Firewall 101

You have probably heard that the Internet is the world at your fingertips. Your parents also probably told you to never take anything from strangers. Yet, being on the Internet and functioning in any reasonable manner means that you are going to receive all kinds of things from strangers. It cannot be avoided.

I am placing this here for those of you that do not have a firewall in place. If you know what a firewall is for your computer system, then you probably also know that it will help to keep you from receiving things from strangers that you do not want to have. If you do not have a firewall in place for some reason, then you need this script. If you are one of those that do not know what a firewall is, then you really need this script!

[ Update: ]
Due to various things(my dedicated firewall needs hardware, I have been testing MDK 10.2 & everything gets formatted often, I do not like shorewall & I am lazy :), I have not had a firewall installed but since this system is going to be on the net for a while and this page has not been tested in a l o n g while, I decided it was a good idea to install one.
I just used this page information and file to install a firewall using kernel 2.6.11-6mdk & iptables-1.2.9-7mdk on a Mandrakelinux 10.2RC1 system. It works great!
All major ports are stealthed according to GRC) :

perfect

TruStealth

this machine does not exist on the Internet

Very nice

D!, FWBuilder & iptables are good: works just as good today as years ago when I first put this page up. So, if you are wondering if this page will still help you, it will. And it is still *free*. Enjoy!
[ EndUpdate ]

What it is:
It is the conjuring of a program called Firewall Builder (and, hence, named fwbuilder). It is a very simple firewall that makes your Mandrake Linux box invisible to those that do have any priviledges to be accessing your sytem. That is commonly referred to as "stealth mode" and is about as good as you can get without a heck of a lot of customizations.
It is a very basic firewall meant for a standalone (Mandrake)linux system which uses eth0 and ppp0 that has a dynamically assigned address from the ISP of choice.. Combined with the fact the your address is dynamically assigned, most rude people are going to leave you alone. After all, they have plenty of MSwindows boxes to choose from that are, relatively, easy pickin's.
It allows me to surf as freely as if there was no firewall in place and allows all my local connections to be accessed on demand. Any connection that is made is allowed to return data to me as is needed. It blocks and drops everything else. It is currently setup to log all "drops" under the "CatchAll" rule to /var/log/syslog. I monitor syslog fairly often to see if someone is hammering my box. Yes, it does happen but fortunately, not very often. I will add that the frequency of that has dropped off since the firewall has been in place.
It has the beginnings of masquerading if you have a system that is connected to one or more computers at your location via an ethernet card(NIC) but it will require you to use fwbuilder to complete the design for your special circumstances, protocols, network interfaces, etc. if you need to use it that way. IOW, masquerading is not needed for a Standalone system and therefore it is not usable without modification for a system that has other systems connected to it(Intranet) if you want those systems to access your box. You can use the XML source(near bottom of this doc) and fwbuilder to fix that very easily.

What it is not:
It is not an expert or "professionally" designed firewall. You can either pay somebody a lot of money to set up a firewall for you(it takes quite a bit of time for even simple intranets) or you can spend the time yourself to figure out what and how all the pieces fit together. I am not a security expert and will not do that for you, so do not ask.

It is not guaranteed in any way whatsoever!

It may allow someone to access you system without permission; It may bring your system to its knees; It may not work at all, etc. Although it is unlikely that it will do anymore than protect your system, I have no idea what you will do or how you will implement the script and make no warranty of any kind. It works absolutely flawlessly here so far. I have been using it and various modifications for about a month(as of Jan 2003).

What it needs:
Other than the normal stuff(bash, etc.), Linux 2.4.x and iptables (V4) are required. You may also need " logger " from the util-linux-2.11u-1mdk RPM package. Mandrake Linux 9 has all of that as a typical install, but you might want to make sure those are installed. Your system should be using PPPoE to make your connections.
I have not tested it with a normal serial port modem (yet) but the principles are the same and you can massage it a bit if you are having trouble.
If you want to modify it for masquerading, etc. you will need at least the rc.firewall.01.xml document(near bottom of this page), fwbuilder, libfwbuilder4 and fwbuilder-ipt files. The Firewall Builder developers are currently posting Mandrake Linux 9 versions so you can just get the ones I listed from their site(nice guys, huh!). If you have older versions already installed, UNinstall them first before installing the newest version from the FWB site. Uninstall, here, did not remove the files that I had already built with fwbuilder so it should be safe to uninstall it. Version 1.0.8 fixes some rather old and ugly bugs that are in the 1.0.7 version distributed with ML9. Believe me, it is worth the effort to get it and install it.

Since time is ticking, the script source follows and the instructions to get it running are below it. Here's a link you can use if you do not want to copy and paste the script:
Name Your Firewall!.fw

Please note:It will NOT run with the current information! It has to be very slightly modified (two places) for your system.

#!/bin/sh 
#
#  This is automatically generated file. DO NOT MODIFY !
#  Firewall Builder  fwb_ipt v1.0.8-3 
#  Generated Tue Jan  7 01:25:26 2003 CST by guessWho
#
check() {
  if test ! -x "$1"; then
    echo "$1 not found or is not executable"
    exit 1
  fi
}

log() {
  if test -x "$LOGGER"; then
    logger -p info "$1"
  fi
}

MODPROBE="/sbin/modprobe"
IPTABLES="/sbin/iptables"
IP="/sbin/ip"
LOGGER="/usr/bin/logger"

check $MODPROBE
check $IPTABLES
check $IP

cd /etc || exit 1

log "Activating firewall script generated Tue Jan  7 01:25:26 2003 CST by guessWho"

va_num=1

FWD=`cat /proc/sys/net/ipv4/ip_forward`
echo "0" > /proc/sys/net/ipv4/ip_forward

echo 1 > /proc/sys/net/ipv4/ip_dynaddr

echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout

echo 1800 > /proc/sys/net/ipv4/tcp_keepalive_intvl

$IP -4 neigh flush dev eth0
$IP -4 addr flush dev eth0 label "eth0:FWB*"

$IPTABLES -P OUTPUT  DROP
$IPTABLES -P INPUT   DROP
$IPTABLES -P FORWARD DROP

cat /proc/net/ip_tables_names | while read table; do
  $IPTABLES -t $table -L -n | while read c chain rest; do
      if test "X$c" = "XChain" ; then
        $IPTABLES -t $table -F $chain
      fi
  done
  $IPTABLES -t $table -X
done

