#!/etc/rc.d/init.d/firehol
#
# THREE RULESETS: dst-publicip, dst-privateip, dst-world
#

FIREHOL_LOG_MODE="ULOG"
#FIREHOL_LOG_OPTIONS=" --log-tcp-options --log-ip-options"
#FIREHOL_ULOG_OPTIONS=" --log-tcp-options --log-ip-options  --ulog-cprange 0 "
#FIREHOL_LOG_OPTIONS="--log-level info --log-tcp-options --log-ip-options -ll"
FIREHOL_LOG_OPTIONS="--ulog-cprange 0"


interface eth0 dst-publicip dst 206.222.12.74/32

    # The default policy is DROP. You can be more polite with REJECT.
    # Prefer to be polite on your own clients to prevent timeouts.
    policy drop

    # If you don't trust the clients 
    # add something like this.
    # protection strong

    # Here are the services listening on eth0.
    server smtp accept
    server ICMP accept
    #server mysql accept
    server ntp accept
    server webmin accept
    server http accept
    server dns accept
    server ssh accept
    server pop3 accept
    server imaps accept
    server https accept
    server all accept

    client smtp accept
    client dns accept
    client ICMP accept
    client ssh accept
    client pop3 accept
    client http accept
    client imaps accept
    client https accept
    client ntp accept

    client all accept

interface eth1 dst-privateip dst 192.168.1.3/32

    # The default policy is DROP. You can be more polite with REJECT.
    # Prefer to be polite on your own clients to prevent timeouts.
    #policy drop
    policy reject

    # If you don't trust the clients behind eth1 (net "192.168.1.0/24"),
    # add something like this.
    # > protection strong

    # Here are the services listening on eth1.
    # TODO: Normally, you will have to remove those not needed.
    server ICMP accept
    #server mysql accept
    server ntp accept
    server smtp accept
    server webmin accept
    server http accept
    server dns accept
    server ssh accept
    server https accept
    server all accept

    client dns accept
    client ICMP accept
    client smtp accept
    client ssh accept
    client https accept

    client all accept 


interface eth0 dst-outside dst not "192.168.1.3 206.222.12.74"

    # The default policy is DROP. You can be more polite with REJECT.
    # Prefer to be polite on your own clients to prevent timeouts.
    policy drop
    #policy reject

    # If you don't trust the clients behind eth1 (net "192.168.1.0/24"),
    # add something like this.
    # > protection strong

    # Here are the services listening on eth1.
    # TODO: Normally, you will have to remove those not needed.
    server ICMP accept
    #server mysql accept
    server ntp accept
    server smtp accept
    server webmin accept
    server http accept
    server dns accept
    server ssh accept
    server https accept
    server imaps accept
    server all accept

    client ICMP accept
    client dns accept
    client smtp accept
    client ssh accept
    client https accept
    client http accept 
    client imaps accept

    client all accept
    # for now, we let all traffic out