<?xml version="1.0" encoding="ISO-8859-1" ?>

<NetML xmlns="http://www.xmlnetwork.org" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.xmlnetwork.org netml.xsd">

   <Networks>
      <n id="n-A">
         <networkAddress>135.207.10.0/24</networkAddress>
         <CollisionDomains>
            <c id="C0">
               <iface r_id="r_1" if="eth0"/>
            </c>
         </CollisionDomains>
      </n>
   </Networks>
   <Routers>
      <RouterConf id="r_1" Hostname="pc1">
         <Interface name="eth0">
            <ipAddress>135.207.10.1</ipAddress>
         </Interface>
      </RouterConf>
   </Routers>


<Firewalls>
<FwallConf>

<fw_id>001</fw_id>
<link>r_1</link>

<acl>

   

	<name>standard</name>
	<effect>protect from common attacks</effect>

	 <policy>deny</policy>

	<construct name="loopback" description="allow in and outbound loopback connections">
		<rule id="loop">
			<action>permit</action>
			<protocol>all</protocol>
			<source>any</source>
			<destination>any</destination>
			<interface>
				<via>lo0</via>
			</interface>
		</rule>
	</construct>

	<construct description="allow established connections">
		<rule id="est1">
			<action>permit</action>
			<protocol>tcp</protocol>
			<source>any</source>
			<destination>any</destination>
	
			<options>
				<state>established</state>
			</options>
		</rule>
		<rule id="est2">
			<action>permit</action>
			<protocol>udp</protocol>
			<source>any</source>
			<destination>any</destination>
	
			<options>
				<state>established</state>
			</options>
		</rule>
	</construct>






	<construct name="no frags" description="deny fragmented packets">
		<rule id="f1">
			<action>deny</action>
			<protocol>all</protocol>
			<options>
				<fragmented/>
			</options>
		</rule>
	</construct>

	<construct name="Spoof Prevention" description="Prevents spoofing over untrusted interface (eth0 = internet)">
		<!-- interface eth0=outer interface-->

		<rule id="2">
			<action>deny</action>
			<log/>
			<protocol>all</protocol>
			<source>135.207.10.1</source>
			<destination>any</destination>
			<interface>
				<direction>in</direction>
				<via>eth0</via>
			</interface>
		</rule>
		<rule id="3">
			<action>deny</action>
			<log/>
			<protocol>all</protocol>
			<source>127.0.0.1</source>
			<destination>any</destination>
			<interface>
				<direction>in</direction>
				<via>eth0</via>
			</interface>
		</rule>

		</construct>

	
	<construct name="deny unroutable" description="prevent unroutable nets from entering the internet interface">
		<rule id="a">
			<action>deny</action>
			<log/>
			<protocol>all</protocol>
			<source mask="255.0.0.0">0.0.0.0</source>
			<destination>any</destination>
			<interface>
				<direction>in</direction>
				<via>eth0</via>
			</interface>
		</rule>

		<rule id="b">
			<action>deny</action>
			<log/>
			<protocol>all</protocol>
			<source mask="255.255.0.0">169.254.0.0</source>
			<destination>any</destination>
			<interface>
				<direction>in</direction>
				<via>eth0</via>
			</interface>
		</rule>
		<rule id="c">
			<action>deny</action>
			<log/>
			<protocol>all</protocol>
			<source mask="255.255.255.0">192.0.2.0</source>
			<destination>any</destination>
			<interface>
				<direction>in</direction>
				<via>eth0</via>
			</interface>
		</rule>
		<rule id="d">
			<action>deny</action>
			<log/>
			<protocol>all</protocol>
			<source mask="255.0.0.0">224.0.0.0</source>
			<destination>any</destination>
			<interface>
				<direction>in</direction>
				<via>eth0</via>
			</interface>
		</rule>
		<rule id="e">
			<action>deny</action>
			<log/>
			<protocol>all</protocol>
			<source mask="255.0.0.0">240.0.0.0</source>
			<destination>any</destination>
			<interface>
				<direction>in</direction>
				<via>eth0</via>
			</interface>
		</rule>
		</construct>