MODULE_DIR="/lib/modules/`uname -r`/kernel/net/ipv4/netfilter/" 
MODULES=`(cd $MODULE_DIR; ls *_conntrack_*  *_nat_* | sed 's/\.o.*$//')`
for module in $(echo $MODULES); do 
  if [ -e "${MODULE_DIR}/${module}.o" -o -e "${MODULE_DIR}/${module}.o.gz" ]; then 
    $MODPROBE ${module} ||  exit 1 
  fi 
done

#
#  Rule 0(NAT)
# 
# 
$IPTABLES -t nat -A POSTROUTING -o ppp0  -s WWW.XXX.Y.ZZ -j MASQUERADE  
#
#

$IPTABLES -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# 
# Rule 0(lo)
# 
# allow everything on loopback
# 
$IPTABLES -A INPUT  -i lo -j ACCEPT 
$IPTABLES -A FORWARD  -i lo -j ACCEPT 
$IPTABLES -A OUTPUT  -o lo -j ACCEPT 
$IPTABLES -A FORWARD  -o lo -j ACCEPT 
# 
# Rule 0(global)
# 
# 'masquerading' rule
# 
$IPTABLES -A INPUT  -s WWW.XXX.Y.ZZ  -m state --state NEW -j ACCEPT 
$IPTABLES -A OUTPUT  -m state --state NEW -j ACCEPT 
# 
# Rule 1(global)
# 
# 'catch all' rule
# 
$IPTABLES -N RULE_1
$IPTABLES -A OUTPUT -j RULE_1 
$IPTABLES -A INPUT -j RULE_1 
$IPTABLES -A FORWARD -j RULE_1 
$IPTABLES -A RULE_1 -j LOG  --log-level warning --log-prefix " ++CatchAll++ " 
$IPTABLES -A RULE_1 -j DROP 
#
#
echo 1 > /proc/sys/net/ipv4/ip_forward

All you have to do is modify the IP address to match your system and then run the script. Logging to syslog is enabled and you can see what the firewall is doing by tailing syslog in a shell. A little better explanation is that you need to replace the " WWW.XXX.Y.ZZ " in the above script with your eth0 address. You can get your eth0 address by typing
ifconfig
at a CLI prompt in a bash shell.

It will return with a display of some information similar to the following:

eth0 Link encap:Ethernet HWaddr 00:01:3A:00:BB:BB inet addr:WWW.XXX.Y.ZZ Bcast:WWW.XXX.Y.zzz Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 ppp0 Link encap:Point-to-Point Protocol inet addr:65.67.86.143 P-t-P:65.67.87.254 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1 (some details omitted for brevity)

The address following "inet addr:" on your system's display is the address you need to substitute into the script for the two places that have WWW.XXX.Y.ZZ shown in the script.
For example, in the case of 65.67.86.143 as the IP address shown above, executing

sed s/WWW\.XXX\.Y\.ZZ/65\.67\.86\.143/g NameYourFirewall.fw > MyFW.fw

will create a new file named MyFW.fw with 65.67.86.143 in place of the WWW.XXX.Y.ZZ pseudo IP address. Then

chmod +x MyFW.fw

and MyFW.fw is ready to execute with

./MyFW.fw

You can also change "guessWho" in the two spots of the script to your name.
If you happen to be using ethX where X is not equal to 0, then you will have to change that too for all occurrences in the script.
Otherwise, leave it alone if you want it to work!

You can use the rc.firewall.01.xml document that follows to modify the script with fwbuilder anyway you want, if you so choose and need to do it to get a firewall running for your specific configuration.

AFTER you have made the address changes, you can run the script from any bash shell. If the script is named yourMachineName.fw( and the script is executable, i.e., you performed a chmod +x yourMachineName.fw ), just type
./yourMachineName.fw
and the script will install an iptables basic firewall for you. ( Yes, you need to be in the same directory where you saved the NameYourFirewall.fw script. )

That's it! Your system is protected.

If you want to check it, you can go to get your "shield" tested at various places. The easiest I have found is GRC:
http://grc.com/x/ne.dll?rh1ck2l2
Scroll down a bit and find the "ShieldsUp!" link; click on it to open that page and select the "Probe My Ports". All ports should be reported as "Stealth" mode, i.e., you are invisible to anyone that does not know your box is on the net. Although the site is designed for MSwindows users, it does not matter for the test.

If you execute
tail -n152 -f /var/log/syslog
in a shell, you can see who is bouncing signals off of your box which are subsequently being DROPPED in a realtime display. (note: Use CTRL-C to quit.)
[Update:]
I hope this is obvious but I just realized that I did not mention what happens when you shut down the internet connection or, e.g., turn off your system or reboot.
The script has to be modified with your new IP address everytime you get one.
Its a simple grep & replace, easy to do...
E.g., if your IP address was 70.243.170.156 and the new one is 71.243.173.152, and the current fwbuilder file is myfw1.fw, one can
sed s/70\.243\.173\.156/71\.243\.173\.152/g myfw1.fw > myfw2.fw
from the directory where the file is located. Do NOT try to overwrite the same file using this method.
Coincidentally,
sed s/WWW\.XXX\.Y\.ZZ/71\.243\.173\.152/g NameYourFirewall.fw > MyFW.fw
works too..;)
Of course, opening the file with your favorite text editor and manually changing the address in the two spots will work just as well.
[endUpdate]

