example2.conf

sifi-0.1.6.tar.gz 出自http://www.ifi.unizh.ch/ikm/SINUS/firewall/ 一个linux的防火墙工具。

ManageDomain=sfclasses.ManageDomain[Name="Example Domain",Topology=sfclasses.Graph[vertices=Vector[11,sfclasses.Host[actX=125,actY=85,objectID="Primary Firewall",level=1,HostAddresses=sfclasses.AddrList[Addresses=Vector[2,sfclasses.AddrObj[address=4,124,10,13,39,netmask=4,-1,-1,-1,-1]5,sfclasses.AddrObj[address=4,-66,12,-46,33,netmask=4,-1,-1,-1,-1]6]]4,internalAddresses=sfclasses.AddrList[Addresses=Vector[2,sfclasses.AddrObj[address=4,-66,12,-46,64,netmask=4,-1,-1,-1,-32]8,sfclasses.AddrObj[address=4,-66,12,-46,32,netmask=4,-1,-1,-1,-32]9]]7,true,false,false,true,Templates=8,false,false,false,false,false,false,false,false]3,sfclasses.Host[actX=175,actY=35,objectID="Public WWW and SMTP Server",level=1,HostAddresses=sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,40,netmask=4,-1,-1,-1,-1]12]]11,internalAddresses=sfclasses.AddrList[Addresses=Vector[0]]13,false,true,true,true,Templates=8,true,true,true,true,false,false,false,false]10,sfclasses.Net[actX=195,actY=85,objectID="Public Server Subnet",level=1,NetAddresses=sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,32,netmask=4,-1,-1,-1,-32]16]]15]14,sfclasses.Internet[actX=50,actY=85,objectID="Internet",level=0]17,sfclasses.Host[actX=220,actY=35,objectID="Intranet Server",level=1,HostAddresses=sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,41,netmask=4,-1,-1,-1,-1]20]]19,internalAddresses=0,false,true,true,false,Templates=8,true,false,false,false,true,false,false,false]18,sfclasses.Host[actX=320,actY=125,objectID="PPP Router",level=2,HostAddresses=sfclasses.AddrList[Addresses=Vector[2,sfclasses.AddrObj[address=4,-66,12,-46,88,netmask=4,-1,-1,-1,-1]23,sfclasses.AddrObj[address=4,-66,12,-46,89,netmask=4,-1,-1,-1,-1]24]]22,internalAddresses=0,false,true,false,true,Templates=8,false,false,false,false,false,false,false,false]21,sfclasses.Host[actX=430,actY=125,objectID="External Host",level=2,HostAddresses=sfclasses.AddrList[Addresses=Vector[2,sfclasses.AddrObj[address=4,-66,12,-46,90,netmask=4,-1,-1,-1,-1]27,sfclasses.AddrObj[address=4,-66,12,-46,91,netmask=4,-1,-1,-1,-1]28]]26,internalAddresses=0,false,true,false,true,Templates=8,false,false,false,false,false,false,false,false]25,sfclasses.Net[actX=375,actY=150,objectID="PPP link 2",level=2,NetAddresses=sfclasses.AddrList[Addresses=Vector[2,sfclasses.AddrObj[address=4,-66,12,-46,89,netmask=4,-1,-1,-1,-1]31,sfclasses.AddrObj[address=4,-66,12,-46,91,netmask=4,-1,-1,-1,-1]32]]30]29,sfclasses.Net[actX=375,actY=110,objectID="PPP link 1",level=2,NetAddresses=sfclasses.AddrList[Addresses=Vector[2,sfclasses.AddrObj[address=4,-66,12,-46,88,netmask=4,-1,-1,-1,-1]35,sfclasses.AddrObj[address=4,-66,12,-46,90,netmask=4,-1,-1,-1,-1]36]]34]33,sfclasses.Host[actX=260,actY=85,objectID="Secondary Firewall",level=2,HostAddresses=sfclasses.AddrList[Addresses=Vector[2,sfclasses.AddrObj[address=4,-66,12,-46,34,netmask=4,-1,-1,-1,-1]39,sfclasses.AddrObj[address=4,-66,12,-46,65,netmask=4,-1,-1,-1,-1]40]]38,internalAddresses=sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,64,netmask=4,-1,-1,-1,-32]42]]41,true,true,false,true,Templates=8,false,false,false,false,false,false,false,false]37,sfclasses.Net[actX=320,actY=85,objectID="Private