<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="2.1.8" lastModified="1146716506" id="root">
  <Library color="#ffb4b4" comment="Template objects that can be used to generate typical firewall configurations" id="syslib100" name="Firewall Templates" ro="True">
    <ObjectGroup id="id4070BB9B" name="Objects">
      <ObjectGroup id="id4070BB9B_og_ats_1" name="Address Tables"/>
      <ObjectGroup id="id4070BB9B_og_dnsn_1" name="DNS Names"/>
      <ObjectGroup id="id4070BB9C" name="Addresses"/>
      <ObjectGroup id="id4070BB9D" name="Groups"/>
      <ObjectGroup id="id4070BB9E" name="Hosts">
        <Host comment="This object represents a PC with a single network interface" id="id40CBF1A5" name="PC with 1 interface">
          <Interface bridgeport="False" dyn="False" id="id40CBF1A7" label="" name="eth0" security_level="0" unnum="False">
            <IPv4 address="192.168.1.1" comment="" id="id40CBF1A9" name="pc:eth0:ip" netmask="255.255.255.0"/>
          </Interface>
          <Management address="0.0.0.0">
            <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
            <FWBDManagement enabled="False" identity="" port="-1"/>
            <PolicyInstallScript arguments="" command="" enabled="False"/>
          </Management>
          <HostOptions>
            <Option name="use_mac_addr_filter">False</Option>
          </HostOptions>
        </Host>
        <Host comment="This object represents a PC with two network interfaces" id="id40CBF1AC" name="PC with 2 interfaces">
          <Interface bridgeport="False" dyn="False" id="id40CBF1AE" label="" name="eth0" security_level="0" unnum="False">
            <IPv4 address="192.168.1.1" comment="" id="id40CBF1B0" name="pc:eth0:ip" netmask="255.255.255.0"/>
          </Interface>
          <Interface bridgeport="False" dyn="False" id="id40CBF1B1" label="" name="eth1" security_level="0" unnum="False">
            <IPv4 address="192.168.2.1" comment="" id="id40CBF1B3" name="pc:eth1:ip" netmask="255.255.255.0"/>
          </Interface>
          <Management address="0.0.0.0">
            <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
            <FWBDManagement enabled="False" identity="" port="-1"/>
            <PolicyInstallScript arguments="" command="" enabled="False"/>
          </Management>
          <HostOptions>
            <Option name="use_mac_addr_filter">False</Option>
          </HostOptions>
        </Host>
        <Host comment="This object represents a router with two interfaces. You may need to change interface names if your router uses different naming scheme." id="id40CBF1C8" name="Router with 2 interfaces">
          <Interface bridgeport="False" comment="" dyn="False" id="id40CBF1CB" label="" name="FastEthernet 0/0" security_level="0" unnum="False">
            <IPv4 address="192.168.1.1" comment="" id="id40CBF1CD" name="rtr:FE0/0:ip" netmask="255.255.255.0"/>
          </Interface>
          <Interface bridgeport="False" comment="" dyn="False" id="id40CBF1CE" label="" name="FastEthernet 0/1" security_level="0" unnum="False">
            <IPv4 address="192.168.2.1" comment="" id="id40CBF1D0" name="rtr:FE0/1:ip" netmask="255.255.255.0"/>
          </Interface>
          <Management address="0.0.0.0">
            <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
            <FWBDManagement enabled="False" identity="" port="-1"/>
            <PolicyInstallScript arguments="" command="" enabled="False"/>
          </Management>
          <HostOptions>
            <Option name="use_mac_addr_filter">False</Option>
          </HostOptions>
        </Host>
      </ObjectGroup>
      <ObjectGroup id="id4070BB9F" name="Networks"/>
      <ObjectGroup id="id4070BBA0" name="Address Ranges"/>
    </ObjectGroup>
    <ServiceGroup id="id4070BBA1" name="Services">
      <ServiceGroup id="id4070BBA1_og_tag_1" name="TagServices"/>
      <ServiceGroup id="id4070BBA2" name="Groups"/>
      <ServiceGroup id="id4070BBA3" name="ICMP"/>
      <ServiceGroup id="id4070BBA4" name="IP"/>
      <ServiceGroup id="id4070BBA5" name="TCP"/>
      <ServiceGroup id="id4070BBA6" name="UDP"/>
      <ServiceGroup id="id4070BBA7" name="Custom"/>
    </ServiceGroup>
    <ObjectGroup id="id4070BBA8" name="Firewalls">
      <Firewall comment="This firewall has two interfaces. Eth0 faces outside and has a dynamic address; eth1 faces inside.&#10;Policy includes basic rules to permit unrestricted outbound access and anti-spoofing rules. Access to the firewall is permitted only from internal network and only using SSH. The firewall uses one of the machines on internal network for DNS. Internal network is configured with address 192.168.1.0/255.255.255.0" host_OS="unknown_os" id="id40708A6A" lastCompiled="0" lastInstalled="0" lastModified="0" name="fw template 1" platform="unknown" version="">
        <NAT id="id40708A6E">
          <NATRule disabled="False" id="id4070BFF5" position="0">
            <OSrc neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </OSrc>