More Details

Why is it:
Everyone needs a basic firewall in place before accessing the Internet. Unfortunately, the various firewalls that are out there are meant to be unusually complicated and designed for SOHO and medium to large businesses. When I tried to use Shorewall as supplied in the Mandrake Control Center(MCC) it worked so good that I could not even connect to my own local system -or- it allowed everything and EvERryBoDy to access the system. IOW, it did not work. Shorewall is a complicated firewall system to learn. I was able to find a "Standalone" version that Mandrake Linux has installed but it allowed some ports to be closed rather than dropped(Most notably, IDENT port 113). Closed ports mean your box exists but you are not 'open for business', so to speak. Well, some people do not care whether you are 'open for business' or not and will try to access your box regardless.
Because of those things, I had to spend a lot of time surfing, reading and learning just to get a good iptables firewall inplace that would DROP all connections except the ones I wanted. Portsentry had done that for versions of Linux before 2.4 but with the many advantages of iptables and Linux 2.4 plus some other reasons( http://www.linux.ie/articles/portsentryandsnortcompared.php ), I decided not to use Portsentry.
I, of course, want my local loopback and Intranet to work and I need to be able to contact any http or ftp site via browser or some other means as long as I initiate the connection. In particular, I needed for my Folding@home projects to be able to upload and download work units without any problems or personal intervention. Although I am working on an Apache Extranet server, qmail, and a few other projects, they are not ready and I do not want anyone other than myself to acess them. IOW, my needs are not complicated at this time. Your mileage will vary and mine will change in the future. :)
By far and large, I think the majority of people that need protection are the single system, "standalone", surfers. Reading page after page of acronym filled documents is frustrating even for someone who normally reads technical literature. I think it may cause the normal person to just give up and "hope for the best". The latter is a very dangerous thing to do. Your box can be oWnED by a stranger in less than FIFTEEN minutes!
That script, above, is here to get you some protection right away.

For the future, now or later, you can get fwbuilder-1.0.8 (or greater) and spend some time designing the firewall you really need or want. You can get it from the Firewall builder site http://www.fwbuilder.org/ at:
http://www.fwbuilder.org/pages/downloads/downloads.php. There are even Cisco & M$ Windows versions of FWBulider available, http://www.netcitadel.com/p/cat_fwb_gui_download.html, now (for a price of course).

In other words, I think this is a good firewall to start with but everybody's needs are different and you can (and should) adjust it to meet your needs.

In order for you to make those adjustments I have posted the source for the XML file which was used by the fwbuilder complier to create the script that was posted above. The xml document is what is loaded into fwbuilder when you do an "Open" file. The version that I have posted below has been spayed, :), meaning personally identifiable information for me and my system have been changed to protect the innocent(me). You can use this xml document as a guide when building the firewall you need. It should decrease the time spent considerably. At least it would have for me if I could have found such a document somewhere...

If you want to inspect the source after you get it onto your box, I'm putting a link here to download it. However, there is no guarantee that you can get it. There are bandwidth and other limitations for the Lycos "free with ads" sites. Right click on the following link and "Save As" or, in Galeon, "Download Link":

rc.firewall.01.xml

However, even if that does not work, you can "Select All" and copy it from below. Then paste it into a blank document created with a text editor and save it as rc.firewall.01.xml (or whatever you want).

Either way, I hope it helps. Here's the source:
[Update] This source was via fwbuilder 1.08 but current version is 2.06. This source might not work with the current fwbuilder release. IHNI and probably won't be testing it since the script above works for me... [EndUpdate]

