firehol-cthelper(5)

💖 firehol-cthelper — the manual page, but make it a group chat 💖

okay bestie, sit down, hydrate, because today we're talking about firehol-cthelper — that's the section 5 page from the FireHOL Reference, version 3.1.8. it's all about connection tracking helpers and honestly? it's giving ✨ control freak ✨ in the best way.

---

🎀 NAME 🎀

firehol-cthelper — control connection tracking helpers 💅

---

🌸 SYNOPSIS 🌸

{ cthelper | cthelper4 | cthelper6 } protocol helper where [rule-params]

that's the whole vibe. three possible command names, then a protocol, then a helper, then a where, then optionally some rule params. periodt. 💖

---

✨ DESCRIPTION ✨

okay so. the netfilter team (love them, no notes) put protocol helpers into the Linux kernel. what do they do? they sit there and monitor traffic so that certain protocols can actually function under the connection tracker. it's giving surveillance but make it helpful 🦋

here's the full list of protocol helpers they've provided:

• amanda
• ftp
• tftp (cannot be configured 🙈)
• h323 (cannot be configured 🙈)
• irc (does not support IPv6)
• netbios_ns (cannot be configured 🙈)
• pptp (does not support IPv6)
• gre (cannot be configured 🙈)
• sane
• sip

🚨 vibe check, and it's a bad one: by default, the helpers will trust either side of the communication. this is considered a security issue and should be avoided. like, genuinely. do not let it slide. 😭

so, using cthelper, the helpers that can be configured can be told to trust one specific side of the communication. main character energy: you decide, not the kernel. 👑

but before you do any of that, the variable FIREHOL_CONNTRACK_HELPERS_ASSIGNMENT should be set to manual. don't skip this step bestie, it's literally the whole setup. 💅

---

🌈 the where argument 🌈

where defines where the trusted traffic is expected. it can be:

• IN, INPUT, or PREROUTING — to match incoming packets
• OUT, OUTPUT — to match outgoing packets
• BOTH, BIDIRECTIONAL, or INOUT — to match all packets

---

🧚 about rule-params 🧚

the rule-params define a set of rule parameters to further restrict the traffic that is matched. see firehol-params(5) for more details. iykyk 🫶

---

🔥 FIREHOL_CONNTRACK_HELPERS_ASSIGNMENT values 🔥

this variable accepts the following values:

• kernel — which is the default, and it allows the kernel to determine by itself which side to trust. letting the algorithm cook, basically. 💀
• firehol — to have FireHOL automatically generate cthelper statements, keeping src, dst, inface and outface from the statements that require each helper.

⚠️ keep in mind this will only generate valid statements if you don't use NAT at all. cthelper statements are executed by iptables before any NAT is applied, while packet filtering is configured after DNAT and before SNAT — resulting in wrong statements when NAT is applied. not a vibe. not even a little bit. 😭

• manual — to use the cthelper helper to configure the trusts in firehol.conf. this is your "i'll do it myself" era. 💅

and the little plot twist: when set to kernel, FireHOL will set net.netfilter.nf_conntrack_helper=1. in all other cases, FireHOL will set net.netfilter.nf_conntrack_helper=0. slay, that's just how it is. ⭐

---

🍓 EXAMPLES 🍓

here's the snack platter, verbatim, don't touch a single character:

# enable manual protocol helpers mode
FIREHOL_CONNTRACK_HELPERS_ASSIGNMENT="manual"

# trust SIP packets we send via interface dsl0
cthelper sip out outface dsl0

# trust SIP packets we receive from 10.0.0.1 via eth0
cthelper sip in inface eth0 src 10.0.0.1

# trust pptp packets we send via interface wan0 (IPv4 only)
cthelper4 pptp out outface wan0

obsessed. ate. no crumbs. 🎀

---

👑 SEE ALSO 👑

go read these next, bestie, they're the extended universe:

• firehol(1) — FireHOL program
• firehol.conf(5) — FireHOL configuration
• FireHOL Website
• FireHOL Online PDF Manual
• FireHOL Online Documentation

---

💜 AUTHORS 💜

FireHOL Team. legends, honestly. 🫶

---

and that's the whole page!! this was the FireHOL Reference edition, version 3.1.8, built 13 Apr 2025 — shoutout to the firehol-cthelper(5) manual for the lore. stay tracked, stay trusted on the right side only, and never let NAT catch you slippin' 💖✨🎀🦋🌸💅🫶👑