firehol-router(5)

📦
version 3.1.8 · 4 versions
, in debian trixie, ubuntu resolute, ubuntu stonking

💖 firehol-router 💖

okay bestie, we're doing firehol-router from the FireHOL manual (section 5, the big reference one) ✨ this is the page that teaches you how to make a router definition, and honestly? it's giving main character energy. let's get into it 🫶

✨ NAME ✨

firehol-router — create a router definition 🌈

🎀 SYNOPSIS 🎀

{ router | router46 } name rule-params

router4 name rule-params

router6 name rule-params

💅 DESCRIPTION 💅

so a router definition is literally just a set of rules for traffic that's passing through the host running the firewall. not traffic going to the box itself — traffic going through it. iykyk 🦋

the default policy for router definitions is RETURN, which means packets do not get dropped by any particular router. but heads up: packets that aren't matched by any router get dropped at the end of the firewall. so it's not a free pass, it's just "next please" 😌

the behaviour of the router you defined is controlled by adding subcommands from the ones listed down in ROUTER SUBCOMMANDS 👑

Note 📌 writing router4 is equivalent to writing ipv4 router, and it ensures the defined router is created only in the IPv4 firewall, along with any rules within it. writing router6 is equivalent to writing ipv6 router, and it ensures the defined router is created only in the IPv6 firewall, along with any rules within it. writing router46 is equivalent to writing both router, and it ensures the defined router is created in both the IPv4 and IPv6 firewalls. any rules within it will also be applied to both, unless they specify otherwise. 💫

🌸 PARAMETERS 🌸

  • name — this is a name for this router. you should use short names (10 characters maximum, bestie, don't go feral) without spaces or other symbols. a name should be unique for all FireHOL interface and router definitions. no name-stealing in this house 🚫
  • rule-params — the set of rule parameters that further restrict the traffic that is matched to this router. see firehol-params(5) for info on the parameters that can be used. some examples:
router mylan inface ppp+ outface eth0 src not ${UNROUTABLE_IPS}

router myrouter

see firehol.conf(5) for an explanation of ${UNROUTABLE_IPS}. 💖

🦋 WORKING WITH ROUTERS 🦋

routers create stateful iptables(8) rules which match traffic in both directions. both ways, no cap 👀

to match some client or server traffic, the input/output interface or source/destination of the request must be specified. all inface/outface and src/dst firehol-params(5) can be given on the router statement itself — in which case they'll be applied to all subcommands for the router — or just within the subcommands of the router. your call, queen 👑

for example, to define a router which matches requests from any PPP interface and destined for eth0, and on this allowing HTTP servers (on eth0) to be accessed by clients (from PPP) and SMTP clients (from eth0) to access any servers (on PPP):

router mylan inface ppp+ outface eth0
  server http accept
  client smtp accept
Note 📌 the client subcommand reverses any optional rule parameters passed to the router — in this case the inface and outface. sneaky little flip, love that for it 🔄

equivalently, to define a router which matches all forwarded traffic and within the the router allow HTTP servers on eth0 to be accessible to PPP and any SMTP servers on PPP to be accessible from eth0:

router mylan
  server http accept inface ppp+ outface eth0
  server smtp accept inface eth0 outface ppp
Note 📌 in this instance two server subcommands are used since there are no parameters on the router to reverse. avoid the use of the client subcommand in routers unless the inputs and outputs are defined as part of the router. fr fr, just don't do it 🙈

any number of routers can be defined and the traffic they match can overlap. since the default policy is RETURN, any traffic that is not matched by any rules in one will proceed to the next, in order, until none are left. it's a little relay race and the vibes are immaculate 🏃♀️✨

⭐ SEE ALSO ⭐

👑 Router Subcommands 👑

💜 AUTHORS 💜

FireHOL Team. (genuinely iconic of them 🫶)

okay that's the whole page, you ate that 💅 this was the FireHOL Reference, version 3.1.8, built 13 Apr 2025, and it's still firehol-router(5) — go forth and route responsibly, bestie 🎀✨

📦 where this page comes from