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="0.10.12" id="root">
  <AnyNetwork comment="Any Network" id="sysid0" library="Standard" name="Any" address="0.0.0.0" netmask="0.0.0.0"/>
  <AnyIPService comment="Any IP Service" id="sysid1" library="Standard" name="Any" protocol_num="0"/>
  <AnyInterval comment="Any Interval" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" id="sysid2" library="Standard" name="Any" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
  <ObjectGroup id="sysid3" library="Standard" name="ScratchPad"/>
  <ObjectGroup id="stdid01" library="Standard" name="Objects">
    <ObjectGroup id="stdid04" library="Standard" name="Groups"/>
    <ObjectGroup id="stdid02" library="Standard" name="Hosts"/>
    <ObjectGroup id="stdid03" library="Standard" name="Networks">
      <Network comment="your.box.name should be replaced with the FQDN of your system.\nThe address and netmask should be replaced with the info you receive from using " ifconfig " at a CLI.\n" id="id3E0AFAFE" name="your.box.name" address="1.1.1.1" netmask="255.255.255.0"/>
    </ObjectGroup>
    <ObjectGroup id="stdid15" library="Standard" name="Address Ranges"/>
  </ObjectGroup>
  <ServiceGroup id="stdid05" library="Standard" name="Services">
    <CustomService comment="This service matches all packets which are part of network connections established through the firewall, or \n  connections 'related' to those established through the firewall. Term 'established' refers to the state tracking \n  mechanism which exists inside iptables and other stateful firewalls and does not mean any particular \n  combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it \n  belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful \n  inspection module made appropriate record in the state table. Usually statefule firewalls keep track of network \n  connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' \n  describes packet belonging to a separate network connection, related to the session firewall is keeping \n  track of. One example is FTP command and FTP data sessions." id="stdid14" library="Standard" name="ESTABLISHED">
      <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
      <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
      <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
    </CustomService>
    <ServiceGroup id="stdid10" library="Standard" name="Groups">
      <ServiceGroup comment="" id="sg-DHCP" library="Standard" name="DHCP">
        <ServiceRef ref="udp-bootpc"/>
        <ServiceRef ref="udp-bootps"/>
      </ServiceGroup>
      <ServiceGroup id="id3CB1279B" library="Standard" name="IPSEC">
        <ServiceRef ref="id3CB12797"/>
        <ServiceRef ref="ip-IPSEC"/>
      </ServiceGroup>
      <ServiceGroup comment="" id="sg-NETBIOS" library="Standard" name="NETBIOS">
        <ServiceRef ref="udp-netbios-dgm"/>
        <ServiceRef ref="udp-netbios-ns"/>
        <ServiceRef ref="udp-netbios-ssn"/>
      </ServiceGroup>
      <ServiceGroup id="id3CB131CC" library="Standard" name="PCAnywhere">
        <ServiceRef ref="id3CB131CA"/>
        <ServiceRef ref="id3CB131C8"/>
      </ServiceGroup>
      <ServiceGroup comment="" id="sg-Useful_ICMP" library="Standard" name="Useful_ICMP">
        <ServiceRef ref="icmp-Time_exceeded"/>
        <ServiceRef ref="icmp-Time_exceeded_in_transit"/>
        <ServiceRef ref="icmp-ping_reply"/>
        <ServiceRef ref="icmp-Unreachables"/>
      </ServiceGroup>
      <ServiceGroup id="id3B4FEDD9" library="Standard" name="kerberos">
        <ServiceRef ref="id3B4FEDA5"/>
        <ServiceRef ref="id3B4FEDA9"/>
        <ServiceRef ref="id3B4FEDA7"/>
        <ServiceRef ref="id3B4FEDAB"/>
        <ServiceRef ref="id3B4FEDA3"/>
        <ServiceRef ref="id3B4FEE21"/>
        <ServiceRef ref="id3B4FEE23"/>
      </ServiceGroup>
      <ServiceGroup id="id3B4FF35E" library="Standard" name="nfs">
        <ServiceRef ref="id3B4FEE7A"/>
        <ServiceRef ref="id3B4FEE78"/>
      </ServiceGroup>
      <ServiceGroup id="id3B4FEFFA" library="Standard" name="quake">
        <ServiceRef ref="id3B4FEF7C"/>
        <ServiceRef ref="id3B4FEF7E"/>
      </ServiceGroup>
      <ServiceGroup id="id3D703C9A" library="Standard" name="Real Player">
        <ServiceRef ref="id3D703C99"/>
        <ServiceRef ref="id3D703C8B"/>
      </ServiceGroup>
    </ServiceGroup>
    <ServiceGroup id="stdid07" library="Standard" name="ICMP">
      <ICMPService code="-1" comment="" id="icmp-Unreachables" library="Standard" name="all ICMP unreachables" type="3"/>
      <ICMPService code="-1" comment="" id="id3C20EEB5" library="Standard" name="any ICMP" type="-1"/>
      <ICMPService code="1" comment="" id="icmp-Host_unreach" library="Standard" name="host_unreach" type="3"/>
      <ICMPService code="0" comment="" id="icmp-ping_reply" library="Standard" name="ping reply" type="0"/>
      <ICMPService code="0" comment="" id="icmp-ping_request" library="Standard" name="ping request" type="8"/>
      <ICMPService code="3" comment="Port unreachable" id="icmp-Port_unreach" library="Standard" name="port unreach" type="3"/>
      <ICMPService code="0" comment="ICMP messages of this type are needed for traceroute" id="icmp-Time_exceeded" library="Standard" name="time exceeded" type="11"/>
      <ICMPService code="1" comment="" id="icmp-Time_exceeded_in_transit" library="Standard" name="time exceeded in transit" type="11"/>
    </ServiceGroup>
    <ServiceGroup id="stdid06" library="Standard" name="IP">
      <IPService comment="IPSEC Authentication Header Protocol" fragm="False" id="id3CB12797" library="Standard" lsrr="False" name="AH" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False"/>
      <IPService comment="IPSEC Encapsulating Security Payload Protocol" fragm="False" id="ip-IPSEC" library="Standard" lsrr="False" name="ESP" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False"/>
      <IPService comment="Route recording packets" fragm="False" id="ip-RR" library="Standard" lsrr="False" name="RR" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False"/>
      <IPService comment="All sorts of Source Routing Packets" fragm="False" id="ip-SRR" library="Standard" lsrr="True" name="SRR" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False"/>
      <IPService comment="'Short' fragments" fragm="False" id="ip-IP_Fragments" library="Standard" lsrr="False" name="ip_fragments" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False"/>
      <IPService comment="IPSEC Simple Key Management for Internet Protocols" fragm="False" id="id3D703C8E" library="Standard" lsrr="False" name="SKIP" protocol_num="57" rr="False" short_fragm="False" ssrr="False" ts="False"/>
      <IPService comment="Generic Routing Encapsulation\n" fragm="False" id="id3D703C8F" library="Standard" lsrr="False" name="GRE" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False"/>
      <IPService comment="Virtual Router Redundancy Protocol" fragm="False" id="id3D703C95" library="Standard" lsrr="False" name="vrrp" protocol_num="112" rr="False" short_fragm="False" ssrr="False" ts="False"/>
    </ServiceGroup>
    <ServiceGroup id="stdid09" library="Standard" name="TCP">
      <TCPService ack_flag="False" ack_flag_mask="False" comment="ipchains used to use this range of port numbers for masquerading. " dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="False" id="tcp-ALL_TCP_Masqueraded" library="Standard" name="ALL TCP Masqueraded" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="65095" src_range_start="61000" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="False" id="tcp-All_TCP" library="Standard" name="All TCP" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="1494" dst_range_start="1494" fin_flag="False" fin_flag_mask="False" id="id3CB131C4" library="Standard" name="Citrix-ICA" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="1720" dst_range_start="1720" fin_flag="False" fin_flag_mask="False" id="id3AEDBEAC" library="Standard" name="H323" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="data channel for PCAnywhere v7.52 and later " dst_range_end="5631" dst_range_start="5631" fin_flag="False" fin_flag_mask="False" id="id3CB131C8" library="Standard" name="PCAnywhere-data" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="113" dst_range_start="113" fin_flag="False" fin_flag_mask="False" id="tcp-Auth" library="Standard" name="auth" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="13" dst_range_start="13" fin_flag="False" fin_flag_mask="False" id="id3AEDBE6E" library="Standard" name="daytime" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="53" dst_range_start="53" fin_flag="False" fin_flag_mask="False" id="tcp-DNS_zone_transf" library="Standard" name="dns_tcp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="2105" dst_range_start="2105" fin_flag="False" fin_flag_mask="False" id="id3B4FEDA3" library="Standard" name="eklogin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="79" dst_range_start="79" fin_flag="False" fin_flag_mask="False" id="id3AECF774" library="Standard" name="finger" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="21" dst_range_start="21" fin_flag="False" fin_flag_mask="False" id="tcp-FTP" library="Standard" name="ftp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="FTP data channel.\n  Note: FTP protocol does not really require server to use source port 20 for the data channel, \n  but many ftp server implementations do so." dst_range_end="65535" dst_range_start="1024" fin_flag="False" fin_flag_mask="False" id="tcp-FTP_data" library="Standard" name="ftp data" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="20" src_range_start="20" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="80" dst_range_start="80" fin_flag="False" fin_flag_mask="False" id="tcp-HTTP" library="Standard" name="http" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="443" dst_range_start="443" fin_flag="False" fin_flag_mask="False" id="id3B4FED69" library="Standard" name="https" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="143" dst_range_start="143" fin_flag="False" fin_flag_mask="False" id="id3AECF776" library="Standard" name="imap" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="993" dst_range_start="993" fin_flag="False" fin_flag_mask="False" id="id3B4FED9F" library="Standard" name="imaps" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="6667" dst_range_start="6667" fin_flag="False" fin_flag_mask="False" id="id3B4FF13C" library="Standard" name="irc" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="543" dst_range_start="543" fin_flag="False" fin_flag_mask="False" id="id3B4FEE21" library="Standard" name="klogin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="544" dst_range_start="544" fin_flag="False" fin_flag_mask="False" id="id3B4FEE23" library="Standard" name="ksh" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="389" dst_range_start="389" fin_flag="False" fin_flag_mask="False" id="id3AECF778" library="Standard" name="ldap" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="98" dst_range_start="98" fin_flag="False" fin_flag_mask="False" id="id3B4FF000" library="Standard" name="linuxconf" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="98" dst_range_start="98" fin_flag="False" fin_flag_mask="False" id="id3AED0D6D" library="Standard" name="linuxconf" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3306" dst_range_start="3306" fin_flag="False" fin_flag_mask="False" id="id3B4FEEEE" library="Standard" name="mysql" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="2049" dst_range_start="2049" fin_flag="False" fin_flag_mask="False" id="id3B4FEE7A" library="Standard" name="nfs" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="119" dst_range_start="119" fin_flag="False" fin_flag_mask="False" id="tcp-NNTP" library="Standard" name="nntp