filtergen8
Packet filter compiler
Usage
filtergen [{-h | --help}]
[{-V | --version}]
[{-c | --compile}]
[{-t
target | --target=target}]
[{-o
outfile | --output=outfile}]
infile
filtergen [{-h | --help}]
[{-V | --version}]
[{-c | --compile}]
[{-t
target | --target=target}]
[{-o
outfile | --output=outfile}]
[{-F
policy | --flush=policy}]
Overview
filtergen compiles a high-level filtering description language into a variety of target formats.
Usage
filtergen reads the ruleset from the infile specified on the command line (or standard input if infile is "-") and outputs to standard output (or outfile) via an optionally specified backend.
Both short and GNU-style long option options are accepted:
- -c, --compile
-
Only try to "compile" the input, and do not generate any output. This may be useful to check that an input file has no syntax errors in it before one attempts to use the result on a live server.
- -t target-filter, --target=target-filter
-
If specified, target-filter will be used to select an output filter type, otherwise the default of
iptableswill be used. Supported backends areiptables,ip6tables,iptables-restore,ip6tables-restore,ipchains,ipfilterandcisco(for Cisco IOS access-lists).
- -F policy, --flush=policy
-
Flush mode. Generate a set of rules for clearing all rules from the packet filter. Useful for firewall scripts that need to `shutdown' the firewall. You can supply a policy argument in place of the usual filename, to specify whether the flushed filter should default to
accept,reject, ordrop. It defaults toaccept, equivalent to having no filter loaded at all. It is not necessary to specify an infile when using flush mode.
- -o outfile, --output=outfile
-
Write output to outfile instead of standard output.
- -h, --help
-
Show command help.
- -V, --version
-
Show program version.
Releases
11 releases since Debian 3.1 (Sarge); the text changed 1 time.