uif(8)

🦋 uif — Universal Internet Firewall 💅

okay bestie, welcome to uif(8), the Universal Internet Firewall. yes she's a section 8 system admin page, yes she's iconic, and yes she's about to make your packetfilter rules not a mess. sit down, grab a strawberry, let's go 🍓

---

✨ SYNOPSIS ✨

uif [-c <configfile>] [-n] [-p [-l]] [-6] uif -d [-6] uif [<ldap-options>]

that's the whole vibe. short, mysterious, a little unhinged. periodt.

---

🌸 DESCRIPTION 🌸

so like, this manual page documents the uif command. what does she do? she generates optimized nft(8) or iptables(8) packetfilter rules, using a simple description file that you specify. you write the cute little description, she does the heavy lifting. slay.

the generated rules come out in nft(8) style (that's with option -f <filename>) or in iptables-save8 style. and because she's ambitious, uif can also read or write rulesets from or to LDAP servers in your network, which gives you a global storing mechanism (ngl, LDAP support hasn't been tested for a long time, so... lowkey beware 🙈). important note: you need to include the uif.schema to your slapd configuration in order to use it. no schema, no LDAP, no cap.

uif.conf(5) is the bestie that makes it easy to specify rules without exact knowledge of the nft / iptables syntax. she gives you groups and aliases so your packetfilter is actually human readable. it's giving accessibility. it's giving kindness.

keep in mind that uif is intended to assist you when designing firewalls, but she will not tell you what to filter. that part? that's on you, main character. she's your assistant, not your therapist. 😭

---

👑 OPTIONS 👑

The options are as follows:

• -6 — Turn on IPv6 mode so as to manipulate IPv6 rules. the default configuration file changes to /etc/uif/uif6.conf, see -c below. and heads up: it should be noted that nat rules are silently ignored if -6 is used. silently! just gone! 💀
• -b <basedn> — Specify the base DN to act on when using LDAP based firewall configuration. uif will look in the subtree ou=filter,ou=sysconfig,<basedn> for your rulesets.
• -c <configfile> — This option specifies the configuration file to be read by uif. see uif.conf(5) for detailed information on the fileformat. it defaults to /etc/uif/uif.conf.
• -C <configfile> — When reading configuration data from other sources than specified with -c you may want to convert this information into a textual configuration file. this option writes the parsed config back to the file specified by <configfile>.
• -d — Clears all firewall rules immediately. like, immediately immediately. 🔥
• -D <bind_dn> — If a special account is needed to bind to the LDAP database, the account's DN can be specified at this point. Note: you should use this when writing an existing configuration to the LDAP. reading the configuration may be done with an anonymous bind. casual.
• -p — Prints rules specified in the configuration to stdout. this option is mainly used for debugging the rule simplifier.
• -l — If printing rules (see -p) prepend line numbers to the print-out. cute and organized. ✨
• -r <ruleset> — Specifies the name of the ruleset to load from the LDAP database. remember to use the -b option to set the base. rulesets are stored using the following dn: cn=<ruleset>, ou=rulesets, ou=filter, ou=sysconfig, basedn, where <ruleset> will be replaced by the ruleset specified.
• -R <ruleset> — Specifies the name of the ruleset to write to the LDAP database. this option can be used to convert i.e. a textual configuration to an LDAP based ruleset. like with using -r you've to specify the LDAP base to use. target is cn=<ruleset>, ou=rulesets, ou=filter, ou=sysconfig, <basedn>, where <ruleset> will be replaced by the ruleset specified.
• -s <server> — This option specifies the LDAP server to be used.
• -t — This option is used to validate the packetfilter configuration without applying any rules. mainly used for debugging. a vibe check, basically. 🧚
• -T <time> — When changing your packetfiltering rules remotely, it is useful to have a test option. specify this one to apply your rules for a period of <time> (in seconds). after that the original rules will be restored. it's giving safety net. it's giving "i can always go back".
• -w <password> — When connecting to an LDAP server, you may need to authenticate via a password. if you really need to specify a password on the command line (discouraged!), use this option, otherwise use -W and enter it interactively. bestie. please. use -W. 🙈
• -W — Activate interactive password query for LDAP authentication.

---

uif is meant to leave the packetfilter rules in a defined state, so if something went wrong during the initialisation, or uif is aborted by the user, the rules that were active before starting will be restored. she cleans up after herself. queen behavior. 👑

Normally you will not need to call this binary directly. use the init script instead, since it does the most common steps for you. let the script cook. 🫶

---

🎀 FILES 🎀

Configuration files are located in /etc/uif.

---

🌈 SEE ALSO 🌈

uif.conf(5) nft(8) iptables(8)

---

💜 AUTHOR 💜

This manual page was written by Cajus Pollmeier <pollmeier@gonicus.de> and Jörg Platte <joerg.platte@gmx.de> and adjusted to nft support by Mike Gabriel <mike.gabriel@das-netzwerkteam.de>. legends, all three of them. respect the authors, iykyk. 🌟

---

and that's the page, bestie!! this one's Version 1.99.0, dated Apr 19th, 2022, straight out of the uif(8) manual. go forth and firewall responsibly, no cap 💖✨