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="110" dst_range_start="110" fin_flag="False" fin_flag_mask="False" id="id3B4FEE1D" library="Standard" name="pop3" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="5432" dst_range_start="5432" fin_flag="False" fin_flag_mask="False" id="id3B4FF0EA" library="Standard" name="postgres" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="515" dst_range_start="515" fin_flag="False" fin_flag_mask="False" id="id3AECF782" library="Standard" name="printer" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="26000" dst_range_start="26000" fin_flag="False" fin_flag_mask="False" id="id3B4FEF7C" library="Standard" name="quake" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="512" dst_range_start="512" fin_flag="False" fin_flag_mask="False" id="id3AECF77A" library="Standard" name="rexec" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="513" dst_range_start="513" fin_flag="False" fin_flag_mask="False" id="id3AECF77C" library="Standard" name="rlogin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="514" dst_range_start="514" fin_flag="False" fin_flag_mask="False" id="id3AECF77E" library="Standard" name="rshell" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="4321" dst_range_start="4321" fin_flag="False" fin_flag_mask="False" id="id3B4FEF34" library="Standard" name="rwhois" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="25" dst_range_start="25" fin_flag="False" fin_flag_mask="False" id="tcp-SMTP" library="Standard" name="smtp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="465" dst_range_start="465" fin_flag="False" fin_flag_mask="False" id="id3B4FF04C" library="Standard" name="smtps" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="1080" dst_range_start="1080" fin_flag="False" fin_flag_mask="False" id="id3B4FEE76" library="Standard" name="socks" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="3128" dst_range_start="3128" fin_flag="False" fin_flag_mask="False" id="id3B4FF09A" library="Standard" name="squid" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="22" dst_range_start="22" fin_flag="False" fin_flag_mask="False" id="tcp-SSH" library="Standard" name="ssh" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="111" dst_range_start="111" fin_flag="False" fin_flag_mask="False" id="id3AEDBE00" library="Standard" name="sunrpc" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="True" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" fin_flag_mask="True" id="tcp-TCP-SYN" library="Standard" name="tcp-syn" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="23" dst_range_start="23" fin_flag="False" fin_flag_mask="False" id="tcp-Telnet" library="Standard" name="telnet" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="540" dst_range_start="540" fin_flag="False" fin_flag_mask="False" id="tcp-uucp" library="Standard" name="uucp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="Windows Terminal Services" dst_range_end="3389" dst_range_start="3389" fin_flag="False" fin_flag_mask="False" id="id3CB131C6" library="Standard" name="winterm" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="7100" dst_range_start="7100" fin_flag="False" fin_flag_mask="False" id="id3B4FF1B8" library="Standard" name="xfs" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="True" ack_flag_mask="True" comment="" dst_range_end="0" dst_range_start="0" fin_flag="True" fin_flag_mask="True" id="id3C685B2B" library="Standard" name="xmas scan" psh_flag="True" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" src_range_end="0" src_range_start="0" syn_flag="True" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="X Window System" dst_range_end="6063" dst_range_start="6000" fin_flag="False" fin_flag_mask="False" id="id3D703C82" library="Standard" name="X11" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="Open Windows" dst_range_end="2000" dst_range_start="2000" fin_flag="False" fin_flag_mask="False" id="id3D703C83" library="Standard" name="OpenWindows" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="TCP high ports" dst_range_end="65535" dst_range_start="1024" fin_flag="False" fin_flag_mask="False" id="id3D703C84" library="Standard" name="TCP high ports" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="1521" dst_range_start="1521" fin_flag="False" fin_flag_mask="False" id="id3D703C87" library="Standard" name="sqlnet1" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="5510" dst_range_start="5510" fin_flag="False" fin_flag_mask="False" id="id3D703C89" library="Standard" name="securidprop" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="RealNetworks PNA Protocol" dst_range_end="7070" dst_range_start="7070" fin_flag="False" fin_flag_mask="False" id="id3D703C8B" library="Standard" name="Real-Audio" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="49" dst_range_start="49" fin_flag="False" fin_flag_mask="False" id="id3D703C8D" library="Standard" name="TACACSplus" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="Lightweight Directory Access Protocol over TLS/SSL" dst_range_end="636" dst_range_start="636" fin_flag="False" fin_flag_mask="False" id="id3D703C90" library="Standard" name="ldap-ssl" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="Entrust CA Administration Service" dst_range_end="709" dst_range_start="709" fin_flag="False" fin_flag_mask="False" id="id3D703C91" library="Standard" name="Entrust-Admin" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="Entrust CA Key Management Service" dst_range_end="710" dst_range_start="710" fin_flag="False" fin_flag_mask="False" id="id3D703C92" library="Standard" name="Entrust-KeyMgmt" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="2998" dst_range_start="2998" fin_flag="False" fin_flag_mask="False" id="id3D703C93" library="Standard" name="RealSecure" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="5190" dst_range_start="5190" fin_flag="False" fin_flag_mask="False" id="id3D703C94" library="Standard" name="AOL" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="515" dst_range_start="515" fin_flag="False" fin_flag_mask="False" id="id3D703C97" library="Standard" name="lpr" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="Microsoft SQL Server" dst_range_end="1433" dst_range_start="1433" fin_flag="False" fin_flag_mask="False" id="id3D703C98" library="Standard" name="ms-sql" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="Real Time Streaming Protocol" dst_range_end="554" dst_range_start="554" fin_flag="False" fin_flag_mask="False" id="id3D703C99" library="Standard" name="rtsp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="8080" dst_range_start="8080" fin_flag="False" fin_flag_mask="False" id="id3E0CA524" name="webcache" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
    </ServiceGroup>
    <ServiceGroup id="stdid08" library="Standard" name="UDP">
      <UDPService comment="ipchains used to use this port range for masqueraded packets" dst_range_end="0" dst_range_start="0" id="udp-ALL_UDP_Masqueraded" library="Standard" name="ALL UDP Masqueraded" src_range_end="65095" src_range_start="61000"/>
      <UDPService comment="" dst_range_end="0" dst_range_start="0" id="udp-All_UDP" library="Standard" name="All UDP" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="500" dst_range_start="500" id="id3CB129D2" library="Standard" name="IKE" src_range_end="0" src_range_start="0"/>
      <UDPService comment="status channel for PCAnywhere v7.52 and later" dst_range_end="5632" dst_range_start="5632" id="id3CB131CA" library="Standard" name="PCAnywhere-status" src_range_end="0" src_range_start="0"/>
      <UDPService comment="routing protocol RIP" dst_range_end="520" dst_range_start="520" id="id3AED0D6B" library="Standard" name="RIP" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="7009" dst_range_start="7000" id="id3B4FEDA1" library="Standard" name="afs" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="68" dst_range_start="68" id="udp-bootpc" library="Standard" name="bootpc" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="67" dst_range_start="67" id="udp-bootps" library="Standard" name="bootps" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="13" dst_range_start="13" id="id3AEDBE70" library="Standard" name="daytime" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="53" dst_range_start="53" id="udp-DNS" library="Standard" name="dns" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="88" dst_range_start="88" id="id3B4FEDA5" library="Standard" name="kerberos" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="750" dst_range_start="749" id="id3B4FEDA9" library="Standard" name="kerberos-adm" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="464" dst_range_start="464" id="id3B4FEDA7" library="Standard" name="kpasswd" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="4444" dst_range_start="4444" id="id3B4FEDAB" library="Standard" name="krb524" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="138" dst_range_start="138" id="udp-netbios-dgm" library="Standard" name="netbios-dgm" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="137" dst_range_start="137" id="udp-netbios-ns" library="Standard" name="netbios-ns" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="139" dst_range_start="139" id="udp-netbios-ssn" library="Standard" name="netbios-ssn" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="2049" dst_range_start="2049" id="id3B4FEE78" library="Standard" name="nfs" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="123" dst_range_start="123" id="udp-ntp" library="Standard" name="ntp" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="26000" dst_range_start="26000" id="id3B4FEF7E" library="Standard" name="quake" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="520" dst_range_start="520" id="id3B4FEE1F" library="Standard" name="rip" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="161" dst_range_start="161" id="udp-SNMP" library="Standard" name="snmp" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="162" dst_range_start="162" id="id3AED0D69" library="Standard" name="snmp-trap" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="111" dst_range_start="111" id="id3AEDBE19" library="Standard" name="sunrpc" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="514" dst_range_start="514" id="id3AECF780" library="Standard" name="syslog" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="69" dst_range_start="69" id="id3AED0D67" library="Standard" name="tftp" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="33524" dst_range_start="33434" id="id3AED0D8C" library="Standard" name="traceroute" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="65535" dst_range_start="1024" id="id3D703C85" library="Standard" name="UDP high ports" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="513" dst_range_start="513" id="id3D703C86" library="Standard" name="Who" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="1024" dst_range_start="1024" id="id3D703C88" library="Standard" name="secureid-udp" src_range_end="0" src_range_start="0"/>
      <UDPService comment="VocalTec Internet Phone" dst_range_end="22555" dst_range_start="22555" id="id3D703C8A" library="Standard" name="interphone" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="1645" dst_range_start="1645" id="id3D703C8C" library="Standard" name="Radius" src_range_end="0" src_range_start="0"/>
      <UDPService comment="" dst_range_end="4000" dst_range_start="4000" id="id3D703C96" library="Standard" name="ICQ" src_range_end="0" src_range_start="0"/>
    </ServiceGroup>
    <ServiceGroup id="stdid13" library="Standard" name="Custom">
      <CustomService comment="works in iptables and requires patch-o-matic" id="id3B64EEA8" library="Standard" name="rpc">
        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
        <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
