## Rule options for iptables policy rules

## Tab General

### Assume firewall is part of 'any'

This option overrides global setting of the option with the same name in the firewall object "advanced" settings dialog.

On some firewall platforms there is a difference in the configuration command used to control access through the firewall versus the command that controls access to the firewall itself. For example, in iptables, packets headed for the firewall machine should be inspected in the INPUT chain, while packets going through the firewall are inspected in the FORWARD chain. If this option is ON, the compiler generates code for both FORWARD and INPUT chains if it sees ’any’ as the destination of the policy rule. In other words, it assumes that the firewall is part of ’any’, and packets may either go to or through the firewall. If this option is off, the compiler only generates code for the FORWARD chain. Compiler treats ’any’ in the source of the rule in a similar way, generating code either for the OUTPUT and FORWARD, or only for the FORWARD chain.

### Stateless rule

Firewall Builder always uses stateful packet inspection if it is available in the target firewall. In case of iptables, this means it always uses module "state" by adding the following parameters to the generated rules: "-m state --state NEW". It also adds a rule to match states "ESTABLISHED,RELATED" on top of the policy. However, sometimes it might be desirable to create a rule without state matching. Checking this checkbox on makes the rule stateless, which means parameters "-m state --state NEW" will not be added.

Rules with action Deny are always stateless by default and do not get the "-m state --state NEW" parameters, although you can make them stateful by checking this checkbox.

## Tab Logging

Options in this tab override the same options configured globally in the firewall object "advanced" settings dialog.

### Log prefix

Log records will be prefixed with a string you enter in this option. Firewall Builder supports the following macros in the log prefix that are expanded at the compile time:

- %N rule number in the GUI.
- %A rule action
- %I interface the rule is associated with
- %C (iptables only) iptables chain that this rule generated code for.

### Log level

Choose one of the standard syslog log levels for the "--log-level" option of the LOG iptables target.

### Netlink group

This specifies the netlink group (1-32) to which the packet is sent. Used to add "--ulog-nlgroup" parameter if ULOG logging is chosen in the firewall settings dialog, tab "Logging".

## Tab limit

Options in this tab are used to configure parameters for the module "limit".

### Rate, burst

These translate into " --limit rate" and "--limit-burst number" options for the module "limit". If rate is set to 0 (the default), parameter "-m limit --limit rate" is not added to the generated iptables command.

## Tab connlimit

Options in this tab are used to configure parameters for the module "connlimit".

### Number of allowed connections per client host

If this option is set to non-zero value, it adds the following clause to the generated iptables command: "-m connlimit --connlimit-above ".

### ...per network with netmask of ...

If this option is set to non-zero value, it adds the following to the generated iptables command: " --connlimit-mask mask".

Note that conntrack module must be compiled into the kernel and iptables in order for these options to work on the firewall.

## Tab hashlimit

Options in this tab are used to configure parameters for the module "hashlimit". Please see man page for iptables, section "hashlimit" for the explanation of all parameters it accepts. Note that on some older Linux systems this module used to be called "dstlimit". Checking corresponding checkbox in this dialog causes compiler to generate parameter as "-m dstlimit" instead of "-m hashlimit".