firehol-actions(5)

📦
version 3.1.8 · 4 versions
, in debian trixie, ubuntu resolute, ubuntu stonking

💖 firehol-actions(5) 💖

part of the FireHOL family — version 3.1.8, manual page firehol-actions(5)

✨ NAME ✨

firehol-actions — the actions you can put on rules, bestie 💅

🎀 SYNOPSIS 🎀

accept

accept with hashlimit name upto|above amount/period [burst amount] [mode
{srcip|srcport|dstip|dstport},...] [srcmask prefix] [dstmask prefix]
[htable-size buckets] [htable-max entries] [htable-expire msec]
[htable-gcinterval msec]

accept with connlimit upto|above limit [mask mask] [saddr|daddr]

accept with limit requests/period burst [overflow action]

accept with recent name seconds hits

accept with knock name

reject [with message]

drop | deny

return

tarpit

🌸 DESCRIPTION 🌸

okay so bestie, these are the actions — the thing that actually happens to traffic once a rule has matched it. Like, the rule is the vibe check, and the action is what you do about it 💅

FireHOL will also happily pass through any action that iptables(8) accepts, no gatekeeping. But these definitions here give you lowercase versions that take arguments where it makes sense — and that you couldn't pass through otherwise. iconic behavior tbh.

Note — the iptables(8) LOG action is best used through the optional rule parameter log, because that one can be combined with one of these actions (FireHOL will generate multiple firewall rules to make it happen, it's giving multitasking ✨). For more info, go look at log and loglimit.

The following actions are defined, and yes we're going through all of them, no skipping 🫶

🍓 accept

accept lets the traffic that matched the rules reach its destination. periodt.

For example, to allow SMTP requests and their replies to flow:

server smtp accept

💜 accept with hashlimit name upto|above amount/period [burst amount] [mode {srcip|srcport|dstip|dstport},...] [srcmask prefix] [dstmask prefix] [htable-size buckets] [htable-max entries] [htable-expire msec] [htable-gcinterval msec]

hashlimit uses hash buckets to express a rate limiting match (like the limit match) for a group of connections using a single iptables rule. The grouping can be per-hostgroup (source and/or destination address) and/or per-port. so efficient, so main character ✨

  • name — the name for the /proc/net/ipt_hashlimit/name entry.
  • upto amount[/second|/minute|/hour|/day] — match if the rate is below or equal to amount/quantum. You write it either as a plain number, with an optional time quantum suffix (default is 3/hour).
  • above amount[/second|/minute|/hour|/day] — match if the rate is above amount/quantum.
  • burst amount — maximum initial number of packets to match. This number gets recharged by one every time the limit specified above is not reached, up to this number; default is 5. ⚠️ Use this option with caution — if the entry expires, the burst value is reset too.
  • mode {srcip|srcport|dstip|dstport},... — a comma-separated list of objects to take into consideration. If no mode option is given, srcip,dstport is assumed.
  • srcmask prefix — when –hashlimit-mode srcip is used, all source addresses encountered will be grouped according to the given prefix length, and the so-created subnet will be subject to hashlimit. prefix must be between (inclusive) 0 and 32. Note that srcmask 0 is basically doing the same thing as not specifying srcip for mode, but is technically more expensive 💀
  • dstmask prefix — like srcmask, but for destination addresses.
  • htable-size buckets — the number of buckets of the hash table.
  • htable-max entries — maximum entries in the hash.
  • htable-expire msec — after how many milliseconds do hash entries expire.
  • htable-gcinterval msec — how many milliseconds between garbage collection intervals.

Examples:

Allow up to 5 connections per second per client to SMTP server:

server smtp accept with hashlimit smtplimit upto 5/s

You can monitor it using the file /proc/net/ipt_hashlimit/smtplimit 👀

🦋 accept with connlimit upto|above limit [mask mask] [saddr|daddr]

accept with connlimit matches on the number of connections per IP.

