<?xml version="1.0"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase version="0.10.3" id="root">
<AnyNetwork comment="Any Network" id="sysid0" library="Standard" name="Any" address="0.0.0.0" netmask="0.0.0.0"/>
<AnyIPService comment="Any IP Service" id="sysid1" library="Standard" name="Any" protocol_num="0"/>
<AnyInterval comment="Any Interval" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" id="sysid2" library="Standard" name="Any" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
<ObjectGroup id="sysid3" library="Standard" name="ScratchPad"/>
<ObjectGroup id="stdid01" library="Standard" name="Objects">
<ObjectGroup id="stdid04" library="Standard" name="Groups"/>
<ObjectGroup id="stdid02" library="Standard" name="Hosts">
<Host address="192.168.1.10" comment="" id="host-hostA" name="hostA" snmp_read_community="public" snmp_write_community="">
<Interface address="192.168.1.10" dyn="False" id="host-hostA-i" name="unknown" netmask="255.255.255.255" physAddress="" security_level="0"/>
<HostOptions>
<Option name="use_mac_addr_filter">false</Option>
</HostOptions>
</Host>
<Host address="192.168.1.20" comment="" id="host-hostB" name="hostB" snmp_read_community="public" snmp_write_community="">
<Interface address="192.168.1.20" dyn="False" id="host-hostB-i" name="unknown" netmask="255.255.255.255" physAddress="" security_level="0"/>
<HostOptions>
<Option name="use_mac_addr_filter">false</Option>
</HostOptions>
</Host>
<Host address="211.11.11.11" comment="" id="host-secondary1.com" name="secondary1.com" snmp_read_community="public" snmp_write_community="">
<Interface address="211.11.11.11" dyn="False" id="host-secondary1.com-i" name="unknown" netmask="255.255.255.255" physAddress="" security_level="0"/>
<HostOptions>
<Option name="use_mac_addr_filter">false</Option>
</HostOptions>
</Host>
<Host address="211.22.22.22" comment="" id="host-secondary2.com" name="secondary2.com" snmp_read_community="public" snmp_write_community="">
<Interface address="211.22.22.22" dyn="False" id="host-secondary2.com-i" name="unknown" netmask="255.255.255.255" physAddress="" security_level="0"/>
<HostOptions>
<Option name="use_mac_addr_filter">false</Option>
</HostOptions>
</Host>
</ObjectGroup>
<ObjectGroup id="stdid03" library="Standard" name="Networks">
<Network comment="" id="net-Internal_net" name="Internal_net" address="192.168.1.0" netmask="255.255.255.0"/>
</ObjectGroup>
</ObjectGroup>
<ServiceGroup id="stdid05" library="Standard" name="Services">
<CustomService comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually statefule firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." id="stdid14" library="Standard" name="ESTABLISHED">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
</CustomService>
<ServiceGroup id="stdid10" library="Standard" name="Groups">
<ServiceGroup comment="" id="sg-DHCP" library="Standard" name="DHCP">
<ServiceRef ref="udp-bootpc"/>
<ServiceRef ref="udp-bootps"/>
</ServiceGroup>
<ServiceGroup comment="" id="sg-NETBIOS" library="Standard" name="NETBIOS">
<ServiceRef ref="udp-netbios-dgm"/>
<ServiceRef ref="udp-netbios-ns"/>
<ServiceRef ref="udp-netbios-ssn"/>
</ServiceGroup>
<ServiceGroup comment="" id="sg-Useful_ICMP" library="Standard" name="Useful_ICMP">
<ServiceRef ref="icmp-Time_exceeded"/>
<ServiceRef ref="icmp-Time_exceeded_in_transit"/>
<ServiceRef ref="icmp-ping_reply"/>
<ServiceRef ref="icmp-Unreachables"/>
</ServiceGroup>
</ServiceGroup>
<ServiceGroup id="stdid07" library="Standard" name="ICMP">
<ICMPService code="1" comment="" id="icmp-Host_unreach" library="Standard" name="Host_unreach" type="3"/>
<ICMPService code="3" comment="Port unreachable" id="icmp-Port_unreach" library="Standard" name="Port_unreach" type="3"/>
<ICMPService code="0" comment="" id="icmp-Time_exceeded" library="Standard" name="Time_exceeded" type="11"/>
<ICMPService code="1" comment="" id="icmp-Time_exceeded_in_transit" library="Standard" name="Time_exceeded_in_transit" type="11"/>
<ICMPService code="0" comment="" id="icmp-ping_reply" library="Standard" name="ping_reply" type="0"/>
<ICMPService code="0" comment="" id="icmp-ping_request" library="Standard" name="ping_request" type="8"/>
<ICMPService code="-1" comment="all icmp &quot;unreachables&quot;" id="icmp-Unreachables" library="Standard" name="all_icmp_unreachables" type="3"/>
</ServiceGroup>
