="snmp_description"></Option>
        <Option name="snmp_location"></Option>
        <Option name="use_numeric_log_levels">False</Option>
      </FirewallOptions>
    </Firewall>
    <Firewall comment="firewall protects host it is running on" host_OS="linux24" id="id3AF5A2BA" name="host" platform="iptables" version="">
      <NAT id="id3AF5A2BD"/>
      <Policy id="id3AF5A2BC">
        <PolicyRule action="Deny" comment="block fragments and port scans" disabled="False" id="id3AF5A74B" log="True" position="0">
          <Src neg="False">
            <ObjectRef ref="sysid0"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="id3AF5A2BA"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="ip-IP_Fragments"/>
            <ServiceRef ref="id3B64EF50"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
        <PolicyRule action="Accept" disabled="False" id="id3AF5A73A" log="False" position="1">
          <Src neg="False">
            <ObjectRef ref="sysid0"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="id3AF5A2BA"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="tcp-SMTP"/>
            <ServiceRef ref="tcp-HTTP"/>
            <ServiceRef ref="tcp-SSH"/>
            <ServiceRef ref="tcp-FTP"/>
            <ServiceRef ref="tcp-Telnet"/>
            <ServiceRef ref="icmp-Unreachables"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
        <PolicyRule action="Accept" comment="allow all outgoing connections" disabled="False" id="id3AF5A757" log="False" position="2">
          <Src neg="False">
            <ObjectRef ref="id3AF5A2BA"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="sysid0"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="sysid1"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
        <PolicyRule action="Deny" comment="'catch all' rule" disabled="False" id="id3AF5A762" log="True" position="3">
          <Src neg="False">
            <ObjectRef ref="sysid0"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="sysid0"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="sysid1"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
      </Policy>
      <Interface dyn="False" id="id3AF5A2CB" name="eth0" security_level="100" unnum="False">
        <IPv4 address="22.22.22.22" id="id3AF5A2CB-ipv4" name="host" netmask="255.255.255.0"/>
        <InterfacePolicy id="id3AF5A2CD"/>
      </Interface>
      <Interface dyn="False" id="id3B6C7A3B" name="lo" security_level="100" unnum="False">
        <IPv4 address="127.0.0.1" id="id3B6C7A3B-ipv4" name="host" netmask="255.0.0.0"/>
        <InterfacePolicy id="id3B6C7A3C">
          <PolicyRule action="Accept" comment="allow everything on loopback" direction="Inbound" disabled="False" id="id3B6C7A72" log="False" position="0">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3AF5A2BA"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <PolicyRuleOptions>
              <Option name="stateless">True</Option>
            </PolicyRuleOptions>
          </PolicyRule>
          <PolicyRule action="Accept" comment="allow everything on loopback" direction="Outbound" disabled="False" id="id3B6C7A7B" log="False" position="1">
            <Src neg="False">
              <ObjectRef ref="id3AF5A2BA"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <PolicyRuleOptions>
              <Option name="stateless">True</Option>
            </PolicyRuleOptions>
          </PolicyRule>
        </InterfacePolicy>
      </Interface>
      <Management address="22.22.22.22">
        <SNMPManagement enabled="False" snmp_read_community="public" snmp_write_community=""/>
        <FWBDManagement enabled="False" identity="" port="-1"/>
        <PolicyInstallScript arguments="" command="" enabled="False"/>
      </Management>
      <FirewallOptions>
        <Option name="accept_established">True</Option>
        <Option name="accept_new_tcp_with_no_syn">True</Option>
        <Option name="action_on_reject">ICMP net unreachable</Option>
        <Option name="check_shading">true</Option>
        <Option name="cmdline"></Option>
        <Option name="compiler"></Option>
        <Option name="debug">False</Option>
        <Option name="dyn_addr">False</Option>
        <Option name="firewall_is_part_of_any_and_networks">False</Option>
        <Option name="inst_cmdline"></Option>
        <Option name="inst_script"></Option>
        <Option name="linux24_ip_forward">0</Option>
        <Option name="load_modules">False</Option>
        <Option name="log_all_dropped">False</Option>
        <Option name="log_ip_opt">False</Option>
        <Option name="log_level">warning</Option>
        <Option name="log_limit_suffix">/second</Option>
        <Option name="log_limit_value">0</Option>
        <Option name="log_prefix"></Option>
        <Option name="log_tcp_opt">False</Option>
        <Option name="log_tcp_seq">False</Option>
        <Option name="manage_virtual_addr">False</Option>
        <Option name="no_iochains_for_any">False</Option>
        <Option name="no_optimisation">False</Option>
        <Option name="platform">iptables</Option>
        <Option name="snmp_contact"></Option>
        <Option name="snmp_description"></Option>
        <Option name="snmp_location"></Option>
      </FirewallOptions>
    </Firewall>
  </ObjectGroup>
  <IntervalGroup id="stdid11" library="Standard" name="Time">
    <Interval comment="any day, 9:00am through 5:00pm" from_day="-1" from_hour="9" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" id="int-workhours" library="Standard" name="workhours" to_day="-1" to_hour="17" to_minute="0" to_month="-1" to_weekday="-1" to_year="-1"/>
    <Interval comment="weekends: Saturday 0:00 through Sunday 23:59 " from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="7" from_year="-1" id="int-weekends" library="Standard" name="weekends" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="1" to_year="-1"/>
    <Interval comment="any day 6:00pm - 12:00am" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" id="int-afterhours" library="Standard" name="afterhours" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1"/>
  </IntervalGroup>
</FWObjectDatabase>