        <CustomServiceCommand platform="unknown"></CustomServiceCommand>
      </CustomService>
      <CustomService comment="IRC connection tracker, supports DCC. Works on iptables and requires patch-o-matic" id="id3B64EF4E" library="Standard" name="irc-conn">
        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
        <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
        <CustomServiceCommand platform="unknown"></CustomServiceCommand>
      </CustomService>
      <CustomService comment="Port scan detector, works only on iptables and  requires patch-o-matic " id="id3B64EF50" library="Standard" name="psd">
        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
        <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
        <CustomServiceCommand platform="unknown"></CustomServiceCommand>
      </CustomService>
      <CustomService comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic" id="id3B64EF52" library="Standard" name="string">
        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
        <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
        <CustomServiceCommand platform="unknown"></CustomServiceCommand>
      </CustomService>
      <CustomService comment="Talk protocol support. Works in iptables and requires patch-o-matic" id="id3B64EF54" library="Standard" name="talk">
        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
        <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
        <CustomServiceCommand platform="unknown"></CustomServiceCommand>
      </CustomService>
    </ServiceGroup>
  </ServiceGroup>
  <ObjectGroup id="stdid12" library="Standard" name="Firewalls">
    <Firewall comment="Host OS is Linux 2.4.x for this sample firewall.\nThe platform being used is iptables.\n\nThose items are required for fwbuilder to work properly.  \nThey must be set to match your configuration.\n\nNote that this sample is set-up to use an install script (Compile/Install tab) but there is not one supplied.  There are too many possible variations for me to do that and have it work.  \nInstall has to be done manually via the CLI or by setting this up in the initd scripts. THat can, of course, be changed whever you are ready.\n\nIn fact. modify anything you want but be careful. Contradictory rules could leave you with holes in the firewall that you do not want. You mightawanna make a new file with a new name for "try-its"  and leave this one untouched AFTER you have changed the basic info and the firewall is running properly.\n" host_OS="linux24" id="id3E0AFB01" name="Name Your Firewall!" platform="iptables" version="ge_1.2.6">
      <NAT id="id3E0AFB05">
        <NATRule disabled="False" id="id3E0AFB2D" position="0">
          <OSrc neg="False">
            <ObjectRef ref="id3E0AFB01"/>
          </OSrc>
          <ODst neg="False">
            <ObjectRef ref="sysid0"/>
          </ODst>
          <OSrv neg="False">
            <ServiceRef ref="sysid1"/>
          </OSrv>
          <TSrc neg="False">
            <ObjectRef ref="id3E0AFB01"/>
          </TSrc>
          <TDst neg="False">
            <ObjectRef ref="sysid0"/>
          </TDst>
          <TSrv neg="False">
            <ServiceRef ref="sysid1"/>
          </TSrv>
          <NATRuleOptions/>
        </NATRule>
      </NAT>
      <Policy id="id3E0AFB04">
        <PolicyRule action="Accept" comment="'masquerading' rule" disabled="False" id="id3E0AFB22" log="False" position="0">
          <Src neg="False">
            <ObjectRef ref="id3E0AFB01"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="sysid0"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="sysid1"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions/>
        </PolicyRule>
        <PolicyRule action="Deny" comment="'catch all' rule" disabled="False" id="id3E0AFB3D" log="True" position="1">
          <Src neg="False">
            <ObjectRef ref="sysid0"/>
          </Src>
          <Dst neg="False">
            <ObjectRef ref="sysid0"/>
          </Dst>
          <Srv neg="False">
            <ServiceRef ref="sysid1"/>
          </Srv>
          <When neg="False">
            <IntervalRef ref="sysid2"/>
          </When>
          <PolicyRuleOptions>
            <Option name="action_on_reject"></Option>
            <Option name="limit_burst">0</Option>
            <Option name="limit_suffix"></Option>
            <Option name="limit_value">0</Option>
            <Option name="log_level">warning</Option>
            <Option name="log_prefix"> ++CatchAll++ </Option>
            <Option name="stateless">False</Option>
          </PolicyRuleOptions>
        </PolicyRule>
      </Policy>
      <Interface comment="This is your loopback interface. You always want it accessible to you since it is an Internel interface\nIt is not dynamic and not normally the management interface.\n\nYou can erase this stuff and put your comments/reminders here. \nIf all goes well, you will need the reminders because you will not have to fool \naround with this stuff for, possibly, years.\n" dyn="False" id="id3E0AFB0D" label="" mgmt="False" name="lo" physAddress="" security_level="100">
        <IPv4 address="127.0.0.1" comment="lo        Link encap:Local Loopback\n          inet addr:127.0.0.1  Mask:255.0.0.0\n          UP LOOPBACK RUNNING  MTU:16436  Metric:1\n\nThis is pretty standard stuff.  Your box might be different but it is unlikely, especially with a default install of Mandrake Linux 9.\n\n" id="id3E0AFB0F" name="localhost.localdomain" netmask="255.0.0.0"/>
        <InterfacePolicy id="id3E0AFB0E">
          <PolicyRule action="Accept" comment="allow everything on loopback" direction="Both" disabled="False" id="id3E0AFB18" log="False" position="0">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="stateless">True</Option>
            </PolicyRuleOptions>
          </PolicyRule>
        </InterfacePolicy>
      </Interface>
      <Interface comment="eth0 is the NIC and could be the connection to an internal network, if I had one.\n\nThis is also considered an internal interface, normally. \nThe address is not normally dynamic.\nIt could be a management interface -your choice there but it is not required for a simple firewall.\nMAC address is unnecessary for simple firewalls - best to leave it blank. \n( You do not want to spread around the hardware address of your NIC. )\nIt could be needed for some advanced configurations. You are on your own there..." dyn="False" id="id3E0AFB10" label="" mgmt="False" name="eth0" physAddress="" security_level="100">
        <IPv4 address="01.01.01.01" comment="eth0    Link encap:Ethernet  HWaddr 00:0x:xy:kk:rr:al\n          inet addr: 192.152.0.1  Bcast:192.152.0.255  Mask:255.255.255.0\n\nThe bit above is just a sample of what you get when you run " ifconfig " at a CLI.\nYou need to change you.box.name in ALL occurrences to the Fully Qualified Domain Name(FQDN) you have given to your system.  That is available by using " hostname " at a CLI.  It shouls also be in the " /etc/hosts " file where you should also find the address for your.box.name.\nYour box.name and the address is also in the "Objects/Networks" object shown on the left.\n" id="id3E0AFB12" name="your.box.name" netmask="255.255.255.0"/>
        <InterfacePolicy id="id3E0AFB11"/>
      </Interface>
      <Interface comment="The is the connection to the ISP with dynamically assigned local and remote addresses.\nIs is THE external interface.\nIt is not normally used as the management interface but hey! maybe you want too..." dyn="True" id="id3E0AFB13" label="" mgmt="False" name="ppp0" physAddress="" security_level="0">
        <IPv4 address="0.0.0.0" comment="ppp0   Link encap:Point-to-Point Protocol\n          inet addr:DYNAMIC  P-t-P:DYNAMIC.254  Mask:255.255.255.255\n          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1\n\nThe info above is just a smple out put from " ifconfig " at a CLI.\nWell what didya think ppp stood for anyway? :)" id="id3E0AFB15" name="Point-to-Point" netmask="0.0.0.0"/>
        <InterfacePolicy id="id3E0AFB14"/>
      </Interface>
      <Management address="0.0.0.0">
        <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
        <FWBDManagement enabled="False" identity="" port="9999"/>
        <PolicyInstallScript arguments="" command="installfw.sh" enabled="True"/>
      </Management>
      <FirewallOptions>
        <Option name="accept_established">True</Option>
        <Option name="accept_new_tcp_with_no_syn">True</Option>
        <Option name="action_on_reject">ICMP host prohibited</Option>
        <Option name="bridging_fw">False</Option>
        <Option name="check_shading">False</Option>
        <Option name="clamp_mss_to_mtu">False</Option>
        <Option name="cmdline"></Option>
        <Option name="compiler"></Option>
        <Option name="debug">False</Option>
        <Option name="firewall_is_part_of_any_and_networks">True</Option>
        <Option name="ignore_empty_groups">False</Option>
        <Option name="limit_suffix"></Option>
        <Option name="limit_value">0</Option>
        <Option name="linux24_ip_dynaddr">1</Option>
        <Option name="linux24_ip_forward">1</Option>
        <Option name="linux24_path_ip">/sbin/ip</Option>
        <Option name="linux24_path_iptables">/sbin/iptables</Option>
        <Option name="linux24_path_logger">/usr/bin/logger</Option>
        <Option name="linux24_path_modprobe">/sbin/modprobe</Option>
        <Option name="linux24_tcp_fin_timeout">30</Option>
        <Option name="linux24_tcp_keepalive_interval">1800</Option>
        <Option name="load_modules">True</Option>
        <Option name="log_all">False</Option>
        <Option name="log_all_dropped">False</Option>
        <Option name="log_ip_opt">False</Option>
        <Option name="log_level">info</Option>
        <Option name="log_prefix">RULE %N -- %A </Option>
        <Option name="log_tcp_opt">False</Option>
        <Option name="log_tcp_seq">False</Option>
        <Option name="manage_virtual_addr">True</Option>
        <Option name="no_optimisation">False</Option>
        <Option name="snmp_contact"></Option>
        <Option name="snmp_description">whatever...</Option>
        <Option name="snmp_location"></Option>
        <Option name="ulog_cprange">0</Option>
        <Option name="ulog_nlgroup">1</Option>
        <Option name="ulog_qthreshold">1</Option>
        <Option name="use_ULOG">False</Option>
        <Option name="use_numeric_log_levels">False</Option>
        <Option name="verify_interfaces">False</Option>
      </FirewallOptions>
    </Firewall>
  </ObjectGroup>
  <IntervalGroup id="stdid11" library="Standard" name="Time">
    <Interval comment="any day, 9:00am through 5:00pm" from_day="-1" from_hour="9" from_minute="0" from_month="-1" from_weekday="1" from_year="-1" id="int-workhours" library="Standard" name="workhours" to_day="-1" to_hour="17" to_minute="0" to_month="-1" to_weekday="5" to_year="-1"/>
    <Interval comment="weekends: Saturday 0:00 through Sunday 23:59 " from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="7" from_year="-1" id="int-weekends" library="Standard" name="weekends" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="1" to_year="-1"/>
    <Interval comment="any day 6:00pm - 12:00am" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" id="int-afterhours" library="Standard" name="afterhours" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1"/>
    <Interval comment="" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" id="id3C63479C" library="Standard" name="Sat" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1"/>
    <Interval comment="" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" id="id3C63479E" library="Standard" name="Sun" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1"/>
  </IntervalGroup>
</FWObjectDatabase>

