1*95daf09dSCy Schubertfilter-rule = [ insert ] action in-out [ options ] [ tos ] [ ttl ] 2*95daf09dSCy Schubert [ proto ] [ ip ] [ group ] [ tag ] [ pps ] . 3*95daf09dSCy Schubert 4*95daf09dSCy Schubertinsert = "@" decnumber . 5*95daf09dSCy Schubertaction = block | "pass" | log | "count" | auth | call . 6*95daf09dSCy Schubertin-out = "in" | "out" . 7*95daf09dSCy Schubertoptions = [ log ] [ "quick" ] [ onif [ dup ] [ froute ] ] . 8*95daf09dSCy Schuberttos = "tos" decnumber | "tos" hexnumber . 9*95daf09dSCy Schubertttl = "ttl" decnumber . 10*95daf09dSCy Schubertproto = "proto" protocol . 11*95daf09dSCy Schubertip = srcdst [ flags ] [ with withopt ] [ icmp ] [ keep ] . 12*95daf09dSCy Schubertgroup = [ "head" decnumber ] [ "group" decnumber ] . 13*95daf09dSCy Schubertpps = "pps" decnumber . 14*95daf09dSCy Schubert 15*95daf09dSCy Schubertonif = "on" interface-name [ "out-via" interface-name ] . 16*95daf09dSCy Schubertblock = "block" [ return-icmp[return-code] | "return-rst" ] . 17*95daf09dSCy Schubertauth = "auth" | "preauth" . 18*95daf09dSCy Schubertlog = "log" [ "body" ] [ "first" ] [ "or-block" ] [ "level" loglevel ] . 19*95daf09dSCy Schuberttag = "tag" tagid . 20*95daf09dSCy Schubertcall = "call" [ "now" ] function-name "/" decnumber. 21*95daf09dSCy Schubertdup = "dup-to" interface-name[":"ipaddr] . 22*95daf09dSCy Schubertfroute = "fastroute" | "to" interface-name . 23*95daf09dSCy Schubertreplyto = "reply-to" interface-name [ ":" ipaddr ] . 24*95daf09dSCy Schubertprotocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber . 25*95daf09dSCy Schubertsrcdst = "all" | fromto . 26*95daf09dSCy Schubertfromto = "from" object "to" object . 27*95daf09dSCy Schubert 28*95daf09dSCy Schubertreturn-icmp = "return-icmp" | "return-icmp-as-dest" . 29*95daf09dSCy Schubertloglevel = facility"."priority | priority . 30*95daf09dSCy Schubertobject = addr [ port-comp | port-range ] . 31*95daf09dSCy Schubertaddr = "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ] . 32*95daf09dSCy Schubertport-comp = "port" compare port-num . 33*95daf09dSCy Schubertport-range = "port" port-num range port-num . 34*95daf09dSCy Schubertflags = "flags" flag { flag } [ "/" flag { flag } ] . 35*95daf09dSCy Schubertwith = "with" | "and" . 36*95daf09dSCy Schuberticmp = "icmp-type" icmp-type [ "code" decnumber ] . 37*95daf09dSCy Schubertreturn-code = "("icmp-code")" . 38*95daf09dSCy Schubertkeep = "keep" "state" [ "limit" number ] | "keep" "frags" . 39*95daf09dSCy Schubert 40*95daf09dSCy Schubertnummask = host-name [ "/" decnumber ] . 41*95daf09dSCy Schuberthost-name = ipaddr | hostname | "any" . 42*95daf09dSCy Schubertipaddr = host-num "." host-num "." host-num "." host-num . 43*95daf09dSCy Schuberthost-num = digit [ digit [ digit ] ] . 44*95daf09dSCy Schubertport-num = service-name | decnumber . 45*95daf09dSCy Schubert 46*95daf09dSCy Schubertwithopt = [ "not" | "no" ] opttype [ [ "," ] withopt ] . 47*95daf09dSCy Schubertopttype = "ipopts" | "short" | "nat" | "bad-src" | "lowttl" | "frag" | 48*95daf09dSCy Schubert "mbcast" | "opt" ipopts . 49*95daf09dSCy Schubertoptname = ipopts [ "," optname ] . 50*95daf09dSCy Schubertipopts = optlist | "sec-class" [ secname ] . 51*95daf09dSCy Schubertsecname = seclvl [ "," secname ] . 52*95daf09dSCy Schubertseclvl = "unclass" | "confid" | "reserv-1" | "reserv-2" | "reserv-3" | 53*95daf09dSCy Schubert "reserv-4" | "secret" | "topsecret" . 54*95daf09dSCy Schuberticmp-type = "unreach" | "echo" | "echorep" | "squench" | "redir" | 55*95daf09dSCy Schubert "timex" | "paramprob" | "timest" | "timestrep" | "inforeq" | 56*95daf09dSCy Schubert "inforep" | "maskreq" | "maskrep" | "routerad" | 57*95daf09dSCy Schubert "routersol" | decnumber . 58*95daf09dSCy Schuberticmp-code = decumber | "net-unr" | "host-unr" | "proto-unr" | "port-unr" | 59*95daf09dSCy Schubert "needfrag" | "srcfail" | "net-unk" | "host-unk" | "isolate" | 60*95daf09dSCy Schubert "net-prohib" | "host-prohib" | "net-tos" | "host-tos" | 61*95daf09dSCy Schubert "filter-prohib" | "host-preced" | "cutoff-preced" . 62*95daf09dSCy Schubertoptlist = "nop" | "rr" | "zsu" | "mtup" | "mtur" | "encode" | "ts" | "tr" | 63*95daf09dSCy Schubert "sec" | "lsrr" | "e-sec" | "cipso" | "satid" | "ssrr" | "addext" | 64*95daf09dSCy Schubert "visa" | "imitd" | "eip" | "finn" . 65*95daf09dSCy Schubertfacility = "kern" | "user" | "mail" | "daemon" | "auth" | "syslog" | 66*95daf09dSCy Schubert "lpr" | "news" | "uucp" | "cron" | "ftp" | "authpriv" | 67*95daf09dSCy Schubert "audit" | "logalert" | "local0" | "local1" | "local2" | 68*95daf09dSCy Schubert "local3" | "local4" | "local5" | "local6" | "local7" . 69*95daf09dSCy Schubertpriority = "emerg" | "alert" | "crit" | "err" | "warn" | "notice" | 70*95daf09dSCy Schubert "info" | "debug" . 71*95daf09dSCy Schubert 72*95daf09dSCy Schuberthexnumber = "0" "x" hexstring . 73*95daf09dSCy Schuberthexstring = hexdigit [ hexstring ] . 74*95daf09dSCy Schubertdecnumber = digit [ decnumber ] . 75*95daf09dSCy Schubert 76*95daf09dSCy Schubertcompare = "=" | "!=" | "<" | ">" | "<=" | ">=" | "eq" | "ne" | "lt" | "gt" | 77*95daf09dSCy Schubert "le" | "ge" . 78*95daf09dSCy Schubertrange = "<>" | "><" . 79*95daf09dSCy Schuberthexdigit = digit | "a" | "b" | "c" | "d" | "e" | "f" . 80*95daf09dSCy Schubertdigit = "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" . 81*95daf09dSCy Schubertflag = "F" | "S" | "R" | "P" | "A" | "U" | "C" | "W" . 82