Subnet",level=2,NetAddresses=sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,64,netmask=4,-1,-1,-1,-32]45]]44]43],adjlist=Vector[2,14,17],adjlist=Vector[1,14],adjlist=Vector[4,3,10,18,37],adjlist=Vector[1,3],adjlist=Vector[1,14],adjlist=Vector[3,29,33,43],adjlist=Vector[2,33,29],adjlist=Vector[2,21,25],adjlist=Vector[2,21,25],adjlist=Vector[2,14,43],adjlist=Vector[2,37,21]]2,Firewalls=Vector[2,3,37],Rules=Vector[38,sfclasses.Rule[Rule=0,0,true,false,false,true,2,true,true,"Allow configuration connections from configuration clients.",0,-2,2,-107,0,-104,0,450560,0,6,0,0]46,sfclasses.Rule[Rule=1,0,true,false,false,false,2,true,true,"Accept connections from localhost to localhost.",0,-2,2,-110,0,-110,0,0,0,0,0,0]47,sfclasses.Rule[Rule=2,0,true,false,false,false,2,true,true,"Accept connections from local addresses to local addresses.",0,-2,2,-123,0,-123,0,0,0,0,0,0]48,sfclasses.Rule[Rule=3,0,true,false,false,false,2,true,true,"e-Mail from firewalls",0,-2,2,-103,0,-111,0,450560,0,6,0,0]49,sfclasses.Rule[Rule=4,0,true,false,false,false,2,true,true,"finger from firewalls",0,-2,2,-103,0,-125,0,450560,0,6,0,0]50,sfclasses.Rule[Rule=5,0,true,false,false,false,2,true,true,"reject ident to firewalls",0,-2,20,0,0,-105,0,57344,0,6,0,0]51,sfclasses.Rule[Rule=6,0,true,false,false,false,2,true,true,"ident from firewalls",0,-2,2,-103,0,-112,0,57344,0,6,0,0]52,sfclasses.Rule[Rule=7,0,true,false,false,false,2,true,true,"rusers from firewalls (uses port sunrpc)",0,-2,2,-103,0,-113,0,57344,0,17,0,0]53,sfclasses.Rule[Rule=8,0,true,false,false,false,2,true,true,"rusers to firewalls (uses port sunrpc)",0,-2,2,-113,0,-103,0,57344,0,17,0,0]54,sfclasses.Rule[Rule=9,0,true,false,false,false,2,true,true,"DNS from firewalls",0,-2,2,-102,0,-114,0,57344,0,17,0,0]55,sfclasses.Rule[Rule=10,0,true,false,false,false,2,true,true,"DNS to firewalls",0,-2,2,-114,0,-102,0,57344,0,17,0,0]56,sfclasses.Rule[Rule=11,0,true,false,false,false,2,true,true,"DNS from firewalls (TCP)",0,-2,2,-102,0,-114,0,450560,0,6,0,0]57,sfclasses.Rule[Rule=12,0,true,false,false,false,2,true,true,"Ping from oneself",0,-2,2,-123,0,0,0,1105920,0,1,0,0]58,sfclasses.Rule[Rule=13,0,true,false,false,false,2,true,true,"traceroute - tell them they've reached their destination",12,-2,-4,0,0,-106,0,57344,0,17,0,0]59,sfclasses.Rule[Rule=14,0,true,false,false,false,2,true,true,"Block all source routed packets",1,-2,1,0,0,0,0,1536,0,0,0,0]60,sfclasses.Rule[Rule=15,0,true,false,false,false,2,true,true,"Answer pings from outside",14,-2,21,-109,0,0,0,1105920,0,1,0,0]61,sfclasses.Rule[Rule=16,0,true,false,false,false,2,true,true,"Block dangerous ICMP",14,-2,1,0,0,0,0,428400640,0,1,0,0]62,sfclasses.Rule[Rule=17,0,true,false,false,false,2,true,true,"Accept ICMP",15,-2,2,0,0,0,0,57344,0,1,0,0]63,sfclasses.Rule[Rule=18,0,true,false,false,false,2,true,true,"reject ident to inside",11,-2,20,0,0,-121,0,57344,0,6,0,0]64,sfclasses.Rule[Rule=19,0,true,false,false,false,2,true,true,"traceroute - tell them they've reached their destination",12,-2,-4,0,0,-122,0,57344,0,17,0,0]65,sfclasses.Rule[Rule=20,0,true,false,false,false,2,true,true,"outgoing FTP connections",13,-2,2,-108,0,-115,0,57344,0,6,0,0]66,sfclasses.Rule[Rule=21,0,true,false,false,false,2,true,true,"outgoing Telnet connections",13,-2,2,-108,0,-116,0,450560,0,6,0,0]67,sfclasses.Rule[Rule=22,0,true,false,false,false,2,true,true,"DNS from inside",0,-2,2,-108,0,-114,0,57344,0,17,0,0]68,sfclasses.Rule[Rule=23,0,true,false,false,false,2,true,true,"DNS to inside",0,-2,2,-114,0,-108,0,57344,0,17,0,0]69,sfclasses.Rule[Rule=24,0,true,false,false,false,2,true,true,"DNS from inside (TCP)",13,-2,2,-108,0,-114,0,450560,0,6,0,0]70,sfclasses.Rule[Rule=26,0,true,false,false,false,2,true,true,"SSH