<ServiceGroup id="stdid06" library="Standard" name="IP">
<IPService comment="" fragm="False" id="ip-IPSEC" library="Standard" lsrr="False" name="IPSEC" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False"/>
<IPService comment="'Short' fragments" fragm="False" id="ip-IP_Fragments" library="Standard" lsrr="False" name="ip_fragments" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False"/>
<IPService comment="Route recording packets" fragm="False" id="ip-RR" library="Standard" lsrr="False" name="RR" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False"/>
<IPService comment="All sorts of Source Routing Packets" fragm="False" id="ip-SRR" library="Standard" lsrr="True" name="SRR" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False"/>
</ServiceGroup>
<ServiceGroup id="stdid09" library="Standard" name="TCP">
<TCPService ack_flag="False" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" id="tcp-ALL_TCP_Masqueraded" library="Standard" name="ALL_TCP_Masqueraded" rst_flag="False" src_range_end="65095" src_range_start="61000" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" id="tcp-All_TCP" library="Standard" name="All_TCP" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="113" dst_range_start="113" fin_flag="False" id="tcp-Auth" library="Standard" name="auth" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="53" dst_range_start="53" fin_flag="False" id="tcp-DNS_zone_transf" library="Standard" name="dns-tcp" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="21" dst_range_start="21" fin_flag="False" id="tcp-FTP" library="Standard" name="ftp" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="65535" dst_range_start="1024" fin_flag="False" id="tcp-FTP_data" library="Standard" name="ftp_data" rst_flag="False" src_range_end="20" src_range_start="20" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="80" dst_range_start="80" fin_flag="False" id="tcp-HTTP" library="Standard" name="http" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="6667" dst_range_start="6667" fin_flag="False" id="tcp-IRC" name="irc" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="119" dst_range_start="119" fin_flag="False" id="tcp-NNTP" library="Standard" name="nntp" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="25" dst_range_start="25" fin_flag="False" id="tcp-SMTP" library="Standard" name="smtp" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="22" dst_range_start="22" fin_flag="False" id="tcp-SSH" library="Standard" name="ssh" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="0" dst_range_start="0" fin_flag="False" id="tcp-TCP-SYN" library="Standard" name="tcp-syn" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="True"/>
<TCPService ack_flag="False" comment="" dst_range_end="23" dst_range_start="23" fin_flag="False" id="tcp-Telnet" library="Standard" name="telnet" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
<TCPService ack_flag="False" comment="" dst_range_end="540" dst_range_start="540" fin_flag="False" id="tcp-uucp" library="Standard" name="uucp" rst_flag="False" src_range_end="0" src_range_start="0" syn_flag="False"/>
</ServiceGroup>
<ServiceGroup id="stdid08" library="Standard" name="UDP">
<UDPService comment="" dst_range_end="0" dst_range_start="0" id="udp-ALL_UDP_Masqueraded" library="Standard" name="ALL_UDP_Masqueraded" src_range_end="65095" src_range_start="61000"/>
<UDPService comment="" dst_range_end="0" dst_range_start="0" id="udp-All_UDP" library="Standard" name="All_UDP" src_range_end="0" src_range_start="0"/>
<UDPService comment="" dst_range_end="53" dst_range_start="53" id="udp-DNS" library="Standard" name="DNS" src_range_end="" src_range_start=""/>
<UDPService comment="" dst_range_end="161" dst_range_start="161" id="udp-SNMP" library="Standard" name="SNMP" src_range_end="" src_range_start=""/>
<UDPService comment="" dst_range_end="68" dst_range_start="68" id="udp-bootpc" library="Standard" name="bootpc" src_range_end="0" src_range_start="0"/>
<UDPService comment="" dst_range_end="67" dst_range_start="67" id="udp-bootps" library="Standard" name="bootps" src_range_end="0" src_range_start="0"/>
<UDPService comment="" dst_range_end="138" dst_range_start="138" id="udp-netbios-dgm" library="Standard" name="netbios-dgm" src_range_end="0" src_range_start="0"/>