Yep, it is a long script to be posted. Okay, it is really long.:) It's about 50KB in size. I placed it here because it is the source and you need to be secure in the fact that you know exactly what you are getting for the security of your system(s).
In order to use it, you can load it the way it is into fwbuilder and then modify it to change the names to whatever suits you - should not take more than a few minutes.
However, it will be easier and faster if you will open the rc.firewall.01.xml file in nedit, xemacs, gedit or some other text editor and do a "Search and Replace" for all occurrences of " Name Your Firewall! ", " your.box.name " and " 01.01.01.01 " to replace them with the appropriate information and then save it. When you open up the file in fwbuilder, there will not be much to change.
Either way, you are, obviously, going to need to change the name "your.box.name" to the name you get when you type " hostname " at a CLI shell prompt. That's in two places in the xml file. And you will need to change the 01.01.01.01 to the eth0 address of your box (also two places). The firewall name, currently "Name Your Firewall!", should be changed to the name you want to use for your machine. That is, if you have a Dell xyz computer, then call it DellxyzFW (or whatever... something like that) which will identify the machine among the others in your Intranet.
Once again, if you are not using eth0 for your internet connection, you will also have to change that to match your specific configuration in all occurrences in the file.

The current names are
Name Your Firewall! for the Firewall Machine Name and will also be the script's executable name;
your.box.name for address 01.01.01.01 ;
lo for localhost.localdomain address 127.0.0.1 ;
ppp0 for a 'dynamic address' .

