Contents

• 1 Introduction
  • 1.1 Intended audience
  • 1.2 Status
  • 1.3 Copyright and license
  • 1.4 Contacting the author
  
  
• 2 Basic firewalling
  • 2.1 Ruleset basics
  • 2.2 More advanced rulesets
  • 2.3 Keeping state
  • 2.4 Breaking from rulesets: the quick keyword
  • 2.5 Matching network interfaces
  • 2.6 Matching TCP flags
  • 2.7 Sets
  • 2.8 Variable expansion
  • 2.9 Ruleset optimization: skip steps
  • 2.10 Putting it all together
  • 2.11 Loading your ruleset
  
  
• 3 Filtering Bridges
  • 3.1 Two directions
  • 3.2 Stateful filtering
  
  
• 4 Firewalling tricks
  • 4.1 State modulation
  • 4.2 Packet normalization
  
  
• 5 Migrating from IPFilter
  • 5.1 head and group are gone
  
  
• 6 Other documentation
• 7 Thanks