fwbedit(1)

fwbedit(1) — yep, that's the page name, and it hangs out in the Firewall Builder corner of the man-page universe, right next to fwbuilder(1) 💅

💖 NAME 💖

fwbedit — general purpose object tree editing tool ✨

🎀 SYNOPSIS 🎀

fwbedit command [options]

🦋 DESCRIPTION 🦋

okay so. fwbedit is a general purpose object tree editing tool for Firewall Builder (peep fwbuilder(1) if you wanna know that whole situation 👀). It's the tool you call from shell scripts — the ones you write for batch-processing your Firewall Builder data files. Like, that's literally its whole thing, it was built for that.

Here's the vibe: fwbedit can do all of this to your objects and your tree —

• create a new object
• delete an existing object
• modify attributes of an object
• add a reference to the given object to a group
• remove a reference to an object from a group
• upgrade a data file
• check the object tree in the file and repair it if necessary

and both the object and the group can be defined either by their ID or by their name plus a full path in the tree (the EXAMPLES section way down below shows you exactly how, bestie 🫶).

---

🌸 COMMANDS AND OPTIONS 🌸

🆕 new

new -f file.fwb -t objtype -n name -p parent [-c comment] [-a attrs]

Creates a new object. Brand new, fresh out the box, main character energy 👑

• -f file.fwb — the data file
• -t objtype — create a new object of this type
• -p parent — create the new object as a child of this object. This parameter is mandatory. If you're adding an address to an interface, the corresponding interface object must be specified as the parent. Same deal going the other way: if you need to add an interface to a host or a firewall, the corresponding host or firewall object is the parent. And if you're adding an object to one of the standard folders, the parent is the library you want to add the object to, or the correct full path to the folder in the tree.
• -n name — the name of the new object
• -c txt — specify a comment for the new object
• -a attribute1[,attribute2...] — specify attributes that define parameters of the new object (the full tea is in the attributes section below 👇)

🗑️ delete

delete -f file.fwb -o object

Deletes the object specified by its full path in the tree, or by its object ID. gone. bye. 💀

• -f file.fwb — the data file
• -o object — object to be deleted, full path or ID

✏️ modify

modify -f file.fwb -o object -c comment [-a attrs]

Modifies the object specified by its full path in the tree, or by its object ID. Heads up though: an object can not be renamed using this operation. So like, glow-up yes, name change no 🙈

• -f file.fwb — the data file
• -o object — object to be deleted, full path or ID
• -c txt — specify a comment for the new object
• -a attribute1[,attribute2...] — specify attributes that define parameters of the new object (again, see below)

📋 list

list -f file.fwb -o object [-r|-c] [-d|-Fformat]

Prints the name and ID of an object. simple. iconic. 🌟

• -f file.fwb — the data file
• -o object — object to print, full path or ID
• -r — print the specified object and all objects under it in the tree
• -c — print only the children objects of the given object, but do not print the object itself
• -d — print a full dump of all of the object's attributes, including internal debugging information if it's available. this can be very verbose, no cap 😭
• -Fformat_string — the program recognizes macros in the format string and replaces them with the values of the corresponding object's attributes. A macro is the name of the attribute surrounded with %, such as %name% or %address%. Here's the list of some attribute names: "id", "name", "path", "comment", "type", "address", "netmask", "dnsname". TCP and UDP service objects provide the attributes "src_range_start", "src_range_end", "dst_range_start", "dst_range_end" for the source and destination port ranges. ICMP and ICMP6 service objects have the attributes "icmp_type" and "icmp_code".

➕ add

add -f file.fwb -g group -o object

Adds the object specified by path or ID to a group, which is also specified by its path or ID.

• -f file.fwb — the data file
• -g group — group the object should be added to, full path or ID
• -o object — object to be deleted, full path or ID

➖ remove

remove -f file.fwb -g group -o object

Removes an object from a group. it's giving "we don't do that here anymore" 💅

• -f file.fwb — the data file
• -g group — group the object should be removed from, full path or ID
• -o object — object to be deleted, full path or ID

⬆️ upgrade

upgrade -f file.fwb

Upgrades the data file to the latest data format version. yes bestie, we're updating ✨

• -f file.fwb — the data file

🩺 checktree

checktree -f file.fwb

Checks the consistency and correctness of the object tree in the given data file, and repairs it if necessary. it's giving wellness check + therapy 🧚

• -f file.fwb — the data file

🔀 merge

merge -f file1.fwb -i file2.fwb

Objects from file2.fwb are merged with the objects in file1, and the combined object tree is saved in file1.fwb.

• -f file.fwb — data file #1
• -i file.fwb — data file #2

📥 import

import -f file1.fwb -i firewall_config.txt -o path_to_firewall_object [-d]

The firewall configuration from the file firewall_config.txt is parsed and imported into the data file file1.fwb. The program creates a new firewall object located in the library, with the name defined by its path, path_to_firewall_object.

• -f file.fwb — data file #1
• -i config.txt — firewall configuration file
• -o object_path — full path to the firewall object that will be created. This has to be a full path, beginning with the library name, such as "/User/Firewalls/my_new_firewall"
• -d — avoid creating duplicate objects on import

currently (as of v4.2.0) fwbuilder supports import of iptables configuration saved with the iptables-save command, as well as import of Cisco router IOS configuration, and Cisco PIX, ASA and FWSM firewalls saved with the "show run" command.

