Provided by: uif_1.99.0-7_all 
NAME
uif.conf - default configuration file for the Universal Internet Firewall
DESCRIPTION
/etc/uif/uif.conf is the default configuration file for uif(8). This file may contain several sections
and comments. Each section begins with the section name and the left curly brace and ends with the right
curly brace in a single line. A comment starts with a hash mark (#) at the beginning of a line. Blank
lines are silently ignored.
The following sections are valid: include, include4, include6, sysconfig, service, network, interface,
Imarker, filter, nat, input, output, forward, masquerade and stateless.
The sections service, network, marker and interface have all a very similar syntax. Each line starts
with an identifier followed by one or more blanks and one or more section specific entries or defined
identifiers separated by blanks. A valid identifier is case sensitive and consists of letters, digits,
underscores and hyphens.
If two or more identifiers in one section are equal, the corresponding entries are merged to the first
identifier. Hence, it's not possible to overwrite previously defined identifiers. As a result the order
of the section entries is irrelevant and it's possible to define a section more than once.
include section
Include other configuration files. Each line in this section, enclosed in quotation marks ("), must be a
valid filename or a valid file globbing pattern (it is ok, if no files match this pattern). The contents
of this file / these files are added to the actual configuration and each file should contain at least
one section (a comment only file is not really useful...).
include4 section
Include other configuration files but ONLY in IPv4 mode (WITHOUT -6 switch to uif). Otherwise equivalent
to the include section above.
include6 section
Include other configuration files but ONLY in IPv6 mode (WITH -6 switch to uif). Otherwise equivalent to
the include section above.
sysconfig section
Set some global settings. Each line in this section starts with one of the following identifiers followed
by one or more blanks and the desired value: LogLevel, LogPrefix, LogLimit, LogBurst, Limit, Burst or
AccountPrefix. If there are multiple definitions of one entry the last definition is stored.
LogLevel
A valid default log priority (see syslog.conf(5)).
LogPrefix
The default log prefix. Each netfilter (or iptables) log message starts with this prefix.
LogLimit
The default limit value for log messages (see nft(8) or iptables(8)).
LogBurst
The default burst value for log messages (see nft(8) or iptables(8)).
Limit The default limit value (see nft(8) or iptables(8)).
Burst The default burst value (see nft(8) or iptables(8)).
AccountPrefix
The default prefix for accounting chains.
service section
This section defines all needed services. A service description starts with the protocol (see
protocols(5)) followed by parameters in parenthesis. Most protocols don't need any parameters. The only
exceptions are tcp, udp and icmp. The tcp and udp parameters define the source and destionation
port(-range). The source and destination ports are separated by a slash (/) and port ranges are separated
by a colon (eg. tcp(123:333/99): tcp protocol, source port range 123-333, destination port 99). Empty
source or destination ports are expanded to 1:65535. The icmp protocol parameter must be a valid icmp
type (see iptables -p icmp --help).
network section
This section defines all needed networks and hosts. A network description starts with a valid IPv4
address (dotted quad), a valid IPv6 address (colon syntax, square brackets not needed), an optional
netmask in cidr notation (number of bits) or an optional MAC-address (with a prefixed equal sign (=).
Some valid entries are: 127.0.0.1, 127.0.0.0/8, ::1, fd00:1:2:3::/64,
and 192.168.0.1=00:00:00:00:00:FF.
interface section
This section defines all needed (physical and bridged) interfaces (eg. eth0, lo, ppp0).
marker section
This section defines all needed numerical (decimal) values for packet marking purposes.
filter, nat, input, output, forward, masquerade and stateless sections
Due to better partitioning of the packetfilter, rules can be split into these sections. Internally they
are equivalent and contain all rules. As an exception to all other sections the order of entries in these
sections is important.
The default policy for the chains INPUT, OUTPUT and FORWARD is DROP (see nft(8) or iptables(8)) and it's
not possible to change this.
Each line in in this section begins with in, out, fw, nat, masq, slin, slout or slfw, followed by '+',
'-' or a mark identifier enclosed in curly braces (or, in case of fw followed by '>'). The identifiers
in, out and fw define rules for incoming, outgoing and forwarded IP-packets. Each packet with an INVALID
state (see nft(8) or iptables(8)) is matched by slin, slout and slfw. The lines starting with nat and
masq define rules to modify the source or destination address or the destination port.
Note: The identifiers nat and masq are non-operational in IPv6 mode. They simply get ignored as NAT and
Masquerading are not supported by the IPv6 protocol.
The plus and minus signs specify the type of the rule: '+' accepts matching packets and '-' drops them.
As a special case the identifier out and fw accept the greater than (>) sign to modify the MSS depending
on the PMTU (see iptables(8)).
A very basic ruleset may look like this: out+
This allows every outgoing traffic and rejects all incoming connections (because of the default policy).
To be more specific, each line may contain several parameters. Each parameter starts with a single
character followed by an equal sign (=) and one or more previously defined identifiers (in the
corresponding sections) separated by commas. The following parameters are valid:
s The source address or network. Append "(4)" or "(6)" to the network name to make this rule apply
to IPv4 or IPv6 only.
d The destination address or network. Append "(4)" or "(6)" to the network name to make this rule
apply to IPv4 or IPv6 only.
i The input interface.
o The output interface.
pi The physical input interface (only useful when used with bridged interfaces, not supported with
nft as deprecated there).
po The physical output interface (only useful when used with bridged interfaces, not supported with
nft as deprecated there).
p The service description (protocol).
m The mark field associated with a packet.
S The the new source address in nat rules. Supported in IPv4 mode only. Ignored in IPv6 mode.
D The the new destination address in nat rules. Supported in IPv4 mode only. Ignored in IPv6 mode.
P The the new service description in nat rules. This is only valid with tcp or udp packets.
f This parameter sets some 'flags'. A flag definition starts with the flag identifier and optional
parameters in parenthesis. Valid flags are:
log - Logs matching packages to syslog. The given parameter is included in the log entry. The number of
logged packets and the loglevel can be set in the sysconfig section.
reject - Only valid in DROP rules. This is used to send back an error packet in response to the matched
packet. The default behaviour is a packet with set RST flag on tcp connections and a
destination-unreachable icmp packet in every other case. Valid parameters are listed in iptables(8) in
the REJECT section.
account - Create an accounting chain for all matching packages and possible responses. The optional
parameter is a part of the name of the chain.
limit - Limits the number of matching packets. The default values are set in the sysconfig section. Other
values can be defined with the optional parameter. The first entry sets a new limit and the second
parameter (separated by a comma (,)) sets the burst value (see Limit and Burst in sysconfig section).
It's possible to invert the identifier of one of following parameters - if it expands to ecactly one
object - by prepending a exclamation mark (!): s, d, i, o, p (eg.: s=!local p=!http).
FILES
Configuration files are located in /etc/uif. There is a sample configuration in
/usr/share/doc/uif/uif.conf.tmpl.gz.
SEE ALSO
nft(8) iptables(8) uif(8)
AUTHOR
This manual page was written by Jörg Platte <joerg.platte@gmx.de> and Cajus Pollmeier
<pollmeier@gonicus.de>, and has been adjusted for nft support by Mike Gabriel <mike.gabriel@das-
netzwerkteam.de>.
Version 1.99.0 Apr 19th, 2022 uif.conf(5)