As long as all the changes have been made correctly, fwbuilder will compile the xml document successfully. Here's what the fwbuilder will look like if you do not change the script before opening it. The link will open in a new widow: Example 1

After you make any other changes you need, save the file with a new name of your choice and then "compile" it. If we did not screeeww-up, you will have a brand new firewall ready to run and modify any way you need. The new firewall's executable name will be what you substituted for the "Name Your Firewall!" (it is in the fwbuilder "General" box-widget). Just execute it ( ./theNameYouChose.fw ) to get it started.

After you are satisfied that your box is protected and you can Work&Play as normal, you can then work on putting the script into the /etc/init.d scripts so that it will start up every time you start your Linux system and so that you can start, status and stop it with a web interface such as Webmin or from the CLI. There are some samples of how to do that at the Firewall Builder site and other places.

If you want to see the firewall iptables chains, just

iptables --list

at any command prompt.

One last thing, Remember this command:

iptables -F

If all goes haywire and the firewall you designed is keeping you from getting anywhere, that will "flush" all the chains and reset the iptables rules to "ACCEPT" all connections in, forwarding and out. I would not suggest being connected to the internet if you do that as your box will be as bare-ass as a new born baby. :)

Oh yea, updates? I will modify the layout of this(do not like it much) and, if necessary, update the script(s) when I get a chance.

Good Luck!

This document is licensed under the GNU Free Documentaion license.
Please refer to http://www.gnu.org/licenses/fdl.html for specifics.
Copyrights reserved.