firehol(1)

📦
version 3.1.8 · 4 versions
, in debian trixie, ubuntu resolute, ubuntu stonking

🎀 firehol — NAME 🎀

okay so bestie, meet firehol (that's the firehol(1) page, version 3.1.8, hi hello) — an easy to use but powerful iptables stateful firewall. yes she's lowkey iconic, yes she's highkey running your whole network vibe check. 💅

✨ SYNOPSIS ✨

firehol

sudo -E firehol panic [ IP ]

firehol command [ – conf-arg...  ]

firehol CONFIGFILE [start|debug|try] [– conf-arg...  ]

like, that's the whole energy right there. 🫶

🌸 DESCRIPTION 🌸

Running firehol invokes iptables(8) to manipulate your firewall. that's the tea. ☕

Run it with no arguments at all and firehol will just present some help on usage. she's being polite.

When given CONFIGFILE, firehol will use the named file instead of /etc/firehol/firehol.conf as its configuration. and if no command is given, firehol assumes try. (bold assumption but okay queen 👑)

It is possible to pass arguments for use by the configuration file by separating any conf-arg values from the rest of the arguments with --. The arguments are accessible in the configuration using standard bash(1) syntax e.g. $1, $2, etc. 🧚

🚨 PANIC 🚨

To block all communication, invoke firehol with the panic command.

FireHOL removes all rules from the running firewall and then DROPs all traffic on all iptables(8) tables (mangle, nat, filter) and pre-defined chains (PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING).

DROPing is not done by changing the default policy to DROP, but by adding one rule per table/chain to drop all traffic. This allows systems which do not reset all the chains to ACCEPT when starting to function correctly. (iykyk 💀)

When activating panic mode, FireHOL checks for the existence of the SSH_CLIENT shell environment variable, which is set by ssh(1). If it finds this, then panic mode will allow the established SSH connection specified in this variable to operate. 🦋

Note 📌 In order for FireHOL to see the environment variable you must ensure that it is preserved. For sudo(8) use the -E and for su(1) omit the - (minus sign). not me locking myself out of my own server, couldn't be me 🙈

If SSH_CLIENT is not set, the IP after the panic argument allows you to give an IP address for which all established connections between the IP address and the host in panic will be allowed to continue. 🫶

💜 COMMANDS 💜

  • start; restart — Activates the firewall using /etc/firehol/firehol.conf.

Use of the term restart is allowed for compatibility with common init implementations. (she's flexible, we love that ✨)

  • try — Activates the firewall, waiting for the user to type the word commit. If this word is not typed within 30 seconds, the previous firewall is restored. it's giving "trust fall but make it networking" 😭
  • stop — Stops a running iptables(8) firewall by clearing all of the tables and chains and setting the default policies to ACCEPT. This will allow all traffic to pass unchecked. fr fr be careful, that's a wide open door bestie 🚪💀
  • condrestart — Restarts the FireHOL firewall only if it is already active. This is the generally expected behaviour (but opposite to FireHOL prior to 2.0.0-pre4). glow up confirmed 💅
  • status — Shows the running firewall, using /sbin/iptables -nxvL | less. vibe check on your firewall, literally 👀
  • save — Start the firewall and then save it using iptables-save(8) to the location given by FIREHOL_AUTOSAVE. See firehol-defaults.conf(5) for more information.

The required kernel modules are saved to an executable shell script /var/spool/firehol/last_save_modules.sh, which can be called during boot if a firewall is to be restored.

Note 📌 External changes may cause a firewall restored after a reboot to not work as intended where starting the firewall with FireHOL will work. This is because as part of starting a firewall, FireHOL checks some changeable values. For instance the current kernel configuration is checked (for client port ranges), and RPC servers are queried (to allow correct functioning of the NFS service). she's thorough like that, no cap 🌈
  • debug — Parses the configuration file but instead of activating it, FireHOL shows the generated iptables(8) statements. peek behind the curtain, main character energy 🔥
  • explain — Enters an interactive mode where FireHOL accepts normal configuration commands and presents the generated iptables(8) commands for each of them, together with some reasoning for its purpose.

Additionally, FireHOL automatically generates a configuration script based on the successful commands given.

Some extra commands are available in explain mode.

  • help — Present some help
  • show — Present the generated configuration
  • quit — Exit interactive mode and quit
  • helpme; wizard — Tries to guess the FireHOL configuration needed for the current machine.

FireHOL will not stop or alter the running firewall. The configuration file is given in the standard output of firehol, thus firehol helpme > /tmp/firehol.conf will produce the output in /tmp/firehol.conf. slay, redirect that girl 💅

The generated FireHOL configuration must be edited before use on your systems. You are required to take a number of decisions; the comments in the generated file will instruct you in the choices you must make. it's a starting point bestie, not a finished fit 🎀

🍓 FILES 🍓

  • /etc/firehol/firehol.conf

🌈 SEE ALSO 🌈

go read those, they're the supporting cast and they ate 💖

👑 AUTHORS 👑

FireHOL Team; Original man page by Marc Brockschmidt. legends, honestly 🫶

and that's the whole page bestie!! this one's from the FireHOL Reference, built 13 Apr 2025, and it lives at firehol(1) — version 3.1.8 if you were wondering. stay firewalled, stay fierce. 💜✨

📦 where this page comes from