  • saddr — matches on source IP.
  • daddr — matches on destination IP.
  • mask — groups IPs with the mask given.
  • upto — matches when the number of connections is up to the given limit.
  • above — matches when the number of connections is above the given limit.

okay important thing bestie: the number of connections counted are system wide, not service specific. So for example with saddr, you cannot connlimit 2 connections for SSH and 4 for SMTP. If you connlimit 2 connections for SSH, then the first 2 connections of a client can be SSH. But if a client already has 2 connections to another service, that client will not be able to connect to SSH. it's giving shared budget 😭

So, connlimit can safely be used:

  • with daddr to limit the connections a server can accept
  • with saddr to limit the total connections per client to all services

🌈 accept with limit requests/period burst [overflow action]

accept with limit allows the traffic, with new connections limited to requests/period with a maximum burst. Run iptables -m limit --help for more information.

The default overflow action is to REJECT the excess connections (DROP would produce timeouts on otherwise valid service clients). slay 🫶

Examples:

server smtp accept with limit 10/sec 100

server smtp accept with limit 10/sec 100 overflow drop

⭐ accept with recent name seconds hits

accept with recent allows the traffic matching the rules to reach its destination, limited per remote IP to hits per seconds. Run iptables -m recent --help for more information.

The name parameter is used to allow multiple rules to share the same table of recent IPs. cute, they share 💜

For example, to allow only 2 connections every 60 seconds per remote IP, to the smtp server:

server smtp accept with recent mail 60 2
Note — when a new connection is not allowed, the traffic will continue to be matched by the rest of the firewall. In other words, if the traffic is not allowed due to the limitations set here, it is not dropped, it is just not matched by this rule. no hard feelings, just not this rule's business 💅

🔥 accept with knock name

accept with knock allows easy integration with knockd, a server that allows you to control access to services by sending certain packets to "knock" on the door, before the door is opened for service. literally knocking, how iconic 🚪✨

The name is used to build a special chain knock_<name> which contains rules to allow established connections to work. If knockd has not allowed new connections, any traffic entering this chain will just return back and continue to match against the other rules until the end of the firewall.

For example, to allow HTTPS requests based on a knock write:

server https accept with knock hidden

then configure knockd to enable the HTTPS service with:

iptables -A knock_hidden -s %IP% -j ACCEPT

and disable it with:

iptables -D knock_hidden -s %IP% -j ACCEPT

You can use the same knock name in more than one FireHOL rule to enable/disable all the services based on a single knockd configuration entry. efficiency queen 👑

Note — there is no need to match anything other than the IP in knockd. FireHOL already matches everything else needed for its rules to work.

🎀 reject

reject discards the traffic matching the rules and sends a rejecting message back to the sender. not a silent treatment girlie, she tells them 💅

💖 reject with message

When used with with the specific message to return can be specified. Run iptables -j REJECT --help for a list of the --reject-with values which can be used for message. See REJECT WITH MESSAGES for some examples.

The default (no message specified) is to send tcp-reset when dealing with TCP connections and icmp-port-unreachable for all other protocols.

For example:

UNMATCHED_INPUT_POLICY="reject with host-prohib"

policy reject with host-unreach

server ident reject with tcp-reset

🧚 drop; deny

drop discards the traffic matching the rules. It does so silently and the sender will need to timeout to conclude it cannot reach the service. ghosting, but make it networking 😭

deny is a synonym for drop. For example, either of these would silently discard SMTP traffic:

server smtp drop

server smtp deny

💫 return

return will return the flow of processing to the parent of the current command.

Currently, the only time return can be used meaningfully used is as a policy for an interface definition. Unmatched traffic will continue being processed with the possibility of being matched by a later definition. For example:

policy return

🕸️ tarpit

tarpit captures and holds incoming TCP connections open. it's giving trap, but politely ✨

Connections are accepted and immediately switched to the persist state (0 byte window), in which the remote side stops sending data and asks to continue every 60-240 seconds.

Attempts to close the connection are ignored, forcing the remote side to time out the connection after 12-24 minutes. brutal. obsessed. 💅

Example:

server smtp tarpit
Note — as the kernel conntrack modules are always loaded by FireHOL, some per-connection resources will be consumed. See this bug report for details.