			<construct name="tcp in/out" description="allow outbound tcp traffic, permit inbound,except connection initiation">
		<rule id="tcp_out">
			<action>permit</action>
			<protocol>tcp</protocol>
			<source>135.207.10.1</source>
			<interface>
			<direction>out</direction>
			<via>eth0</via>
			</interface>
			<!--this host-->
			<destination>any</destination>
		</rule>
		<rule id="deny_tcp_conn_in">
			<action>deny</action>
			<protocol>tcp</protocol>
			<source>any</source>
			<interface>
				<direction>in</direction><via>eth0</via>
			</interface>
			<destination>135.207.10.1</destination>
			<options>
				<state>new</state>
			</options>
		</rule>
		<rule id="permit_tcp_in">
			<action>permit</action>
			<protocol>tcp</protocol>
			<source>any</source>
			<interface>
				<direction>in</direction>
			</interface>
			<destination>135.207.10.1</destination>
		</rule>
	</construct>

	<construct name="udp" description="allow dns and NTP traffic">
		<rule id="dns-ntp-in">
			<action>permit</action>
			<protocol>udp</protocol>
			<source>any</source>
			<destination>135.207.10.1</destination>
			<options>
				<sourceport>53</sourceport>
				<sourceport>123</sourceport>
			</options>
		</rule>
		<rule id="dns-ntp-out">
			<action>permit</action>
			<protocol>udp</protocol>
			<source>135.207.10.1</source>
			<destination>any</destination>
			<options>
				<destport>53</destport>
				<destport>123</destport>
			</options>
		</rule>
	</construct>

	<construct name="icmp" description="allow ping, ping reply, time-exceeded, fragmentation needed messages">
		<rule id="icmp_in">
			<action>permit</action>
			<protocol>icmp</protocol>
			<source>any</source>
			<destination>135.207.10.1</destination>
			<options>
				<IcmpType>echo-request</IcmpType>
			</options>
			<interface><direction>in</direction><via>eth0</via></interface>
		</rule>
			<rule id="icmp_in2">
			<action>permit</action>
			<protocol>icmp</protocol>
			<source>any</source>
			<destination>135.207.10.1</destination>
			<options>
				<IcmpType>echo-reply</IcmpType>
			</options>
				<interface><direction>in</direction><via>eth0</via></interface>
				</rule>
				<rule id="icmp_in3">
			<action>permit</action>
			<protocol>icmp</protocol>
			<source>any</source>
			<destination>135.207.10.1</destination>
			<options>
				<IcmpType>ttl-exceed</IcmpType>
			</options>
			<interface><direction>in</direction><via>eth0</via></interface>
		</rule>
			<rule id="icmp_in4">
			<action>permit</action>
			<protocol>icmp</protocol>
			<source>any</source>
			<destination>135.207.10.1</destination>
			<options>
				<IcmpType>source-quench</IcmpType>
			</options>
			<interface><direction>in</direction><via>eth0</via></interface>
		</rule>
		<rule id="icmp_out">
			<action>permit</action>
			<protocol>icmp</protocol>
			<source>135.207.10.1</source>
			<destination>any</destination>
			<interface><direction>out</direction><via>eth0</via></interface>
			<options>
				<IcmpType>echo-request</IcmpType>
			</options>
		</rule>
			<rule id="icmp_out2">
			<action>permit</action>
			<protocol>icmp</protocol>
			<source>135.207.10.1</source>
			<destination>any</destination>
			<interface><direction>out</direction><via>eth0</via></interface>
			<options>
				<IcmpType>echo-reply</IcmpType>
			</options>
		</rule>
	</construct>

</acl>

</FwallConf>

</Firewalls>

</NetML>

