3.2.3 Usage

September 13th, 2025

AC Firewall runs as a service but can also be controlled directly. Correct configuration and control of AC FIrewall is performed using the following:

• Configuration files
• The systemctl command
• The ac_firewall command

3.2.3.1 Service control via systemd (systemctl)

3.2.3.2 Direct control via ac_firewall

Usage

ac_firewall <Option> [--with_ping]

Options

3.2.3.3 Configuration Files

Actually configurating the firewall and setting up port address translation is performed via configuration files located in /etc/ac_firewall/.

A fully configured sample configuration file set can be found in the samples/ subdirectory.

All configuration files support comment lines prefixed with the hash character #.

Let's look at the sample files and how they are put together.

hosts_this

Example

192.168.1.13 192.168.0.1

Explanation
This simply lists all local IP addresses of the host. The file must be complete and include all addresses even if they are on interfaces that are down or blocked by the eth_down file. The addresses are used to create some basic anti-spoofing rules as is best practice.

eth_down

Example

eth2

Explanation
This shows that one interface, called eth2 is not going to accept any network traffic in or out.

eth_up

Example

eth0 eth1 icmp

Explanation
Allows interfaces named eth0 and eth1 to accept network traffic in and out according to the rules configured in the other configuration files for incoming and outgoing traffic. In this example, interface eth1 will also allow ICMP packets for ping.

In the past, routers and hosts were susceptible to a type of DoS attack known as "The Ping of Death". As a result, it became common practice to block ICMP traffic on both WAN and LAN networks. However, this is not true anymore. There is no reason to disable ICMP traffic on your internal network and in most cases, it can be safely allowed on public facing interfaces also. Disabling ICMP traffic just makes network troubleshooting needlessly difficult.

incoming_<INTERFACE>_public

Example

#[TCP/UDP] [PORT NUMBER] [optional:DESCRIPTION] tcp 80 HTTP server udp 5000:5999 DLNA listeners tcp 443 Secure HTTP server tcp 53 DNS udp 53 DNS tcp 81->8888 Proxy squid on 8888

Explanation
In this file, we have one line of headers commented out for readability. This is followed by a number of rules defined by just two columns. The third column is ignored and can be used for notes.

Each line defines a port type (TCP or UDP), followed by a port number to accept traffic on. Port notation is as follows.

<PORT>
Allow traffic to this port number.

<PORT_X>:<PORT_Y>
Allow traffic between this range of port numbers were PORT_Y is greater than PORT_X. In the example, we have opened up a large range of port numbers from UDP5000 to UDP5999.

<PORT_X>-><PORT_Y>
Set up Port Address Translation so that traffic coming in to PORT_X is redirected to PORT_Y. In the example, traffic to TCP81 is redirected to TCP8888.

incoming_<INTERFACE>_restricted

Example

#[TCP/IP] [PORT] [CLIENT IP] [optional:DESCRIPTION] upd 53 214.165.2.14 DNS tcp 22 192.168.1.11 SSH for Workstation tcp 22 192.168.1.12 SSH for notebook tcp 22 154.219.2.171 SSH for self over WAN tcp 22->8022 16.118.222.129 SSH for Alegria main office tcp 8:1024 192.168.1.2 Reserved services for admin host udp 8:1024 192.168.1.2 Reserved services for admin host

Explanation
In this file, we have one line of headers commented out for readability. This is followed by a number of rules defined by three columns. The fourth column is ignored and can be used for notes.

Each line defines a port type (TCP or UDP), followed by a port number to accept traffic on, and finally a source IP address to accept traffic from. Port notation is as follows.

<PORT>
Allow traffic to this port number.

<PORT_X>:<PORT_Y>
Allow traffic between this range of port numbers were PORT_Y is greater than PORT_X. In the example, we have opened up a large range of port numbers for both UDP and TCP traffic from 8 to 1024.

<PORT_X>-><PORT_Y>
Set up Port Address Translation so that traffic coming in to PORT_X is redirected to PORT_Y. In the example, traffic to TCP22 is redirected to TCP8022.

outgoing_<INTERFACE>_public

Example

#[TCP/UDP] [PORT] [optioanl:DESCRIPTION] udp 123 NTP server tcp 53 DNS query udp 53 DNS query tcp 25 SMTP udp 25 SMTP tcp 123 NTP udp 123 NTP udp 9000:9300 DLNA responses

Explanation
In this file, we have one line of headers commented out for readability. This is followed by a number of rules defined by just two columns. The third column is ignored and can be used for notes.

Each line defines a port type (TCP or UDP), followed by a port number to accept traffic on. Port notation is as follows.

<PORT>
Allow traffic to this port number.

<PORT_X>:<PORT_Y>
Allow traffic between this range of port numbers were PORT_Y is greater than PORT_X. In the example, we have opened up a large range of port numbers from UDP9000 to UDP9300.