            <ODst neg="False">
              <ObjectRef ref="sysid0"/>
            </ODst>
            <OSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </OSrv>
            <TSrc neg="False">
              <ObjectRef ref="id4070BFD8"/>
            </TSrc>
            <TDst neg="False">
              <ObjectRef ref="sysid0"/>
            </TDst>
            <TSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </TSrv>
            <NATRuleOptions/>
          </NATRule>
        </NAT>
        <Policy id="id40708A6D">
          <PolicyRule action="Deny" comment="anti spoofing rule" direction="Inbound" disabled="False" id="id4070BFE9" log="True" position="0">
            <Src neg="False">
              <ObjectRef ref="id40708A6A"/>
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id4070BFD8"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4094092C" log="False" position="1">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id40940929"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="SSH Access to firewall is permitted&#10;only from internal network" disabled="False" id="id40941C75" log="False" position="2">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id40708A6A"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-SSH"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="Firewall uses one of the machines&#10;on internal network for DNS" disabled="False" id="id40941D2E" log="True" position="3">
            <Src neg="False">
              <ObjectRef ref="id40708A6A"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="id3F530CC8"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" comment="All other attempts to connect to&#10;the firewall are denied and logged" disabled="False" id="id40941CB8" log="True" position="4">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id40708A6A"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="" disabled="False" id="id4070BFDE" log="False" position="5">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" disabled="False" id="id40708A71" log="True" position="6">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
        </Policy>
        <Routing id="id40708A6A-routing"/>
        <Interface bridgeport="False" comment="" dyn="True" id="id4070BFD8" label="outside" mgmt="False" name="eth0" security_level="0" unnum="False"/>
        <Interface bridgeport="False" comment="" dyn="False" id="id4070BFDA" label="inside" mgmt="True" name="eth1" security_level="100" unnum="False">
          <IPv4 address="192.168.1.1" comment="" id="id4070BFDC" name="ip" netmask="255.255.255.0"/>
        </Interface>
        <Interface bridgeport="False" comment="" dyn="False" id="id40940929" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False">
          <IPv4 address="127.0.0.1" comment="" id="id4094092B" name="lo:ip" netmask="255.0.0.0"/>
        </Interface>
        <Management address="0.0.0.0">
          <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <FirewallOptions>
          <Option name="accept_established">true</Option>
          <Option name="accept_new_tcp_with_no_syn">true</Option>
          <Option name="check_shading">true</Option>
          <Option name="configure_interfaces">true</Option>
          <Option name="eliminate_duplicates">true</Option>
          <Option name="firewall_dir">/etc</Option>
          <Option name="firewall_is_part_of_any_and_networks">true</Option>
          <Option name="freebsd_ip_forward">1</Option>
          <Option name="limit_value">0</Option>
          <Option name="linux24_ip_forward">1</Option>
          <Option name="load_modules">true</Option>
          <Option name="local_nat">false</Option>
          <Option name="log_level">info</Option>
          <Option name="log_prefix">RULE %N -- %A </Option>
          <Option name="loopback_interface">lo0</Option>
          <Option name="macosx_ip_forward">1</Option>
          <Option name="manage_virtual_addr">true</Option>
          <Option name="openbsd_ip_forward">1</Option>
          <Option name="pf_limit_frags">5000</Option>
          <Option name="pf_limit_states">10000</Option>
          <Option name="pf_timeout_frag">30</Option>
          <Option name="pf_timeout_interval">10</Option>
          <Option name="pix_add_clear_statements">true</Option>
          <Option name="pix_assume_fw_part_of_any">true</Option>
          <Option name="pix_default_logint">300</Option>
          <Option name="pix_emblem_log_format">false</Option>
          <Option name="pix_emulate_out_acl">true</Option>
          <Option name="pix_floodguard">true</Option>
          <Option name="pix_include_comments">true</Option>
          <Option name="pix_route_dnat_supported">true</Option>
          <Option name="pix_rule_syslog_settings">false</Option>
          <Option name="pix_security_fragguard_supported">true</Option>
          <Option name="pix_syslog_device_id_supported">false</Option>
          <Option name="pix_use_acl_remarks">true</Option>
