;-----------------------------------------------------------------------------
; CONFIGURATION FILE
;-----------------------------------------------------------------------------
; Purpose..:  Define global settings and security levels for the Firewall.
; Syntax...:  Records begin in first position of a line.
;             Strings and IP addresses must be in quotes.
;             Blank line(s) terminate a record.
;             Lines starting with the '#' or ';' denote a comment.
;             Default values provided by matching file in the TEMPLATE dir.
;             Records must have unique names.
; Help.....:  Product documentation and matching template/.dct file.
; Errors...:  Written to logs/firewall.log
;_____________________________________________________________________________

;-----------------------------------------------------------------------------
; Use the Security-Level parameter in the SETTINGS to select a pre-
; configured security profile. Refer to the 'Comments' of each level for
; a brief decription of the included security features. The levels are
; designed to be cumulative. Valid level names are Level-nn (where nn is 0
; to 19 - both included). Level-0 offers the lowest security.
;-----------------------------------------------------------------------------


SETTINGS    Security-Level = 5,
            Safe-Mail-Relay-Addresses = "192.168.0.*",
            Safe-Mail-Relay-Domains = "fx.dk",


Level-0     Comment = "Clean Firewall w/NAT support. Firewall PC ports are not blocked.",
            Block-FW-Ports = No,
            Max-Connections = 0,
            Dynamic-Firewall = Disabled,

Level-1     Comment = "Warning on incoming Ping and Traceroute.",
            Block-FW-Ports = No,
            Rules = "base/base alerts/icmp",
            Max-Connections = 0,
            Dynamic-Firewall = Disabled,

Level-2     Comment = "Alerting of incoming popular TCP connections (to file). Full TCP connection logging (to file). Real-time TCP connection table (can be monitored).",
            Block-FW-Ports = No,
            Rules = "base/base base/monitors alerts/icmp alerts/tcp contrack/incoming contrack/outgoing",
            Dynamic-Firewall = Disabled,

Level-3     Comment = "All dropped packets logged to droppkts.log. Rejected TCP connections logged to rejects.log. Warning of 30 dropped packets within 30 minutes.",
            Block-FW-Ports = No,
            Rules = "base/base base/monitors alerts/icmp alerts/tcp contrack/incoming contrack/outgoing alerts/dropped contrack/rejects policy/drop-log",

Level-4     Comment = "ICMP limited to Ping/Traceroute support. Traffic shaping is enabled.",
            Block-FW-Ports = No,
            Rules = "base/base base/monitors alerts/icmp alerts/tcp contrack/incoming contrack/outgoing alerts/dropped contrack/rejects policy/drop-log",
            Allowed-ICMP = "+8 +0 +3 +11",

Level-5     Comment = "Firewall Ports blocked. Port scan alerting. Packets bigger than 6K rejected. URL's bigger than 1024 bytes rejected.  All NetBIOS/SMP File & Print Sharing denied. Warning after 3 invalid GUI passwords sent by one user. LoveSan worm rejected.",
            Rules = "base/base base/monitors alerts/icmp alerts/tcp contrack/incoming contrack/outgoing alerts/dropped contrack/rejects policy/drop-log intrsion/big-url intrsion/bad-url intrsion/big-pkt alerts/portscan policy/netbios policy/gui-auth virus/lovesan",
            Allowed-ICMP = "+8 +0 +3 +11",

Level-6     Comment = "ICMP limited to -outgoing- Ping and Traceroute. Port scanners blacklisted. (D)DOS ping and SYN flood gives blacklisting. Executable e-mail attachments logged and renamed to *.qqq. Blacklisting users who sent an invalid GUI password 3 times.",
            Safe-Mail = Yes,
            Safe-Mail-Action = Rename,
            Safe-Mail-Relay-Control = Yes,
            Rules = "base/base base/monitors alerts/icmp alerts/tcp contrack/incoming contrack/outgoing alerts/dropped contrack/rejects policy/drop-log intrsion/big-url intrsion/bad-url intrsion/big-pkt alerts/portscan dos/flood policy/netbios policy/gui-auth virus/lovesan policy/portscan",
            Allowed-ICMP = "-8 +0 +3 +11",

Level-7     Comment = "Intrusion detection w/denial of virus, exploits, (D)DOS, scan signatures. Alerts on TELNET and FTP authentication failures.",
            Safe-Mail = Yes,
            Safe-Mail-Action = Rename,
            Safe-Mail-Relay-Control = Yes,
            Rules = "base/base base/monitors alerts/icmp alerts/tcp contrack/incoming contrack/outgoing alerts/dropped contrack/rejects policy/drop-log virus/virus intrsion/big-url intrsion/bad-url intrsion/big-pkt alerts/portscan dos/flood policy/netbios policy/gui-auth virus/lovesan alerts/login policy/portscan",
            Allowed-ICMP = "-8 +0 +3 +11",

Level-8     Comment = "UDP limited to DNS traffic. 30 dropped packets give blacklisting. Blacklisting on any packet to lure-ports 22 and 23. Logging of all HTTP requests (URLs). ICMP Echo denied after 20 ping packets within 10 minutes. E-mail attachments are filtered out.",
            Safe-Mail = Yes,
            Safe-Mail-Action = Deny,
            Safe-Mail-Relay-Control = Yes,
            Rules = "base/base base/monitors alerts/icmp alerts/tcp contrack/incoming contrack/outgoing alerts/dropped contrack/rejects policy/drop-bl virus/virus virus/lovesan intrsion/big-url intrsion/bad-url intrsion/big-pkt alerts/portscan dos/flood policy/netbios policy/gui-auth alerts/login policy/portscan policy/icmp policy/lure intrsion/backdoor policy/dns contrack/url",
            Allowed-ICMP = "-8 +0 +3 +11",

Level-9     Comment = "All traffic blocked by default. All traffic to pass through the firewall must be allowed by rule.",
            Safe-Mail = Yes,
            Safe-Mail-Action = Deny,
            Safe-Mail-Relay-Control = Yes,
            Firewall-Mode = Deny-By-Default,
            Rules = "base/base base/monitors alerts/icmp alerts/tcp contrack/incoming contrack/outgoing alerts/dropped contrack/rejects policy/drop-bl virus/virus virus/lovesan intrsion/big-url intrsion/bad-url intrsion/big-pkt alerts/portscan dos/flood policy/netbios policy/gui-auth alerts/login policy/portscan policy/icmp policy/lure intrsion/backdoor policy/dns contrack/url",
            Allowed-ICMP = "-8 +0 +3 +11",

Level-10    Comment = "Allow only IPSec and DNS lookup traffic.",
            Rules = "base/base base/monitors policy/ipsec",
            Allowed-ICMP = "",
