Usage

ConiFW is activated by running the command conifw and specifying the required action. The different actions are described in more detail below.

Example:

# Print out generated ruleset directly to the console
conifw generate --stdout

You can always view the usage using conifw --help:

$ conifw --help
usage: conifw [-h] [-C CONFIG_PATH] [-d] {apply,generate,check,version} ...

ConiFW CLI Tool

positional arguments:
  {apply,generate,check,version}
    apply               Apply rules
    generate            Generate, but do not apply rules
    check               Check configuration
    version             Show version

options:
  -h, --help            show this help message and exit
  -C, --config CONFIG_PATH
                        Path to configuration directory
  -d, --debug           Enable debug logging. This is applied during early
                        program startup and before any configuration has been
                        read. Overrides log level in the configuration file.

Or view help for specific actions with conifw <action> --help:

$ conifw generate --help
usage: conifw generate [-h] [--stdout] [-o FILENAME] [-O]

options:
  -h, --help            show this help message and exit
  --stdout              Write ruleset to stdout
  -o, --filename FILENAME
                        Write ruleset to given filename
  -O, --overwrite       Overwrite existing file

Apply

(Not supported yet)

Generate

This action generates the configuration but does not apply it automatically. If used with the --filename <filename> option, you are able to generate the rules on one host and then transfer them to another host via whatever method you wish. This also means you can manage the rules for multiple remote hosts using only one instance of conifw, using separate configuration files/directories. See the configuration documentation for more details on how to use multiple configurations.

Note

Simply running conifw generate without any parameters will not produce any output (screen nor file). You will need to specify one or more of the options below to be able to view the generated configuration.

Options

-o / --filename)

Write the generated configuration to the indicated file name. An existing file will not be replaced unless -O / --overwrite is specified.

--stdout

This option will produce the generated configuration to standard output. Can be used together with -o filename to generate the file and displaying the output at the same time.

Check

The check action will process the configuration and then exit the program. It is useful for checking for any immediately obvious configuration errors.

Version

This action prints out the current version and exits the program.

Optional parameters for all actions

-C / --config

This parameter specifies an alternative location for the main configuration file. See configuration for more explanation.

-d / --debug

This will make conifw log a great deal of debug information to the console. It’s not beneficial in normal use, but may be helpful in resolving some error situations.

Furthermore, specifying this parameter on the command line will enable debug logging earlier than just changing the level in the main configuration file.