;
; Sample configuration file for SafeFire Firewall 1.2+.
;
; Copy it to SFIRE.CFG to put it to work.
;
; Many variables have reasonable default values so do not touch
; them unless you sure what you want to do.
;

[nat]           ;Network Address Translation configuration parameters

; This variable enables NAT. By default NAT is ON
;enable=yes

; This variable enables assembling packets before translation
;defragment=yes

; This variable enables forwarding of packets ignored by NAT
;forward_ignored=no

; This variables reduces set of internal IP's which will be translated
; to three ranges (see RFC1918):
; 10.0.0.0     ->   10.255.255.255
; 172.16.0.0   ->   172.31.255.255
; 192.168.0.0  ->   192.168.255.255
;
; By default this value is ON.
;private_net=yes

[ident]         ; Internal IDENT server configuration

; This variable enables internal IDENTD
;enable=yes
;
; In general response looks like following:
; 123, 12345: USERID: OS/2: os2user
;
; Following variable determines last part of response
;user=os2user

[portmap]       ; Port mapping rules. NOTE: Portmapper requires enabled NAT!

; This variable can be mentioned more than once, i.e. you can define as many
; port mappings as you wish by adding appropriate 'rule' variable.
;
; Each rule is described by two pairs addr:port as in following example:
;
;   rule = 123.45.67.89:80,192.168.1.1:8080
;
; This rule will redirect all connections going trough SafeFire to
; host 123.45.67.89 and port 80 (www) to host 192.168.1.1 and port 8080.
; You can use 0 in the place of first address if host is the same
; where SafeFire is running


; By default rules are empty
;rule=

[shaper]        ; Traffic shaper

; Sleeping time in ms within the shaper loop (def is 1)
;sleep=

; This variable can be mentioned more than once, i.e. you can define as many
; pipes as you wish by adding appropriate 'pipe' variable.
;
; Each pipe is described using following syntax (refer to documentation
; for more details):
;
;  pipe=number parm ...
;
;  parm:
;      {speed|delay|loss|length}
;
;  speed:  speed <speed> [{M|K}][bps]  default - 0 bps (no speed limit)
;  delay:  delay <delay> [s|ms]        default - 0 ms  (no delay is set)
;  loss :  loss <loss>[%]              default - 0%    (no packet loss)
;  length: length <length>             default - MAX_LENGTH (500)

;
;pipe=


[filter]        ; Packet filter

; This variable enables packet filter
;enable=no

; This variable can be mentioned more than once, i.e. you can define as many
; rules as you wish by adding appropriate 'rule' variable.
;
; Each rule is described using following syntax (refer to documentation
; for more details):
;   rule = [number] action proto src dst [extra[,...]]
;
;     action: {allow|accept|permit} | {deny|drop|reject} | count | pipe <num> | plugin <num> | skipto <num>
;
;     proto : {all|ip|tcp|udp|icmp}
;
;     src   : from [not] {any|myip|ip[{/bits|:mask}]} [{port|port-port},[port],...]
;     dst   : to [not] {any|myip|ip[{/bits|:mask}]} [{port|port-port},[port],...]
;
;     extra : {fragment|in|out|bidi|established|setup|flags}
;     flags : tcpflags [!]{syn|fin|rst|ack|psh|urg},...

;
;rule=

[mfilter]        ; Packet filter by MAC addresses

; This variable enables filter
;enable=no

; This variable can be mentioned more than once, i.e. you can define as many
; rules as you wish by adding appropriate 'rule' variable.
;
; Each rule is described using following syntax (refer to documentation
; for more details):
;   rule = [number] action [log] proto [src] [dst] [direction] [extra]
;
;     action: {allow|accept|permit} | {deny|drop|reject} | count | pipe <num> | plugin <num> | skipto <num>
;
;     proto : {all|ip|arp|proto number}
;
;     src   : from [!]{any|mac address}[=[!]{any|ip|myip}] [req_match]
;               = means matching particular MAC to particular IP in packets
;                 of some protocols (ip, arp)
;               match means matching mac address in ethernet header to the arp
;                 packet's corresponding mac address
;     dst   : to [!]{any|mac address}[=[!]{any|ip|myip}] [req_match]
;     dst   : to [not] {any|ip[{/bits|:mask}]} [{port|port-port},[port],...]
;
; direction : {in|out|bidi}
;     extra : {opt opt_number}

;
;rule=65500 allow arp from all match to all match bidi
;rule=65510 deny arp from all to all bidi
;rule=65520 allow all from all to all bidi

[key]           ; License key section
;name=
;key=

[remote]

; Remote Control section
;
; Order of checks: allow, deny
; If address of remote falls under conditions of allow and does not match
; anything in 'deny' then connection is accepted.
; All other cases only logged and connections are not permitted
;
; Format of rule (either deny and allow):
;
;  any|ip[{/bits|:mask}]
;
; NOTE: connections from address 127.0.0.1 are always enabled,
;       unless port is set to 0.

;enable = yes
;port   = 1021

;allow  =
;deny   =

; NOTE: this is NOT a default values.
; By default remote access is disabled because of empty rule sets.
;
;userid   = "userid"
;password = "password"

[log]
;console=yes
;level=7

[dhcp]

; Interval in seconds between checks of IP address change.
; Value less than or equal to 0 disables check.
;interval=5

; Enable automatic startup of filter/nat on valid address assignment
;auto_pipe=off

; Command line of the application which will be started
; when IP address change will be detected (limited to 2000 bytes).
; Command line may contain %1, %2, %3 and %4 strings. They will
; automatically be replaced with the following information:
;
; %1 - with new IP address in usual dot-delimited form
; %2 - with old IP address in usual dot-delimited form
; %3 - with new IP mask in usual dot-delimited form
; %4 - with old IP mask in usual dot-delimited form
;
;run=""

; Enable clearing up internal ARP cache on IP address change
;clear_arp=no

[device]
;unit=0
;broken_arp=no
;filter_all=no
fastmode=yes
;queuedepth=8

[plugins]
;plugin=1 c:\simple.dll
;extvar=1:abc xyz