from inside",13,-2,2,-108,0,-117,0,450560,0,6,0,0]71,sfclasses.Rule[Rule=27,0,true,false,false,false,2,true,true,"HTTP from inside",13,-2,2,-108,0,-118,0,450560,0,6,0,0]72,sfclasses.Rule[Rule=28,0,true,false,false,false,2,true,true,"HTTPS from inside",13,-2,2,-108,0,-119,0,450560,0,6,0,0]73,sfclasses.Rule[Rule=29,0,true,false,false,false,2,true,true,"traceroute from inside",13,-2,2,-108,0,-120,0,57344,0,17,0,0]74,sfclasses.Rule[Rule=30,1,true,false,false,false,2,true,false,"WWW server (http to port 80) - Level 1 outgoing",10,-2,2,-109,0,-200,0,450560,0,6,0,0]75,sfclasses.Rule[Rule=30,4,true,false,false,false,2,false,true,"WWW server (http to port 80) - Level 2 incoming",10,-2,2,-108,0,-203,0,450560,0,6,0,0]76,sfclasses.Rule[Rule=31,1,true,false,false,false,2,true,false,"Secure WWW server (https to port 443) - Level 1 outgoing",10,-2,2,-109,0,-204,0,450560,0,6,0,0]77,sfclasses.Rule[Rule=31,4,true,false,false,false,2,false,true,"Secure WWW server (https to port 443) - Level 2 incoming",10,-2,2,-108,0,-207,0,450560,0,6,0,0]78,sfclasses.Rule[Rule=32,1,true,false,false,false,2,true,false,"SMTP to server (TCP to port 25) - Level 1 outgoing",10,-2,2,-109,0,-208,0,450560,0,6,0,0]79,sfclasses.Rule[Rule=32,4,true,false,false,false,2,false,true,"SMTP to server (TCP to port 25) - Level 2 incoming",10,-2,2,-108,0,-211,0,450560,0,6,0,0]80,sfclasses.Rule[Rule=33,1,true,false,false,false,2,true,false,"SMTP from server (TCP to port 25) - Level 1 outgoing",13,-2,2,-212,0,-111,0,450560,0,6,0,0]81,sfclasses.Rule[Rule=33,4,true,false,false,false,2,false,true,"SMTP from server (TCP to port 25) - Level 2 incoming",13,-2,2,-215,0,-111,0,450560,0,6,0,0]82,sfclasses.Rule[Rule=34,4,true,false,false,false,2,false,true,"FTP server (TCP to port 21) - Level 2 incoming",10,-2,2,-108,0,-219,0,57344,0,6,0,0]83],NLevels=Vector[0],Macros=Vector[9,sfclasses.Macro[Macro=-200,"TEMP30_1",1,80,80,sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,40,netmask=4,-1,-1,-1,-1]86]]85]84,sfclasses.Macro[Macro=-203,"TEMP30_4",1,80,80,sfclasses.AddrList[Addresses=Vector[2,sfclasses.AddrObj[address=4,-66,12,-46,40,netmask=4,-1,-1,-1,-1]89,sfclasses.AddrObj[address=4,-66,12,-46,41,netmask=4,-1,-1,-1,-1]90]]88]87,sfclasses.Macro[Macro=-204,"TEMP31_1",1,443,443,sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,40,netmask=4,-1,-1,-1,-1]93]]92]91,sfclasses.Macro[Macro=-207,"TEMP31_4",1,443,443,sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,40,netmask=4,-1,-1,-1,-1]96]]95]94,sfclasses.Macro[Macro=-208,"TEMP32_1",1,25,25,sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,40,netmask=4,-1,-1,-1,-1]99]]98]97,sfclasses.Macro[Macro=-211,"TEMP32_4",1,25,25,sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,40,netmask=4,-1,-1,-1,-1]102]]101]100,sfclasses.Macro[Macro=-212,"TEMP33_1",1,0,65535,sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,40,netmask=4,-1,-1,-1,-1]105]]104]103,sfclasses.Macro[Macro=-215,"TEMP33_4",1,0,65535,sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,40,netmask=4,-1,-1,-1,-1]108]]107]106,sfclasses.Macro[Macro=-219,"TEMP34_4",1,21,21,sfclasses.AddrList[Addresses=Vector[1,sfclasses.AddrObj[address=4,-66,12,-46,41,netmask=4,-1,-1,-1,-1]111]]110]109],Clients=sfclasses.AddrList[Addresses=Vector[2,sfclasses.AddrObj[address=4,-66,12,-46,77,netmask=4,-1,-1,-1,-1]113,sfclasses.AddrObj[address=4,-66,12,-46,78,netmask=4,-1,-1,-1,-1]114]]112,Templates=30,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,false,true,true,true,true,true,Mail="root"]1