FILTERGEN(8)

🌸 FILTERGEN(8) — packet filter compiler 🌸

okay bestie, welcome to the System Manager's Manual section for filtergen, the little compiler that could 💖 she eats your high-level filter language and spits out firewall rules. no cap.

✨ NAME ✨

filtergen — packet filter compiler 🧚

✨ SYNOPSIS ✨

filtergen [ -h | --help ] [ -V | --version ] [ -c | --compile ] [ -t target | --target=target ] [ -o outfile | --output=outfile ] infile

filtergen [ -h | --help ] [ -V | --version ] [ -c | --compile ] [ -t target | --target=target ] [ -o outfile | --output=outfile ] [ -F policy | --flush=policy ]

✨ DESCRIPTION ✨

filtergen compiles a high-level filtering description language into a variety of target formats. that's it. that's the vibe. 🦋

✨ USAGE ✨

filtergen reads the ruleset from the infile you give it on the command line (or from standard input if infile is -), and it outputs to standard output (or to outfile) via a backend that you can optionally pick. 👑

both short options and GNU-style long options are accepted, so pick whichever one your heart says:

• -c, --compile — only try to "compile" the input, and don't generate any output at all. this is lowkey the move when you wanna check that an input file has no syntax errors in it before you attempt to use the result on a live server. safety first bestie 🫶
• -t target-filter, --target=target-filter — if you specify it, target-filter gets used to select an output filter type. otherwise the default of iptables is used. the supported backends are iptables, ip6tables, iptables-restore, ip6tables-restore, ipchains, ipfilter and cisco (for Cisco IOS access-lists). pick your fighter 💅
• -F policy, --flush=policy — flush mode. generate a set of rules for clearing all rules from the packet filter. super useful for firewall scripts that need to shutdown the firewall. you can supply a policy argument in place of the usual filename, to specify whether the flushed filter should default to accept, reject, or drop. it defaults to accept, which is equivalent to having no filter loaded at all. and ngl, it is not necessary to specify an infile when using flush mode. periodt ✨
• -o outfile, --output=outfile — write output to outfile instead of standard output. redirecting but make it official 💖
• -h, --help — show command help. bestie needs a lil help sometimes 🥺
• -V, --version — show program version. the iconique origin story check 🌈

✨ BUGS ✨

• not all backends implement all features. 😭 it's giving "we're all doing our best".
• the packet filter is not optimised. 💀 no further comment.

✨ SEE ALSO ✨

fgadm(8), filter_syntax(5), filter_backends(7)

✨ AUTHOR ✨

filtergen was originally written by Matthew Kirkwood. then Jamie Wilkinson <jaq@spacepants.org> rewrote a lot of the internals, added some features, and took on maintenance of the project. main character energy fr fr 👑

and that's the whole page bestie 💖 dated January 7, 2004, from the System Manager's Manual — stay slaying those packets ✨🎀