View Options

View Firewall
View Script
View Modules
View Connections

View Firewall:

The 'View Firewall' function is a very powerful tool as it gives you the ability to manage many of your firewall functions from one screen. You can Save the firewall, Export the firewall to create a boot time script, shift rules up or down, insert new rules, edit/delete rules, and view general statistics about the rules all from this one screen. Lets look at these options:

Save and Export Options:
At the top of the screen, you will see two buttons: Save Firewall and Export to rc.firewall. First, as we said before, fBuilder makes all of its changes in real time, so when you save the firewall, you are saving it so that you can get to this configuration at a later date. There is no need to save the firewall and then hit install. Second, there is a difference between Saving and Exporting. Here is what you need to know:

The 'Save Firewall' function creates a script called fw-init that is used exclusively by fBuilder. This file can restore your previously saved firewall through the fBuilder interface by clicking the 'Install Firewall' option. It is easy to forget to save your changes with fBuilder because the changes are happening in real time, but is a good to do it on a regular basis so you don't end up rebooting and having to create all of those rules again. After clicking the Save Firewall button, you will be brought to the View Script screen to see the script that was created.

The 'Export to rc.firewall' creates a file called rc.firewall in /usr/local/fbuilder by default. Actually it saves it to the directory fBuilder is installed in, so if you moved fBuilder you will know where to find it. This script can be added to your machines start up scripts so your firewall will start at boot time. The script will need to be made executable before it will work and it is a good idea to move it OUT of fBuilder directory for the boot time script. The reason to move the rc.firewall out of the directory is so you have a 'known good' configuration. If every thing goes wrong, you can always reboot to get things back. If you have your boot time scripts pointing towards the copy in the fBuilder directory, and you made a big mistake by exporting a bad configuration, it won't be as simple as rebooting. After clicking the Export to rc.firewall button, you will be brought to a screen that allows you to view the script that was created by fBuilder.

Chain Tables:
Below the save and export options, you will see a table for each of your chains. This table starts will the Chain name and gives you some basic statistics of the chain such as the default policy, the number of packets it has processed, and the number of bytes of data that has passed through the chain.

Below the table heading, you will see the column headings for the table. Below is a list of what each shows:

Shift -- Allows you to shift a rule up or down. The arrow is pointed in the direction that the rule will be shifted if the option is clicked.
Edit -- Takes you to an Edit screen (a modified New Rule screen) where you can edit or delete the rule
Insert -- Takes you to an Insert screen (a Modified New Rule screen) where you can insert a new rule into the place in the chain where the insert button was pressed.
Rule -- Shows the rule number as they are listed in memory. This is the actual order the rules will be processed
Pkts -- Shows the number of Packets the rule has matched.
L -- If limiting is enabled for this rule, a 'L' will show up in this field
Target -- Lists the target of this rule
Prot -- Lists the protocol that this rule applies to
IN -- Lists the Inbound Interface if one is applied to the rule. Shows a * if all interfaces apply. Remember, Inbound Interfaces only apply to INPUT, FORWARD, PREROUTING rules or user defined chains. If this rule is an OUTPUT or POSTROUTING rule, it will always be *.
OUT -- Lists the Outbound Interface if one is applied to the rule. Shows a * if all interfaces apply. Remember, Outbound Interfaces only apply to OUTPUT, FORWARD, POSTROUTING rules or user defined chains. If this rule is an INPUT, or PREROUTING rule, it will always be *.
Flags -- Shows if certain flags or State Checking options are set on this rule. Will show N/A if none are set.
Source -- Shows the source IP address(es) that are associated with the rule.
Dest -- Shows the destination IP address(es) that are associated with the rule.
To (Only in PREROUTING and POSTROUTING chains) -- The 'Nat To' IP address for the NAT rule
Sprt -- Source port(s) associated with the rule. Will show * for ALL ports and N/A if it is not applicable.
Dprt -- Destination port(s) associated with the rule. Will show * for ALL ports and N/A if it is not applicable.
Toprt (Only in the PREROUTING and POSTROUTING chains) -- The 'To port' associated with the NAT rule. Will show N/A if one is not set

Shift:
You can shift a rule up or down to make your firewall more efficient. If a rule is showing a lot of packets matching (by looking at the Pkts column) you can move it closer to the top of the chain. This will allow the firewall to match the packets without having to test on all of the rules located above that rule. One thing to remember is LOG rules: if you have a rule that has a LOG rule associated with it, the log rule should be higher up in the chain (a lower rule number) so that the LOG rule will match BEFORE the packet gets acted upon. Also, if you are trying to LOG failed requests, please note that you will want a log rule as the last rule in your chain before that default policy gets acted upon. The 'New Rule' function will append your new rule as the last rule in the chain, so you will want to shift it up or shift the LOG rule (that logs everything) back down to the bottom of the chain to get the desired result.

