Configuration

Configuration files

Conifw looks for its main configuration in /etc/conifw/conifw.yml by default. This can be changed on the command line by using the -C /path/to/conifw.yml. Note that the path should point to a file, not a directory!

Default configuration paths

Default path	Filename	Purpose
/etc/conifw	conifw.yml	Main configuration
(same as main config)	zones.yml	Zones configuration
(same as main config)	interfaces.yml	Interfaces configuration
(same as main config)	policy.yml	Policy configuration
(same as main config)	rules.yml	Rules configuration
(same as main config)	natrules.yml	Rules configuration

Main configuration file

Main configuration defines some global settings, and also where conifw looks for files for configuring the other sections. If no config_dir is specified, it is assumed to be the same directory where conifw.yml is placed.

The default is an empty file, though it must still be present.

Simple (well, at least not empty) example:

---
global:
   # config_dir: /path/to/config/files/elsewhere
# Set logging configuration for conifw runtime.
# Does not affect logging from generated rules.
# Currently all log events are simply printed to the console.
logging:
   level: info
output:
   filename: "/my/custom/path/to/nftables.conf"

All supported options:

global:
    config_dir: /path/to/config/files/elsewhere
logging:
    level: info
output:
    filename: /etc/conifw/nftables.conf
    # auto_apply: true # Not supported yet
# Options related to nftables generation
nftables:
    comments-on-autorules: true  # Put comments on automatically generated rules?
    logging:
        policy-default-log: true  # Default logging for inter-zone chains when not specified in a policy
    # The settings below affect table/chain names and default policies
    # Note:
    #   These policy settings should not be changed unless you really know you
    #   require them, as inter-zone policies are specified in the policy configuration.
    #
    input_chain_name: INPUT
    input_chain_policy: drop
    output_chain_name: OUTPUT
    output_chain_policy: accept
    forward_chain_name: FORWARD
    forward_chain_policy: drop
    nat_postrouting_chain_name: NAT_POST
    nat_prerouting_chain_name: NAT_PRE
    nat_postrouting_chain_policy: accept
    nat_prerouting_chain_policy: accept

Zones

Conifw is a zone-based firewall, and this is where the zones are defined. Zones only require a name at this time, there are no other options.

Example:

---
lan:

Note

A default zone called fw is automatically defined and can be used for filtering traffic to and from the firewall host managed by Conifw. There is no need to explicitly add or specify it on the zones or the interfaces file.

Even if you only have one interface, you will likely want to define at least one zone that will then be assigned to that interface. This name will be referred to on the rules so pick a good name that is short and precise. Having good and simple zone names will be more important when you have a system with multiple interfaces to different networks.

Interfaces

This file defines which interfaces are to be associated with each zone you specify. A zone must have atleast one interface in order to filter traffic.

Example:

---
# Bind interfaces to zones
ens18:
  zone: lan
  options:
    # Interface is configured via DHCP, so set the 'dhcp-client' option to true.
    dhcp-client: true

Note

You should not add interfaces to the fw zone as it does not require an explicit interface.

About unlisted interfaces

Traffic through an unlisted interface will be blocked by a default rule. You need to assign a zone to interfaces you need to pass traffic through.

You may also specify additional options, like dhcp-client to indicate that the interface needs to be configured via dhcp. This will automatically generate per-interface rules to allow dhcp traffic.

Policies

Policies indicate how traffic should flow between zones by default. Policies don’t deal with protocols or port numbers however, they just provide a default action for when there are no rules to match specific kind of traffic by the actual rules.

The default is to drop all traffic between any two zones. Any traffic not destined to a zone (like a missing interface definition in the interfaces config) is also dropped by default.

Example:

---
# Allow all outgoing traffic from local machine
- source: fw
  dest: lan
  policy: accept

# Drop everything from lan zone by default and log all attempts
- source: lan
  dest: fw
  policy: drop
  log: true

Rules

Rules specify more precisely what traffic is allowed in what direction and they work in conjunction with policies to create the final firewall configuration.

Rules are inserted to nftables using the same order as in the rules file. This will allow more fine grained access rules to be created.

---
- comment: Allow SSH from LAN to the firewall
  action: accept
  source: lan
  dest: fw
  proto: tcp
  destport: 22
  log: true
- comment: Allow PING from fw to LAN
  action: accept
  source: lan
  dest: fw
  proto: [icmp, icmpv6]
  type: echo-request

There is a separate documentation for rules where you will find more in-depth examples.

Include rules from other files

Rules may also be included from other files or directories. If you have multiple configurations, you can share some rules between them in this way.

You can include single files using include: /path/to/file.yml or complete directories with include_directory:

include: /path/to/default/rules.yml
include_directory: path/to/many/files/

Note

include_directory only supports relative imports at this time. Recursion is also unsupported for now.

Included rules will be processed in the order they are included. In case of directory includes, the files will be sorted by name before reading their contents.

---

NAT (Network Address Translation)

Conifw currently supports three modes of NAT:

• Masquerade

• SNAT

• DNAT

See nat rules for more information.