The following actions also exist but should not be used under normal circumstances. like, they're in the group chat but they're muted 🔇

💀 mirror

mirror returns the traffic it receives by switching the source and destination fields. REJECT will be used for traffic generated by the local host.

Warning — the MIRROR target was removed from the Linux kernel due to its security implications. MIRROR is dangerous; use it with care and only if you understand what you are doing. no cap, this one is not a vibe.

🙈 redirect; redirect to-port port

redirect is used internally by FireHOL helper commands.

Only FireHOL developers should need to use this action directly. iykyk 🤫

💌 REJECT WITH MESSAGES 💌

ok bestie, before we get into the individual messages, here's the reading list — these are the RFCs that actually have the tea on all of this. No cap, they're the receipts:

icmp-net-unreachable</p>; net-unreach</p>

ICMP network unreachable 💀

A router generates this one when there's no forwarding path (aka no route) to the destination network. Like, it literally cannot find the way there.

Straight from RFC 1812, section 5.2.7.1. See RFC 1812 and RFC 792.

⚠️ Use with care. The sender — and every router chilling between you and the sender — may conclude that the entire network your host lives in is unreachable, and then just... stop other traffic from reaching you. Not the vibe. 🙈

icmp-host-unreachable</p>; host-unreach

ICMP host unreachable 😭

A router sends this when there's no forwarding path (route) to the destination host on a directly connected network — basically the host isn't answering ARP.

From RFC 1812, section 5.2.7.1. See RFC 1812 and RFC 792.

⚠️ Use with care. The sender and the routers in between may decide your host is entirely unreachable and block other traffic from getting to you. So like... proceed with caution, bestie.

icmp-proto-unreachable</p>; proto-unreach

ICMP protocol unreachable ✨

Generated if the transport protocol named in a datagram isn't supported in the transport layer of the final destination. So the destination is like "girl, I don't speak that protocol." 💅

From RFC 1812, section 5.2.7.1. See RFC 1812 and RFC 792.

icmp-port-unreachable</p>; port-unreach

ICMP port unreachable 🎀

Generated if the designated transport protocol (e.g. TCP, UDP, etc.) can't demultiplex the datagram in the transport layer of the final destination — and it has no protocol mechanism to tell the sender about it. So it just throws this message instead.

From RFC 1812, section 5.2.7.1. See RFC 1812 and RFC 792.

Hosts also generate this one to say that the required port is not active. Iconic behaviour honestly. 🔥

icmp-net-prohibited</p>; net-prohib

ICMP communication with destination network administratively prohibited 🚫

This code was originally intended for end-to-end encryption devices used by U.S. military agencies. Routers SHOULD use the newly defined Code 13 (Communication Administratively Prohibited) if they administratively filter packets. So yeah, this one's a lil vintage.

From RFC 1812, section 5.2.7.1. See RFC 1812 and RFC 1122.

⚠️ This message may not be widely understood. So don't be shocked if nobody gets it. 💀

icmp-host-prohibited</p>; host-prohib

ICMP communication with destination host administratively prohibited 🚫

Same situation as above, bestie — this code was intended for end-to-end encryption devices used by U.S. military agencies, and routers SHOULD use the newly defined Code 13 (Communication Administratively Prohibited) if they administratively filter packets.

From RFC 1812, section 5.2.7.1. See RFC 1812 and RFC 1122.

⚠️ This message may not be widely understood. It's giving "iykyk" but nobody knows. 😭

tcp-reset

TCP RST 🧚

The port unreachable message of the TCP stack. She's the TCP version of "nobody's home."

See RFC 1122.

💡 tcp-reset is useful when you want to prevent timeouts on rejected TCP services where the client incorrectly ignores ICMP port unreachable messages. So if the client is out here ignoring ICMP like it's spam mail, this is your girl. Periodt. 👑

🌈 SEE ALSO 🌈

🫶 AUTHORS 🫶

FireHOL Team. (the icons behind all of this 💖)

and that's a wrap, bestie!! 🎀✨ this whole page is from the FireHOL Reference, and the version you just read was Built 13 Apr 2025 — it's firehol-actions(5), go forth and firewall responsibly 💅🦋🌸

📦 where this page comes from