# Configuration ## Configuration files Conifw looks for its main configuration in ``/etc/conifw/conifw.yml`` by default. This can be changed on the command line by using the ``-C /path/to/conifw.yml``. Note that the path should point to a file, not a directory! ```{table} Default configuration paths | Default path | Filename | Purpose | | --- | --- | --- | | /etc/conifw | conifw.yml | Main configuration | | (same as main config) | [zones.yml](zones.md) | Zones configuration | | (same as main config) | [interfaces.yml](interfaces.md) | Interfaces configuration | | (same as main config) | [policy.yml](policy.md) | Policy configuration | | (same as main config) | [rules.yml](rules.md) | Rules configuration | | (same as main config) | [natrules.yml](natrules.md) | Rules configuration | ``` ## Main configuration file Main configuration defines some global settings, and also where conifw looks for files for configuring the other sections. If no config_dir is specified, it is assumed to be the same directory where conifw.yml is placed. The default is an empty file, though it must still be present. Simple (well, at least not empty) example: ```yaml --- global: # config_dir: /path/to/config/files/elsewhere # Set logging configuration for conifw runtime. # Does not affect logging from generated rules. # Currently all log events are simply printed to the console. logging: level: info output: filename: "/my/custom/path/to/nftables.conf" ``` All supported options: ```yaml global: config_dir: /path/to/config/files/elsewhere logging: level: info output: filename: /etc/conifw/nftables.conf # auto_apply: true # Not supported yet # Options related to nftables generation nftables: comments-on-autorules: true # Put comments on automatically generated rules? logging: policy-default-log: true # Default logging for inter-zone chains when not specified in a policy # The settings below affect table/chain names and default policies # Note: # These policy settings should not be changed unless you really know you # require them, as inter-zone policies are specified in the policy configuration. # input_chain_name: INPUT input_chain_policy: drop output_chain_name: OUTPUT output_chain_policy: accept forward_chain_name: FORWARD forward_chain_policy: drop nat_postrouting_chain_name: NAT_POST nat_prerouting_chain_name: NAT_PRE nat_postrouting_chain_policy: accept nat_prerouting_chain_policy: accept ``` ## Zones Conifw is a zone-based firewall, and this is where the zones are defined. Zones only require a name at this time, there are no other options. Example: ```yaml --- lan: ``` ```{admonition} Note A default zone called `fw` is automatically defined and can be used for filtering traffic to and from the firewall host managed by Conifw. There is no need to explicitly add or specify it on the zones or the interfaces file. ``` Even if you only have one interface, you will likely want to define at least one zone that will then be assigned to that interface. This name will be referred to on the rules so pick a good name that is short and precise. Having good and simple zone names will be more important when you have a system with multiple interfaces to different networks. ## Interfaces This file defines which interfaces are to be associated with each zone you specify. A zone must have atleast one interface in order to filter traffic. Example: ```yaml --- # Bind interfaces to zones ens18: zone: lan options: # Interface is configured via DHCP, so set the 'dhcp-client' option to true. dhcp-client: true ``` ```{admonition} Note You should not add interfaces to the `fw` zone as it does not require an explicit interface. ``` ```{admonition} About unlisted interfaces :class: important Traffic through an unlisted interface will be blocked by a default rule. You need to assign a zone to interfaces you need to pass traffic through. ``` You may also specify additional options, like ```dhcp-client``` to indicate that the interface needs to be configured via dhcp. This will automatically generate per-interface rules to allow dhcp traffic. ## Policies Policies indicate how traffic should flow between zones by default. Policies don't deal with protocols or port numbers however, they just provide a default action for when there are no rules to match specific kind of traffic by the actual rules. The default is to drop all traffic between any two zones. Any traffic not destined to a zone (like a missing interface definition in the interfaces config) is also dropped by default. Example: ```yaml --- # Allow all outgoing traffic from local machine - source: fw dest: lan policy: accept # Drop everything from lan zone by default and log all attempts - source: lan dest: fw policy: drop log: true ``` ## Rules Rules specify more precisely what traffic is allowed in what direction and they work in conjunction with policies to create the final firewall configuration. Rules are inserted to nftables using the same order as in the rules file. This will allow more fine grained access rules to be created. ```yaml --- - comment: Allow SSH from LAN to the firewall action: accept source: lan dest: fw proto: tcp destport: 22 log: true - comment: Allow PING from fw to LAN action: accept source: lan dest: fw proto: [icmp, icmpv6] type: echo-request ``` There is a [separate documentation](rules.md) for rules where you will find more in-depth examples. ### Include rules from other files Rules may also be included from other files or directories. If you have multiple configurations, you can share some rules between them in this way. You can include single files using ```include: /path/to/file.yml``` or complete directories with ```include_directory:``` ```yaml include: /path/to/default/rules.yml include_directory: path/to/many/files/ ``` ```{note} include_directory only supports relative imports at this time. Recursion is also unsupported for now. ``` Included rules will be processed in the order they are included. In case of directory includes, the files will be sorted by name before reading their contents. * * * ## NAT (Network Address Translation) Conifw currently supports three modes of NAT: * Masquerade * SNAT * DNAT See [nat rules](natrules.md) for more information.