          <Option name="solaris_ip_forward">1</Option>
          <Option name="ulog_nlgroup">1</Option>
          <Option name="verify_interfaces">true</Option>
        </FirewallOptions>
      </Firewall>
      <Firewall comment="Similar to fw 1, but the firewall is used as DHCP and DNS server for internal network.&#10;This firewall has two interfaces. Eth0 faces outside and has a dynamic address; eth1 faces inside.&#10;Policy includes basic rules to permit unrestricted outbound access and anti-spoofing rules. Access to the firewall is permitted only from internal network and only using SSH. The firewall can send DNS queries to servers out on the Internet. Another rule permits DNS queries from internal network to the firewall. Special rules permit DHCP requests from internal network and replies sent by the firewall." host_OS="unknown_os" id="id40941E8C" lastCompiled="0" lastInstalled="0" lastModified="0" name="fw template 2" platform="unknown" version="">
        <NAT id="id40941E91">
          <NATRule disabled="False" id="id40941E92" position="0">
            <OSrc neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </OSrc>
            <ODst neg="False">
              <ObjectRef ref="sysid0"/>
            </ODst>
            <OSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </OSrv>
            <TSrc neg="False">
              <ObjectRef ref="id40941ED3"/>
            </TSrc>
            <TDst neg="False">
              <ObjectRef ref="sysid0"/>
            </TDst>
            <TSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </TSrv>
            <NATRuleOptions/>
          </NATRule>
        </NAT>
        <Policy id="id40941EA0">
          <PolicyRule action="Deny" comment="anti spoofing rule" direction="Inbound" disabled="False" id="id40941ED5" log="True" position="2">
            <Src neg="False">
              <ObjectRef ref="id40941E8C"/>
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id40941ED3"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" direction="Both" disabled="False" id="id40941EE6" log="False" position="3">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id40941EE3"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="SSH Access to firewall is permitted&#10;only from internal network&#10;Also firewall serves DNS for internal&#10;network" disabled="False" id="id40941EA1" log="False" position="2">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id40941E8C"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-SSH"/>
              <ServiceRef ref="id3F530CC8"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="DHCP requests are permitted&#10;from internal network" disabled="False" id="id40942038" log="False" position="3">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
              <ObjectRef ref="id3F6D115D"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id40941E8C"/>
              <ObjectRef ref="id3F6D115C"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sg-DHCP"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="DHCP replies" disabled="False" id="id4094204A" log="False" position="4">
            <Src neg="False">
              <ObjectRef ref="id40941E8C"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sg-DHCP"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="Firewall should be able to send&#10;DNS queries to the Internet" disabled="False" id="id40941EAB" log="True" position="5">
            <Src neg="False">
              <ObjectRef ref="id40941E8C"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="id3F530CC8"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" comment="All other attempts to connect to&#10;the firewall are denied and logged" disabled="False" id="id40941EB5" log="True" position="6">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id40941E8C"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="" disabled="False" id="id40941EBF" log="False" position="7">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" disabled="False" id="id40941EC9" log="True" position="8">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
        </Policy>
        <Routing id="id40941E8C-routing"/>
        <Interface bridgeport="False" comment="" dyn="True" id="id40941ED3" label="outside" mgmt="False" name="eth0" security_level="0" unnum="False"/>
        <Interface bridgeport="False" comment="" dyn="False" id="id40941EE0" label="inside" mgmt="True" name="eth1" security_level="100" unnum="False">
          <IPv4 address="192.168.1.1" comment="" id="id40941EE1" name="ip" netmask="255.255.255.0"/>
        </Interface>
        <Interface bridgeport="False" comment="" dyn="False" id="id40941EE3" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False">
          <IPv4 address="127.0.0.1" comment="" id="id40941EE4" name="lo:ip" netmask="255.0.0.0"/>
        </Interface>
        <Management address="0.0.0.0">
          <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <FirewallOptions>
          <Option name="accept_established">true</Option>
