firehol-interface(5)

📦
version 3.1.8 · 4 versions
, in debian trixie, ubuntu resolute, ubuntu stonking

💅 firehol-interface — interface definition 💅

okay bestie, so this is firehol-interface from the firehol-interface(5) manual, and it's literally the blueprint for locking down the actual machine you're sitting on. let's get into it 🫶

✨ NAME ✨

firehol-interface — interface definition

🌸 SYNOPSIS 🌸

{ interface | interface46 } real-interface name rule-params

interface4 real-interface name rule-params

interface6 real-interface name rule-params

🦋 DESCRIPTION 🦋

so when you write an interface definition, you're building a firewall that protects the host the firewall is running on. like, this exact box. main character energy for real. 👑

the default policy is DROP, which means if you give it no subcommands at all, the firewall is just gonna drop every single incoming and outgoing packet using this interface. no cap. silence. nothing gets through. 💀

what your interface actually does is controlled by adding subcommands from the ones listed down in INTERFACE SUBCOMMANDS.

Note — forwarded traffic is never matched by interface rules, even if it was originally headed for the firewall itself and got redirected using NAT. any traffic that needs to pass through the firewall for literally any reason has to live in a router instead (peep firehol-router(5)). 🚧
Note — writing interface4 is the same thing as writing ipv4 interface, and it makes sure the interface you defined gets created only in the IPv4 firewall, along with any rules inside it. ✨
Note — writing interface6 is the same as writing ipv6 interface, and it makes sure the interface you defined gets created only in the IPv6 firewall, along with any rules inside it. ✨
Note — writing interface46 is the same as writing both interface and... it makes sure the defined interface gets created in both the IPv4 and IPv6 firewalls. any rules inside it get applied to both too, unless they say otherwise. double the slay, double the firewall 💖

🎀 PARAMETERS 🎀

  • real-interface — this is the interface name exactly like ip link show shows it to you. generally, anything iptables(8) accepts is valid here. 👀

the + (plus sign) after some text will match all interfaces that start with that text. so eth+ is giving "every eth, bestie".

you can also specify multiple interfaces by wrapping them in quotes and delimiting with spaces, like this:

interface "eth0 eth1 ppp0" myname
  • name — this is the name for your interface. keep it short, bestie: 10 characters maximum, no spaces, no weird symbols. 🎀

a name should be unique across all FireHOL interface and router definitions. no name-stealing allowed. 🙅♀️

  • rule-params — the set of rule parameters that further restrict which traffic gets matched to this interface.

head over to firehol-params(5) for the full rundown on what params you can use. some examples:

interface eth0 intranet src 192.0.2.0/24

interface eth0 internet src not "${UNROUTABLE_IPS}"

and if you're like "wait what is ${UNROUTABLE_IPS}", firehol.conf(5) explains it. iykyk 💜

🌈 SEE ALSO 🌈

⭐ Interface Subcommands ⭐

👑 AUTHORS 👑

FireHOL Team. absolute icons, fr fr 🫶

and that's the whole page bestie, no crumbs left 💅 this was FireHOL Reference, built 13 Apr 2025 — mwah, go secure that host. 🌸✨

📦 where this page comes from