Edit:
The Edit function is where you can edit a specific rule or delete the rule. One great feature of the Edit screen is that you can open an existing rule for editing, click 'Log this rule' and submit the changes. This will create a LOG rule with the same criteria so you can monitor the actions of that rule. As stated above, you will also use this function when you want to delete a rule from the chain. For more information about the options available on this screen, please cross reference the 'New Rule' section in the Edit Firewall documentation.

Insert:
This is the preferred way to enter a new rule if your chain already has rules in it. When using the Insert function, you will be brought to a screen that is very much like the 'New Rule' screen except is has only the options that are relevant to the chain. In other words, you should have options available to you that will cause a iptables error. Of course, this will not prevent an error if you put invalid data in a valid field. The rule will be inserted at the location in the chain where you clicked the Insert button. For more information about the options available on this screen, please cross reference the 'New Rule' section in the Edit Firewall documentation.

View Script:

The View Script function in fBuilder will show you the contents of the fw-init script. This script is created when you use the Firewall Wizard or Save the firewall from the View Firewall screen. Viewing your script can be an easy way to troubleshoot problems instead of finding the rules in the View Firewall screen. Also, this enables you to learn a little bit more about how firewall scripts are created for iptables.

At this time, there is no way to view your rc.firewall through the fBuilder interface except for when you actually Export to rc.firewall.

View Modules:

The View Modules screen allows you to view the modules that are currently loaded on your Linux Firewall. This screen is a great tool for troubleshooting problems that may be occurring because a needed module is not loaded. The fields are:

Name -- The name of the Module that is loaded
Size -- The size (in memory) that the module is using. Listed in bytes
Count -- The use count - How many times it is in use
Used -- The list of referring modules

View Connections:

The View Connections screen will allow you to monitor connections that are being tracked through the connection tracking modules in the Kernel. This screen will allow you to watch what connections are active and can provide troubleshooting and informational data about these connections including:

Status -- The current state of the connection
Protocol -- The Protocol being used in the connection
Source -- The IP of the machine that initiates the connection
Sprt -- The source port being used by the initiating machine
Dest -- The Destination IP of the machine accepting the connection as initiated by the Source machine
Dprt -- The destination port on the destination machine as initiated by the Source machine
Directional arrow -- This shows the direction of the connection. It will always be pointed to the right
Source -- The IP of the machine that has 'accepted' the connection
Sprt -- The port of the remote machine is using to send packets
Destination -- The machine the remote machine is sending it's data to
Dprt -- The port on the destination machine that the remote machine is sending to

This screen may appear confusing at first because there are two of everything (Sources, Destinations, etc). When you look at a data stream, it will make more sense. As an example, think of it this way:

If machine 111.111.111.111 makes a connection to a remote machine to use web services:

The 111.111.111.111 machine will be the Source of the originating connection
Will have a source port in the range of 1024 - 65535
The Dest address will be that of the web server
The Dprt should be 80 (unless you are connecting on a different port like you do with fBuilder)
NOW, the data must come back
The Source will be the ip of the web server
The Sprt typically will be 80
The Dest will be the machine receiving the reply (111.111.111.111)
The Dprt will be in the range of 1024 - 65535

Also remember that the items listed in this table are the connections actively being tracked. Although we said 'accepted' connections above, the connections could have been rejected and have not been dropped from the connection tracking table yet.

At the bottom of the View Connections screen, you will find two check boxes; one for resolving host names and one for resolving common port names. fBuilder will remember the last option that you chose and store its value in the fbuilder.conf file. The next time you view your active connections you will use the options that were chosen in your last session. To change the values, you must select or deselect and option and hit refresh to have fBuilder save the option.