| 12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485 |
- .. program:: qvm-firewall
- :program:`qvm-firewall` -- Manage VM outbound firewall
- ======================================================
- Synopsis
- --------
- :command:`qvm-firewall` [-h] [--verbose] [--quiet] [--reload] *VMNAME* add *RULE*
- :command:`qvm-firewall` [-h] [--verbose] [--quiet] [--reload] *VMNAME* del [--rule-no=*RULE_NUMBER*] [*RULE*]
- :command:`qvm-firewall` [-h] [--verbose] [--quiet] [--reload] *VMNAME* list [--raw]
- :command:`qvm-firewall` [-h] [--verbose] [--quiet] [--reload] *VMNAME* policy {accept,drop}
- Options
- -------
- .. option:: --help, -h
- show help message and exit
- .. option:: --verbose, -v
- increase verbosity
- .. option:: --quiet, -q
- decrease verbosity
- .. option:: --reload, -r
- force reloading rules even when unchanged
- .. option:: --raw
- Print raw rules when listing
- Actions description
- -------------------
- Available actions:
- * add - add specified rule. See `Rule syntax` section below.
- * del - delete specified rule. Can be selected either by rule number using
- :option:`--rule-no`, or specifying rule itself.
- * list - list all the rules for a given VM.
- * policy - set default action if no rule matches.
- Rule syntax
- -----------
- A single rule is built from:
- - action - either ``drop`` or ``accept``
- - zero or more matches
- Selected action is applied on given packet when all specified matches do match,
- further rules are not evaluated. If none of the rules match, default action
- (``policy``) is applied.
- Supported matches:
- - ``dsthost`` - destination host or network. Can be either IP address in CIDR
- notation, or a host name. Both IPv4 and IPv6 are supported by the rule syntax.
- - ``proto`` - specific IP protocol. Supported values: ``tcp``, ``udp``,
- ``icmp``.
- - ``dstports`` - destination port or ports range. Can be either a single port,
- or a range separated by ``-``. Valid only together with ``proto=udp`` or
- ``proto=tcp``.
- - ``icmptype`` - ICMP message type, specified as numeric value. Valid only
- together with ``proto=icmp``.
- - ``specialtarget`` - predefined target. Currently the only supported value is
- ``dns``. This can be combined with other matches to narrow it down.
- Authors
- -------
- | Joanna Rutkowska <joanna at invisiblethingslab dot com>
- | Rafal Wojtczuk <rafal at invisiblethingslab dot com>
- | Marek Marczykowski <marmarek at invisiblethingslab dot com>
- | Wojtek Porczyk <woju at invisiblethingslab dot com>
- .. vim: ts=3 sw=3 et tw=80
|
