PYROMAN(8)

💖 PYROMAN(8) 💖

okay so bestie, welcome to pyroman — it's a firewall configuration utility, and it lives in the System Manager's Manual. sit down, grab a boba, we're gonna set up IP packet filtering together and it's gonna be iconic 💅

---

✨ SYNOPSIS ✨

pyroman
       [ -hvnspP ] [ -r RULESDIR ] [ -t SECONDS ]
       [ --help ] [ --version ] [ --safe ] [ --no-act ]
       [ --print ] [ --print-verbose ] [ --rules=RULESDIR ]
       [ --timeout=SECONDS ] [ safe ]

---

🦋 DESCRIPTION 🦋

pyroman is a firewall configuration utility, periodt.

The way that it works is: it compiles a whole set of configuration files into iptables statements, so it can set up IP packet filtering for you. no cap, it just does it. 🫶

ngl, you can operate and use Pyroman without this, but bestie... you should really already understand how IP, TCP, UDP, ICMP and the other commonly used Internet protocols work and interact. and you should also have the basics of iptables down, otherwise you can't use the full functionality. it's giving "read the room first" 😭

here's the vibe though: pyroman does not try to hide all the iptables complexity from you. instead it tries to give you a convenient way of managing a complex network's firewall. for that, it offers a compact syntax to add new firewall rules, while still exposing access to add arbitrary iptables rules. best of both worlds fr fr 👑

---

🌸 OPTIONS 🌸

• -r RULESDIR, --rules=RULES — load the rules from directory RULESDIR instead of the default directory (usually /etc/pyroman) 📂
• -t SECONDS, --timeout=SECONDS — wait SECONDS seconds after applying the changes for the user to type OK to confirm he can still access the firewall. this implies --safe, but it lets you use a different timeout. ⏳
• -h, --help — print a summary of the command line options and exit. classic. ✨
• -V, --version — print the version number of pyroman and exit. 💜
• -s, --safe, safe — when the firewall was committed, wait 30 seconds for the user to type OK to confirm that he can still access the firewall (i.e. the network connection wasn't blocked by the firewall). otherwise, the firewall changes will be undone, and the firewall will be restored to the previous state. use the --timeout=SECONDS option to change the timeout. 🚨

not me stressing — this is the "did I just lock myself out" safety net and it's lowkey the most important flag here 💀

• -n, --no-act — don't actually run iptables. this can be used to check if pyroman accepts the configuration files. perfect lil dress rehearsal 🎀
• -p, --print — instead of running iptables, output the generated rules. 👀
• -P, --print-verbose — instead of running iptables, output the generated rules. each statement will have one comment line explaining how this rule was generated. this will usually include the filename and line number, and it's useful for debugging. detective mode activated 🔍

---

🧚 CONFIGURATION 🧚

configuration of pyroman consists of a number of files in the directory /etc/pyroman. these files are in python syntax, although bestie you do not need to be a python programmer to use these rules. there is only a small number of statements you need to know, and honestly? it's a short list:

• add_host — define a new host or network 🖥️
• add_interface — define a new interface (group) 🔌
• add_service — add a new service alias (note that you can always use e.g. www/tcp to reference the www tcp service as defined in /etc/services) ⭐
• add_nat — define a new NAT (Network Address Translation) rule 🔄
• allow — allow a service, client, server combination ✅
• reject — reject access for this service, client, server combination 🙅
• drop — drop packets for this service, client, server combination 💀
• add_rule — add a rule for this service, client, server and target combination 🎯
• iptables — add an arbitrary iptables statement to be executed at beginning 🏁
• iptables_end — add an arbitrary iptables statement to be executed at the end 🏁

detailed parameters for these functions can be looked up by calling:

cd /usr/share/pyroman
pydoc ./commands.py

iykyk — go read the docs, they're right there 💖

---

🙈 BUGS 🙈

None known as of pyroman-0.4 release. (not a single one. we're thriving. 🌈)

---

👑 AUTHOR 👑

pyroman was written by Erich Schubert <erich@debian.org> — absolute legend, we stan 🫶

---

🔥 SEE ALSO 🔥

iptables(8), iptables-restore(8) iptables-load(8)

---

and that's the whole page bestie, you ate it up 💅 this was PYROMAN(8) from the System Manager's Manual, mwah, bye, go firewall something responsibly 🎀✨🦋