<UDPService comment="" dst_range_end="137" dst_range_start="137" id="udp-netbios-ns" library="Standard" name="netbios-ns" src_range_end="0" src_range_start="0"/>
<UDPService comment="" dst_range_end="139" dst_range_start="139" id="udp-netbios-ssn" library="Standard" name="netbios-ssn" src_range_end="0" src_range_start="0"/>
<UDPService comment="" dst_range_end="123" dst_range_start="123" id="udp-ntp" library="Standard" name="ntp" src_range_end="0" src_range_start="0"/>
</ServiceGroup>
<ServiceGroup id="stdid13" library="Standard" name="Custom_Services">
<CustomService comment="works in iptables and requires patch-o-matic" id="id3B64EEA8" library="Standard" name="rpc">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
</CustomService>
<CustomService comment="IRC connection tracker, supports DCC. Works with iptables and requires patch-o-matic" id="id3B64EF4E" library="Standard" name="irc-conn">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
</CustomService>
<CustomService comment="Port scan detector, works only with iptables and  requires patch-o-matic " id="id3B64EF50" library="Standard" name="psd">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
</CustomService>
<CustomService comment="Matches a string in a whole packet, works with iptables and requires patch-o-matic" id="id3B64EF52" library="Standard" name="string">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
</CustomService>
<CustomService comment="Talk protocol support. Works with iptables and requires patch-o-matic" id="id3B64EF54" library="Standard" name="talk">
<CustomServiceCommand platform="Undefined"></CustomServiceCommand>
<CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
<CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
</CustomService>
</ServiceGroup>
</ServiceGroup>
<ObjectGroup id="stdid12" library="Standard" name="Firewalls">
<Firewall address="222.222.222.222" comment="example #2  created  01/24/2001 converted to v0.9 format 04/26/2001" host_OS="linux24" id="fw-firewall2" name="firewall" platform="iptables" snmp_read_community="public" snmp_write_community="" version="">
<NAT id="nat-firewall2">
<NATRule comment="" disabled="False" id="nat-firewall2-0" position="0">
<OSrc neg="False">
<ObjectRef ref="net-Internal_net"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="sysid0"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="sysid1"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="fw-firewall2"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="sysid0"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="sysid1"/>
</TSrv>
<NATRuleOptions/>
</NATRule>
<NATRule comment="" disabled="False" id="nat-firewall2-1" position="1">
<OSrc neg="False">
<ObjectRef ref="sysid0"/>
</OSrc>
<ODst neg="False">
<ObjectRef ref="fw-firewall2"/>
</ODst>
<OSrv neg="False">
<ServiceRef ref="tcp-SMTP"/>
</OSrv>
<TSrc neg="False">
<ObjectRef ref="sysid0"/>
</TSrc>
<TDst neg="False">
<ObjectRef ref="host-hostA"/>
</TDst>
<TSrv neg="False">
<ServiceRef ref="tcp-SMTP"/>
</TSrv>
<NATRuleOptions/>
</NATRule>
</NAT>
<Policy id="pol-firewall2">
<PolicyRule action="Accept" comment="" disabled="False" id="pol-firewall2-2" log="False" position="0">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="host-hostA"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="tcp-SMTP"/>
<ServiceRef ref="udp-DNS"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
<PolicyRule action="Accept" comment="" disabled="False" id="pol-firewall2-3" log="False" position="1">
<Src neg="False">
<ObjectRef ref="host-secondary1.com"/>
<ObjectRef ref="host-secondary2.com"/>
</Src>
<Dst neg="False">
<ObjectRef ref="host-hostA"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="tcp-DNS_zone_transf"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
<PolicyRule action="Accept" comment="" disabled="False" id="pol-firewall2-4" log="False" position="2">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="net-Internal_net"/>
<ObjectRef ref="fw-firewall2"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sg-Useful_ICMP"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
<PolicyRule action="Accept" comment="need this for traceroute" disabled="False" id="id3C23933D" log="False" position="3">
<Src neg="False">
<ObjectRef ref="fw-firewall2"/>
</Src>
<Dst neg="False">
<ObjectRef ref="net-Internal_net"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="icmp-Time_exceeded"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
