mirror of
https://github.com/evilsocket/opensnitch.git
synced 2025-03-04 08:34:40 +01:00
d9e0c59158
* Allow to configure firewall rules from the GUI (WIP) New features: - Configure and list system firewall rules from the GUI (nftables). - Configure chains' policies. - Add simple rules to allow incoming ports. - Add simple rules to exclude apps (ports) from being intercepted. This feature is only available for nftables. iptables is still supported, you can add rules to the configuration file and they'll be loaded, but you can't configure them from the GUI. More information: #592
238 lines
6 KiB
JSON
238 lines
6 KiB
JSON
{
|
|
"Enabled": true,
|
|
"Version": 1,
|
|
"SystemRules": [
|
|
{
|
|
"Rule": {
|
|
"Table": "mangle",
|
|
"Chain": "OUTPUT",
|
|
"Enabled": false,
|
|
"Position": "0",
|
|
"Description": "Allow icmp",
|
|
"Parameters": "-p icmp",
|
|
"Expressions": [],
|
|
"Target": "ACCEPT",
|
|
"TargetParameters": ""
|
|
},
|
|
"Chains": []
|
|
},
|
|
{
|
|
"Chains": [
|
|
{
|
|
"Name": "forward",
|
|
"Table": "filter",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "filter",
|
|
"Hook": "forward",
|
|
"Policy": "accept",
|
|
"Rules": []
|
|
},
|
|
{
|
|
"Name": "output",
|
|
"Table": "filter",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "filter",
|
|
"Hook": "output",
|
|
"Policy": "accept",
|
|
"Rules": []
|
|
},
|
|
{
|
|
"Name": "input",
|
|
"Table": "filter",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "filter",
|
|
"Hook": "input",
|
|
"Policy": "accept",
|
|
"Rules": [
|
|
{
|
|
"Enabled": false,
|
|
"Position": "0",
|
|
"Description": "Allow SSH server connections when input policy is DROP",
|
|
"Parameters": "",
|
|
"Expressions": [
|
|
{
|
|
"Statement": {
|
|
"Op": "",
|
|
"Name": "tcp",
|
|
"Values": [
|
|
{
|
|
"Key": "dport",
|
|
"Value": "22"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"Target": "accept",
|
|
"TargetParameters": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"Name": "filter-prerouting",
|
|
"Table": "nat",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "filter",
|
|
"Hook": "prerouting",
|
|
"Policy": "accept",
|
|
"Rules": []
|
|
},
|
|
{
|
|
"Name": "prerouting",
|
|
"Table": "mangle",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "mangle",
|
|
"Hook": "prerouting",
|
|
"Policy": "accept",
|
|
"Rules": []
|
|
},
|
|
{
|
|
"Name": "postrouting",
|
|
"Table": "mangle",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "mangle",
|
|
"Hook": "postrouting",
|
|
"Policy": "accept",
|
|
"Rules": []
|
|
},
|
|
{
|
|
"Name": "prerouting",
|
|
"Table": "nat",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "natdest",
|
|
"Hook": "prerouting",
|
|
"Policy": "accept",
|
|
"Rules": []
|
|
},
|
|
{
|
|
"Name": "postrouting",
|
|
"Table": "nat",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "natsource",
|
|
"Hook": "postrouting",
|
|
"Policy": "accept",
|
|
"Rules": []
|
|
},
|
|
{
|
|
"Name": "input",
|
|
"Table": "nat",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "natsource",
|
|
"Hook": "input",
|
|
"Policy": "accept",
|
|
"Rules": []
|
|
},
|
|
{
|
|
"Name": "output",
|
|
"Table": "nat",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "natdest",
|
|
"Hook": "output",
|
|
"Policy": "accept",
|
|
"Rules": []
|
|
},
|
|
{
|
|
"Name": "output",
|
|
"Table": "mangle",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "mangle",
|
|
"Hook": "output",
|
|
"Policy": "accept",
|
|
"Rules": [
|
|
{
|
|
"Enabled": true,
|
|
"Position": "0",
|
|
"Description": "Allow ICMP",
|
|
"Expressions": [
|
|
{
|
|
"Statement": {
|
|
"Op": "",
|
|
"Name": "icmp",
|
|
"Values": [
|
|
{
|
|
"Key": "type",
|
|
"Value": "echo-request"
|
|
},
|
|
{
|
|
"Key": "type",
|
|
"Value": "echo-reply"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"Target": "accept",
|
|
"TargetParameters": ""
|
|
},
|
|
{
|
|
"Enabled": false,
|
|
"Position": "0",
|
|
"Description": "Exclude WireGuard VPN from being intercepted",
|
|
"Parameters": "",
|
|
"Expressions": [
|
|
{
|
|
"Statement": {
|
|
"Op": "",
|
|
"Name": "tcp",
|
|
"Values": [
|
|
{
|
|
"Key": "dport",
|
|
"Value": "51820"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"Target": "accept",
|
|
"TargetParameters": ""
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"Name": "forward",
|
|
"Table": "mangle",
|
|
"Family": "inet",
|
|
"Priority": "",
|
|
"Type": "mangle",
|
|
"Hook": "forward",
|
|
"Policy": "accept",
|
|
"Rules": [
|
|
{
|
|
"UUID": "7d7394e1-100d-4b87-a90a-cd68c46edb0b",
|
|
"Enabled": false,
|
|
"Position": "0",
|
|
"Description": "Intercept forwarded connections (docker, etc)",
|
|
"Expressions": [
|
|
{
|
|
"Statement": {
|
|
"Op": "",
|
|
"Name": "ct",
|
|
"Values": [
|
|
{
|
|
"Key": "state",
|
|
"Value": "new"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
],
|
|
"Target": "queue",
|
|
"TargetParameters": "num 0"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|