          <Option name="accept_new_tcp_with_no_syn">true</Option>
          <Option name="check_shading">true</Option>
          <Option name="configure_interfaces">true</Option>
          <Option name="eliminate_duplicates">true</Option>
          <Option name="firewall_dir">/etc</Option>
          <Option name="firewall_is_part_of_any_and_networks">true</Option>
          <Option name="freebsd_ip_forward">1</Option>
          <Option name="limit_value">0</Option>
          <Option name="linux24_ip_forward">1</Option>
          <Option name="load_modules">true</Option>
          <Option name="local_nat">false</Option>
          <Option name="log_level">info</Option>
          <Option name="log_prefix">RULE %N -- %A </Option>
          <Option name="loopback_interface">lo0</Option>
          <Option name="macosx_ip_forward">1</Option>
          <Option name="manage_virtual_addr">true</Option>
          <Option name="openbsd_ip_forward">1</Option>
          <Option name="pf_limit_frags">5000</Option>
          <Option name="pf_limit_states">10000</Option>
          <Option name="pf_timeout_frag">30</Option>
          <Option name="pf_timeout_interval">10</Option>
          <Option name="pix_add_clear_statements">true</Option>
          <Option name="pix_assume_fw_part_of_any">true</Option>
          <Option name="pix_default_logint">300</Option>
          <Option name="pix_emblem_log_format">false</Option>
          <Option name="pix_emulate_out_acl">true</Option>
          <Option name="pix_floodguard">true</Option>
          <Option name="pix_include_comments">true</Option>
          <Option name="pix_route_dnat_supported">true</Option>
          <Option name="pix_rule_syslog_settings">false</Option>
          <Option name="pix_security_fragguard_supported">true</Option>
          <Option name="pix_syslog_device_id_supported">false</Option>
          <Option name="pix_use_acl_remarks">true</Option>
          <Option name="solaris_ip_forward">1</Option>
          <Option name="ulog_nlgroup">1</Option>
          <Option name="verify_interfaces">true</Option>
        </FirewallOptions>
      </Firewall>
      <Firewall comment="This firewall has three interfaces. Eth0 faces outside and has a static routable address; eth1 faces inside; eth2 is connected to DMZ subnet.&#10;Policy includes basic rules to permit unrestricted outbound access and anti-spoofing rules. Access to the firewall is permitted only from internal network and only using SSH. The firewall uses one of the machines on internal network for DNS. Internal network is configured with address 192.168.1.0/255.255.255.0, DMZ is 192.168.2.0/255.255.255.0. Since DMZ used private IP address, it needs NAT. There is a mail relay host located on DMZ (object 'server on dmz'). Policy rules permit SMTP connections to it from the Internet and allow this server to connect to a host on internal network 'internal server'. All other access from DMZ to internal net is denied. To provide access to the mail relay its private address is mapped to firewall's outside interface address by NAT rule #1." host_OS="freebsd" id="id40986AFE" lastCompiled="0" lastInstalled="0" lastModified="0" name="fw template 3" platform="unknown" version="">
        <NAT id="id40986B03">
          <NATRule comment="no need to translate&#10;between DMZ and &#10;internal net" disabled="False" id="id40987169" position="0">
            <OSrc neg="False">
              <ObjectRef ref="id3DC75CE7-2"/>
            </OSrc>
            <ODst neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </ODst>
            <OSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </OSrv>
            <TSrc neg="False">
              <ObjectRef ref="sysid0"/>
            </TSrc>
            <TDst neg="False">
              <ObjectRef ref="sysid0"/>
            </TDst>
            <TSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </TSrv>
            <NATRuleOptions/>
          </NATRule>
          <NATRule comment="Translate source address&#10;for outgoing connections" disabled="False" id="id40986B04" position="1">
            <OSrc neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
              <ObjectRef ref="id3DC75CE7-2"/>
            </OSrc>
            <ODst neg="False">
              <ObjectRef ref="sysid0"/>
            </ODst>
            <OSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </OSrv>
            <TSrc neg="False">
              <ObjectRef ref="id40986B45"/>
            </TSrc>
            <TDst neg="False">
              <ObjectRef ref="sysid0"/>
            </TDst>
            <TSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </TSrv>
            <NATRuleOptions/>
          </NATRule>
          <NATRule disabled="False" id="id40986E4B" position="2">
            <OSrc neg="False">
              <ObjectRef ref="sysid0"/>
            </OSrc>
            <ODst neg="False">
              <ObjectRef ref="id40986B45"/>
            </ODst>
            <OSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </OSrv>