---

🎀 ATTRIBUTES FOR THE NEW OBJECTS, BY TYPE 🎀

here's the cheat sheet for what -a wants depending on your -t 🌈

• -t Firewall -a platform, host OS
• -t IPv4 -a IP address [,netmask]
• -t IPv6 -a IPv6 address [,masklen]
• -t DNSName -a DNS record,run time
• -t AddressRange -a start address, end address
• -t ObjectGroup
• -t Network -a address,netmask
• -t NetworkIPv6 -a ipv6_address,netmask_length
• -t Interval -a start time,start date,start day,end time, end date, end day
• -t Interface -a security level,address type (dynamic or unnumbered),management
• -t Host
• -t TCPService -a source port range start,end,destination port range start,end,UAPRSF,UAPRSF
• -t UDPService -a source port range start,end,Destination port range start,end
• -t ICMPService -a ICMP type,ICMP code
• -t IPService -a protocol number,lsrr/ssrr/rr/ts/fragm/short_fragm

---

👑 EXAMPLES 👑

okay this is the fun part, let's actually use the thing 🍓

Print the contents of the object /User/Firewalls/firewall/eth0 according to the provided format. Note that an object of the type "Interface" does not have an attribute that would define its address — an IP address is defined by its child object of the type IPv4 or IPv6.

fwbedit list -f x.fwb  -o /User/Firewalls/firewall/eth0 -F "type=%type% name=%name% id=%id% %comment%"

Print the contents of the object /User/Firewalls/firewall/eth0 and all its child objects. This is the way to see addresses and netmasks. An interface object does not have an attribute "address", so the program ignores the macro "%address%" when it prints an interface.

fwbedit list -f x.fwb  -o /User/Firewalls/firewall/eth0 -F "type=%type% name=%name% id=%id% %comment% %address%" -r

Print the group object /User/Objects/Addresses:

fwbedit list -f x.fwb  -o /User/Objects/Addresses -F "type=%type% name=%name% id=%id% %comment%"

Print the group object /User/Objects/Addresses and all address objects inside of it:

fwbedit list -f x.fwb  -o /User/Objects/Addresses -F "type=%type% name=%name% id=%id% %comment%" -r

Print the address objects inside the group /User/Objects/Addresses but do not print the group object itself:

fwbedit list -f x.fwb  -o /User/Objects/Addresses -F "type=%type% name=%name% id=%id% %comment%" -c

Print addresses and netmasks of all interfaces of all firewalls, in the form of their full object tree path, followed by the type, id, address and netmask:

fwbedit list -f x.fwb  -o /User/Firewalls -F "%path% %type% %id% %address% %netmask%" -r | grep IP

Print names, platform and version information for all firewall objects defined in the data file:

fwbedit list -f x.fwb  -o /User/Firewalls -F "%name% platform: %platform% version:  %version%" -c

Print name, source and destination port ranges for all TCP services in the folder TCP of the user-defined group User:

fwbedit list -f x.fwb  -o /User/Services/TCP -c -F "name='%name%' est=%established%  %src_range_start%-%src_range_end% : %dst_range_start%-%dst_range_end%"

Print icmp type and code for all ICMP services in the folder ICMP of the user-defined group User:

fwbedit list -f x.fwb  -o /User/Services/ICMP -c -F "name='%name%' icmp_type=%icmp_type% icmp_code=%icmp_code%"

Add an IPv6 address to one of the interfaces of the firewall object "firewall":

fwbedit new  -f x.fwb -p /User/Firewalls/firewall/eth3 -t IPv6 -n eth3-v6-addr -a 2001:470:1f05:590::2,64

Add a reference to the Host object 'A' to the group 'B':

fwbedit add -f x.fwb -g /User/Objects/Groups/B -o /User/Objects/Hosts/A

Add a reference to the object with ID id3D71A1BA to the group with ID id3D151943. If objects with the given IDs don't exist, fwbedit prints an error message and does not make any changes in the data file.

fwbedit add -f x.fwb -o id3D71A1BA -g id3D151943

Add a reference to the object with ID id3D71A1BA to the group 'testgroup':

fwbedit add -f x.fwb -o id3D71A1BA -g /User/Objects/Groups/testgroup

The following script uses the fwbedit "list" command to print the IDs of all Address objects in the folder /User/Objects/Addresses, then cycles through the obtained list and uses fwbedit to add them to the group "group1".

  fwbedit list -f x.fwb -o /User/Objects/Addresses -F "%id%" -c  | \
    while read id; do \
      fwbedit add -f x.fwb -g /User/Objects/Groups/group1 -o $id; \
    done

Here's a slightly more complex example. The following script uses the fwbedit "list" command to print the types and IDs of all Address objects in the folder /User/Objects/Addresses, then filters them using grep to get only IPv6 objects, and finally cycles through the obtained list and uses fwbedit to add them to the group "group1".

  fwbedit list -f x.fwb  -o /User/Objects/Addresses -F "%type% %id%" -c | \
    grep IPv6 | \
    while read type id; do \
      fwbedit add -f x.fwb  -g /User/Objects/Groups/group1 -o $id; \
    done

🌈 URL

Okay bestie, need the mothership? The Firewall Builder home page lives right here:

http://www.fwbuilder.org/

That's the whole vibe. Go say hi. 💖

---

🐛 BUGS

Found a bug? Do not suffer in silence, babe, that's not the move. Please report bugs using the bug tracking system on SourceForge:

http://sourceforge.net/tracker/?group_id=5314&atid=105314

That's literally it. Drop the bug, tell the devs, let them cook. 🙈✨

---

👀 SEE ALSO

• fwbuilder(1)

Your other bestie. Go read that one too, iykyk. 🫶

---

okay that's the whole page, you made it, you're literally the main character of firewall config 💅

This one came from the FWB crew, and it's fwbedit(1) — section 1, the classic. The footer's got the source/version tag and the date stamped on it, so if you're reading this in a terminal somewhere, check the bottom line for the receipts. 🎀

stay slay, stay firewalled, bye bestie 🌸🦋