<PolicyRule action="Accept" comment="Automatically generated 'masquerading' rule" disabled="False" id="pol-firewall2-5" log="False" position="4">
<Src neg="False">
<ObjectRef ref="net-Internal_net"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
<PolicyRule action="Reject" comment="send TCP RST to reject connections to IDENT daemon" disabled="False" id="id3C239480" log="False" position="5">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="fw-firewall2"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="tcp-Auth"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions>
<Option name="action_on_reject">TCP RST</Option>
<Option name="limit_suffix"></Option>
<Option name="limit_value">0</Option>
<Option name="log_prefix"></Option>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Deny" comment="Automatically generated 'catch all' rule" disabled="False" id="pol-firewall2-7" log="True" position="6">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
</Policy>
<Interface address="222.222.222.222" dyn="False" id="if-FW-firewall2-eth1" name="eth1" netmask="255.255.255.0" physAddress="" security_level="0">
<InterfacePolicy id="pol-firewall2-eth1">
<PolicyRule action="Deny" comment="Automatically generated rule blocking short fragments" direction="Inbound" disabled="False" id="pol-firewall2-0" log="True" position="0">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="ip-IP_Fragments"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
<PolicyRule action="Deny" comment="Automatically generated anti-spoofing rule" direction="Inbound" disabled="False" id="pol-firewall2-1" log="True" position="1">
<Src neg="False">
<ObjectRef ref="net-Internal_net"/>
<ObjectRef ref="fw-firewall2"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
<PolicyRule action="Deny" direction="Inbound" disabled="False" id="id3B6C77D2" log="True" position="2">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="id3B64EF50"/>
</Srv>
<PolicyRuleOptions>
<Option name="action_on_reject"></Option>
<Option name="limit_value">0</Option>
<Option name="log_limit_suffix"></Option>
<Option name="log_prefix"></Option>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
</InterfacePolicy>
</Interface>
<Interface address="192.168.1.1" dyn="False" id="if-FW-firewall2-eth0" name="eth0" netmask="255.255.255.0" physAddress="" security_level="100"/>
<FirewallOptions>
<Option name="accept_established">True</Option>
<Option name="accept_new_tcp_with_no_syn">True</Option>
<Option name="action_on_reject">ICMP net unreachable</Option>
<Option name="clamp_mss_to_mtu">False</Option>
<Option name="cmdline"></Option>
<Option name="compiler"></Option>
<Option name="debug">False</Option>
<Option name="dyn_addr">False</Option>
<Option name="firewall_is_part_of_any_and_networks">True</Option>
<Option name="inst_cmdline"></Option>
<Option name="inst_script"></Option>
<Option name="limit_suffix">/day</Option>
<Option name="limit_value">0</Option>
<Option name="linux24_ip_forward">1</Option>
<Option name="linux24_tcp_fin_timeout">30</Option>
<Option name="linux24_tcp_keepalive_interval">1800</Option>
<Option name="load_modules">False</Option>
<Option name="log_all_dropped">True</Option>
<Option name="log_ip_opt">False</Option>
<Option name="log_level">warning</Option>
<Option name="log_limit_suffix">/second</Option>
<Option name="log_limit_value">0</Option>
<Option name="log_prefix"></Option>
<Option name="log_tcp_opt">False</Option>
<Option name="log_tcp_seq">False</Option>
<Option name="manage_virtual_addr">True</Option>
<Option name="no_iochains_for_any">False</Option>
<Option name="no_optimisation">False</Option>
<Option name="platform">iptables</Option>
<Option name="script_env_path"></Option>
<Option name="snmp_contact"></Option>
<Option name="snmp_description"></Option>
<Option name="snmp_location"></Option>
<Option name="use_numeric_log_levels">False</Option>
</FirewallOptions>
</Firewall>
<Firewall address="22.22.22.22" comment="firewall protects host it is running on" host_OS="linux24" id="id3AF5A2BA" name="host" platform="iptables" snmp_read_community="public" snmp_write_community="" version="">
<NAT id="id3AF5A2BD"/>
<Policy id="id3AF5A2BC">
<PolicyRule action="Deny" comment="block fragments and port scans" disabled="False" id="id3AF5A74B" log="True" position="0">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id3AF5A2BA"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="ip-IP_Fragments"/>
