Changes between Version 14 and Version 15 of TipAndDoc/network/ufw

Timestamp:

Oct 14, 2010 5:48:19 PM (14 years ago)

Author:

mitty

Comment:

--

TipAndDoc/network/ufw

@@ -92 +92 @@
  * filter table以外を/etc/ufw/*.rulesに書くと、ufw startで反映はされるがufw stopで消去されないので設定が累積していく
    * ~~interfaces pre-upとかに入れるのがよさそう…~~ => スクリプトを作成 => [../iptables#setfilter]
+
+ == chain tree ==
+ === lucid ===
+ * 以下のchainは /lib/ufw/user.rules に記述される
+{{{
+ufw-user-*
+ufw-before-logging-*
+ufw-user-logging-*
+ufw-after-logging-*
+ufw-logging-deny
+}}}
+ 
+ * filter target tree
+{{{
+INPUT
+  |
+  |----> ufw-before-logging-input
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-before-input
+  |       |
+  |       |----> ACCEPT
+  |       |
+  |       |----> ufw-logging-deny ----> LOG
+  |       |       |                      |
+  |       |      DROP <------------------/
+  |       |
+  |       |----> ACCEPT
+  |       |
+  |       |----> ufw-not-local
+  |       |       |
+  |       |<------|
+  |       |       |
+  |       |       |----> ufw-logging-deny ----> LOG
+  |       |       |                              |
+  |       |      DROP <--------------------------/
+  |       |
+  |       |----> ACCEPT
+  |       |
+  |       |----> ufw-user-input
+  |       |       |
+  |       |<------/
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-after-input
+  |       |
+  |       |----> ufw-skip-to-policy-input ----> DROP
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-after-logging-input
+  |       |
+  |      LOG
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-reject-input
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-track-input
+  |       |
+  |<------/
+  |
+  DROP
+}}}
+{{{
+FORWARD
+  |
+  |----> ufw-before-logging-forward
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-before-forward
+  |       |
+  |       |----> ufw-user-forward
+  |       |       |
+  |       |<------/
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-after-forward
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-after-logging-forward ----> LOG
+  |                                       |
+  |<--------------------------------------/
+  |
+  |
+  |----> ufw-reject-forward
+  |       |
+  |<------/
+  |
+  DROP
+}}}
+{{{
+OUTPUT
+  |
+  |
+  |----> ufw-before-logging-output
+  |       |
+  |       |
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-before-output
+  |       |
+  |       |----> ACCEPT
+  |       |
+  |       |----> ufw-user-output
+  |       |       |
+  |       |<------/
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-after-output
+  |       |
+  |       |
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-after-logging-output
+  |       |
+  |       |
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-reject-output
+  |       |
+  |       |
+  |       |
+  |<------/
+  |
+  |
+  |----> ufw-track-output
+  |       |
+  |       |----> ACCEPT
+  |       |
+  |<------/
+  |
+  ACCEPT
+}}}