firehol-protection(5)

📦
version 3.1.8 · 4 versions
, in debian trixie, ubuntu resolute, ubuntu stonking

💖 firehol-protection 💖

okay bestie, welcome to firehol-protection — that's section 5 of the FireHOL Reference, from the FireHOL fam (this build is version 3.1.8, built 13 Apr 2025, and yes we're gonna say bye to that at the bottom too, keep reading 🫶).

✨ NAME ✨

firehol-protection — adds extra protections to a definition 🛡️✨

🎀 SYNOPSIS 🎀

protection [reverse] strong [requests/period [burst]]

protection [reverse] flood-protection-type [requests/period [burst]]

protection [reverse] { bad-packets | packet-protection-type }

protection [reverse] connlimit connections [mask prefix]

protection [reverse] connrate rate [burst amount] [srcmask prefix]
[htable-size buckets] [htable-max entries] [htable-expire msec]
[htable-gcinterval msec]

🌸 DESCRIPTION 🌸

so the protection subcommand sets protection rules on an interface or a router. that's the whole vibe. it's giving bodyguard energy 💅

Flood protections honour the values requests/period and burst. they're the ones that limit the rate of certain types of traffic. lowkey essential.

the default rate FireHOL uses is 100 operations per second with a burst of 50. and if you want the deep lore, run iptables -m limit --help — go off, read the source of truth 📖

the protection type strong will switch on all protections (both packet and flood protections) except all-floods. it has the aliases full and all. iconic behaviour honestly.

the protection type bad-packets will switch on all packet protections but not flood protections. just the packet ones. no floods. okay?

you can specify multiple protection types by using multiple protection commands, or by using a single command and enclosing the types in quotes. (and pls do not forget those quotes, we'll get to that in KNOWN ISSUES 👀)

Note 📝 on a router, protections are normally set up on inface. the reverse option will set up the protections on outface. you must use it as the first keyword. first. keyword. no skipping the line 🚨

🦋 PACKET PROTECTION TYPES 🦋

  • bad-packets — drops all the bad packets detected by these rules. the whole squad of bad-packet rules, in one go.
  • invalid — drops all incoming invalid packets, as detected INVALID by the connection tracker. See also FIREHOL_DROP_INVALID in firehol-defaults.conf(5) which allows setting this function globally. 🌍
  • fragments — drops all packet fragments. real talk: this rule will probably never match anything, since iptables(8) reconstructs all packets automatically before the firewall rules are processed whenever connection tracking is running. so it's a lil decorative bestie, but we keep it 💀
  • new-tcp-w/o-syn — drops all TCP packets that initiate a socket but have not got the SYN flag set. rude packets, blocked 🚫
  • malformed-xmas — drops all TCP packets that have all TCP flags set. 🎄 (yes it's called xmas, no we don't make the rules)
  • malformed-null — drops all TCP packets that have all TCP flags unset. the void packets. gone.
  • malformed-bad — drops all TCP packets that have illegal combinations of TCP flags set. illegal combos? not on my watch 🔥

💫 EXAMPLES

protection bad-packets

🌈 FLOOD PROTECTION TYPES 🌈

  • icmp-floods [requests/period [burst]] — allows only a certain amount of ICMP echo requests. ping responsibly 🏓
  • syn-floods [requests/period [burst]] — allows only a certain amount of new TCP connections.
⚠️ be careful to not set the rate too low, because the rule is applied to all connections regardless of their final result (rejected, dropped, established, etc). too low = you're blocking your own friends 😭
  • all-floods [requests/period [burst]] — allows only a certain amount of new connections.
⚠️ same warning, same energy: be careful to not set the rate too low, as the rule is applied to all connections regardless of their final result (rejected, dropped, established, etc). fr fr.

💫 EXAMPLES

protection all-floods 90/sec 40

👑 CLIENT LIMITING TYPES 👑

these protections were added in v3. new-ish, still slaying ✨

they're used to limit the connections clients make, per interface or per router.

they support appending optional rule parameters to limit their scope to certain clients only. so you can be like "everyone gets this, except you specifically" — the way that works is so good.

  • protection [reverse] connlimit connections [mask prefix] — allow only a number of connections per client (implemented with connlimit with fixed type=saddr).
  • protection [reverse] connrate rate [burst amount] [srcmask prefix] [htable-size buckets] [htable-max entries] [htable-expire msec] [htable-gcinterval msec] — allow up to a rate of new connections per client (implemented with hashlimit with fixed type=upto and mode=srcip).

💫 EXAMPLES

limit the number of concurrent connections to 10 per client:

protection connlimit 10 mask 32

limit the number of concurrent connections to 100 per client class-C, and also limit it to 5 for 1.2.3.4:

protection connlimit 100 mask 24
protection connlimit 5 src 1.2.3.4

in the last example above, if you want to give client 1.2.3.4 more connections than all others, you should exclude it from the first connlimit statement, like this:

protection connlimit 100 mask 24 src not 1.2.3.4
protection connlimit 200 src 1.2.3.4

limit all clients to 10 concurrent connections and 60 connections/minute:

protection connlimit 10
protection connrate 60/minute

💀 KNOWN ISSUES 💀

  • when using multiple types in a single command, if the quotes are forgotten, incorrect rules will be generated without warning. no warning. nothing. it just does it. screaming.
  • when using multiple types in a single command, FireHOL will silently ignore any types that come after a group type (bad-packets, strong and its aliases). so: only use group types on their own line. periodt. 🙈

🫶 SEE ALSO 🫶

⭐ AUTHORS ⭐

FireHOL Team. 🧚 (they ate, ngl)

okay that's the whole page bestie, you're officially a protection girlie now 💅 FireHOL Reference, version 3.1.8, built 13 Apr 2025 — mwah, go protect some packets 🎀💖✨

📦 where this page comes from