ARNO-IPTABLES-FIREWALL(8)

📦
version 2.1.2a · 2 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 ARNO-IPTABLES-FIREWALL 💖

okay bestie, gather round, because we're talking about arno-iptables-firewall — that's the AIF Manual page, section 8 of your friendly neighbourhood manual set. it's a single- & multi-homed firewall script with DSL/ADSL support. yes, DSL. yes, ADSL. the ancestors were cooking fr fr. 🫶

✨ SYNOPSIS ✨

arno-iptables-firewall start | restart | force-reload | stop | stop-block | status | status-plugins | check-conf

that's the whole vibe check. pick a command, run it, firewall does the thing. 💅

🌸 DESCRIPTION 🌸

so, arno-iptables-firewall is an iptables configuration script that supports both IPv4 & IPv6. periodt. 🌈

ngl though, you should not just call it directly. like, technically you can, but the correct move is to invoke it through one of these, depending on which init system your machine is running:

  • /etc/init.d/arno-iptables-firewall
  • systemctl COMMAND arno-iptables-firewall.service

and here's the iconic part — it is extremely easy to set up a basic firewall, but you can also configure it to meet quite complex requirements. so it's giving beginner-friendly AND main-character-level-deep. obsessed. 👑

all the available options are explained in the extensively documented configuration file. (yes bestie, read the config. it's literally a whole novel of options. 🎀)

as a bare minimum, the external interface of the system needs to be set up properly in the firewall's configuration — that's EXT_IF for the uninitiated. and the default behaviour of the firewall? deny all incoming connections. 🛡️ iconic. protective. no notes.

instead of editing the main configuration file (which is lowkey a crime against maintainability), it is recommended to put configuration snippets into .conf files, and drop those into the configuration directory. the way that works: these get sourced after the main configuration file has been read, so they can be used to override previous (default) configurations. override queen energy. 💅✨

now, for additional requirements that the configuration file doesn't cover — and that configuration snippets can't cover either — you can put custom iptables rules in a custom rules file. this file is automatically parsed by the service script. no cap. 🔥

logs get written to a dedicated log file if rsyslogd is in use. and if you want those logs to be actually readable by humans? there's a script for that: arno-fwfilter, which can be used to make the firewall logs more readable for humans (see the manpage, bestie, it's right there). 🙈

and finally — there are several plugins implementing advanced features that come with the firewall script. each of them brings its own configuration file, which you'll find in the plugins configuration directory. so many little babies. so many configs. 🧚

🎀 FILES 🎀

  • /etc/arno-iptables-firewall/firewall.conf — the main configuration file. the big one. the moment. ⭐
  • /etc/arno-iptables-firewall/conf.d/ — the firewall configuration directory. drop your .conf snippets here, bestie. 💖
  • /etc/arno-iptables-firewall/plugins/ — the plugins configuration directory. where all the plugin configs live. 🦋
  • /etc/arno-iptables-firewall/custom-rules — the custom iptables rules file. for when you need to go off-script. 🔥
  • /etc/arno-iptables-firewall/blocked-hosts — host blacklist. ⚠️ heads up: this file does not pre-exist, and its use is disabled in the main configuration file by default. so don't go looking for it and panicking. it's not there. it's fine. 💀
  • /var/log/arno-iptables-firewall — the log file, maintained by rsyslogd. 🌸

🌈 SEE ALSO 🌈

go read them. iykyk. 📚💜

👑 AUTHORS 👑

arno-iptables-firewall was written by Arno van Amersfoort <arnova@rocky.eld.leidenuniv.nl> and Lonnie Abelbeck <lonnie@abelbeck.com>. legends, honestly. 🫶

this manual page was initially written by Michael Hanke <michael.hanke@gmail.com> and has been reworked by Sven Geuer <debmaint@g-e-u-e-r.de>, for the Debian project (but may be used by others). shoutout Debian. 💖

and that's the page, bestie!! this lil beauty dropped as part of the AIF Manual, dated 2020-03-25, and it was Sven Geuer who signed off on it. go forth and firewall. slay. 💅✨

📦 where this page comes from