<ServiceRef ref="id3B64EF50"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
<PolicyRule action="Accept" disabled="False" id="id3AF5A73A" log="False" position="1">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id3AF5A2BA"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="tcp-SMTP"/>
<ServiceRef ref="tcp-HTTP"/>
<ServiceRef ref="tcp-SSH"/>
<ServiceRef ref="tcp-FTP"/>
<ServiceRef ref="tcp-Telnet"/>
<ServiceRef ref="icmp-Unreachables"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
<PolicyRule action="Accept" comment="allow all outgoing connections" disabled="False" id="id3AF5A757" log="False" position="2">
<Src neg="False">
<ObjectRef ref="id3AF5A2BA"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
<PolicyRule action="Deny" comment="'catch all' rule" disabled="False" id="id3AF5A762" log="True" position="3">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<When neg="False">
<IntervalRef ref="sysid2"/>
</When>
<PolicyRuleOptions/>
</PolicyRule>
</Policy>
<Interface address="22.22.22.22" dyn="False" id="id3AF5A2CB" name="eth0" netmask="255.255.255.0" physAddress="" security_level="100">
<InterfacePolicy id="id3AF5A2CD"/>
</Interface>
<Interface address="127.0.0.1" dyn="False" id="id3B6C7A3B" name="lo" netmask="255.0.0.0" physAddress="" security_level="100">
<InterfacePolicy id="id3B6C7A3C">
<PolicyRule action="Accept" comment="allow everything on loopback" direction="Inbound" disabled="False" id="id3B6C7A72" log="False" position="0">
<Src neg="False">
<ObjectRef ref="sysid0"/>
</Src>
<Dst neg="False">
<ObjectRef ref="id3AF5A2BA"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<PolicyRuleOptions>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
<PolicyRule action="Accept" comment="allow everything on loopback" direction="Outbound" disabled="False" id="id3B6C7A7B" log="False" position="1">
<Src neg="False">
<ObjectRef ref="id3AF5A2BA"/>
</Src>
<Dst neg="False">
<ObjectRef ref="sysid0"/>
</Dst>
<Srv neg="False">
<ServiceRef ref="sysid1"/>
</Srv>
<PolicyRuleOptions>
<Option name="stateless">True</Option>
</PolicyRuleOptions>
</PolicyRule>
</InterfacePolicy>
</Interface>
<FirewallOptions>
<Option name="accept_established">True</Option>
<Option name="accept_new_tcp_with_no_syn">True</Option>
<Option name="action_on_reject">ICMP net unreachable</Option>
<Option name="cmdline"></Option>
<Option name="compiler"></Option>
<Option name="debug">False</Option>
<Option name="dyn_addr">False</Option>
<Option name="firewall_is_part_of_any_and_networks">False</Option>
<Option name="inst_cmdline"></Option>
<Option name="inst_script"></Option>
<Option name="linux24_ip_forward">0</Option>
<Option name="load_modules">False</Option>
<Option name="log_all_dropped">False</Option>
<Option name="log_ip_opt">False</Option>
<Option name="log_level">warning</Option>
<Option name="log_limit_suffix">/second</Option>
<Option name="log_limit_value">0</Option>
<Option name="log_prefix"></Option>
<Option name="log_tcp_opt">False</Option>
<Option name="log_tcp_seq">False</Option>
<Option name="manage_virtual_addr">False</Option>
<Option name="no_iochains_for_any">False</Option>
<Option name="no_optimisation">False</Option>
<Option name="platform">iptables</Option>
<Option name="snmp_contact"></Option>
<Option name="snmp_description"></Option>
<Option name="snmp_location"></Option>
</FirewallOptions>
</Firewall>
</ObjectGroup>
<IntervalGroup id="stdid11" library="Standard" name="Time">
<Interval comment="any day, 9:00am through 5:00pm" from_day="-1" from_hour="9" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" id="int-workhours" library="Standard" name="workhours" to_day="-1" to_hour="17" to_minute="0" to_month="-1" to_weekday="-1" to_year="-1"/>
<Interval comment="weekends: Saturday 0:00 through Sunday 23:59 " from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="7" from_year="-1" id="int-weekends" library="Standard" name="weekends" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="1" to_year="-1"/>
<Interval comment="any day 6:00pm - 12:00am" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" id="int-afterhours" library="Standard" name="afterhours" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1"/>
</IntervalGroup>
</FWObjectDatabase>