            <TSrc neg="False">
              <ObjectRef ref="sysid0"/>
            </TSrc>
            <TDst neg="False">
              <ObjectRef ref="id3D84EECF"/>
            </TDst>
            <TSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </TSrv>
            <NATRuleOptions/>
          </NATRule>
        </NAT>
        <Policy id="id40986B12">
          <PolicyRule action="Deny" comment="anti spoofing rule" direction="Inbound" disabled="False" id="id40986B47" log="True" position="4">
            <Src neg="False">
              <ObjectRef ref="id40986AFE"/>
              <ObjectRef ref="id3DC75CE7-1"/>
              <ObjectRef ref="id3DC75CE7-2"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id40986B45"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" direction="Both" disabled="False" id="id40986B58" log="False" position="5">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id40986B55"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="SSH Access to firewall is permitted&#10;only from internal network" disabled="False" id="id40986B13" log="False" position="2">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id40986AFE"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-SSH"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="Firewall uses one of the machines&#10;on internal network for DNS" disabled="False" id="id40986B1D" log="False" position="3">
            <Src neg="False">
              <ObjectRef ref="id40986AFE"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3D84EECE"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="id3F530CC8"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" comment="All other attempts to connect to&#10;the firewall are denied and logged" disabled="False" id="id40986B27" log="True" position="4">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id40986AFE"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Reject" comment="Quickly reject attempts to connect&#10;to ident server to avoid SMTP delays" disabled="False" id="id40986E5C" log="False" position="5">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-Auth"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="Mail relay on DMZ can accept&#10;connections from hosts on the&#10;Internet" disabled="False" id="id40986E16" log="False" position="6">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3D84EECF"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-SMTP"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="this rule permits a mail relay&#10;located on DMZ to connect&#10;to internal mail server" disabled="False" id="id40986EE1" log="False" position="7">
            <Src neg="False">
              <ObjectRef ref="id3D84EECF"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3D84EECE"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-SMTP"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="Mail relay needs DNS and can&#10;connect to mail servers on the&#10;Internet" disabled="False" id="id40987009" log="False" position="8">
            <Src neg="False">
              <ObjectRef ref="id3D84EECF"/>
            </Src>
            <Dst neg="True">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="id3F530CC8"/>
              <ServiceRef ref="tcp-SMTP"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" comment="All other access from DMZ to&#10;internal  net is denied" disabled="False" id="id40986B79" log="True" position="9">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-2"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="This permits access from internal net&#10;to the Internet and DMZ" disabled="False" id="id40986B31" log="False" position="10">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" disabled="False" id="id40986B3B" log="True" position="11">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
        </Policy>
        <Routing id="id40986AFE-routing"/>
        <Interface bridgeport="False" comment="" dyn="False" id="id40986B45" label="outside" mgmt="False" name="eth0" security_level="0" unnum="False">
          <IPv4 address="192.0.2.1" comment="This is a test address, change it to your real one" id="id40986E5B" name="fw 3:eth0:ip" netmask="255.255.255.0"/>
        </Interface>
        <Interface bridgeport="False" comment="" dyn="False" id="id40986B52" label="inside" mgmt="True" name="eth1" security_level="100" unnum="False">
          <IPv4 address="192.168.1.1" comment="" id="id40986B53" name="ip" netmask="255.255.255.0"/>
        </Interface>
        <Interface bridgeport="False" comment="" dyn="False" id="id40986B55" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False">
          <IPv4 address="127.0.0.1" comment="" id="id40986B56" name="lo:ip" netmask="255.0.0.0"/>
        </Interface>
        <Interface bridgeport="False" comment="" dyn="False" id="id40986B67" label="dmz" mgmt="False" name="eth2" security_level="0" unnum="False">
          <IPv4 address="192.168.2.1" comment="" id="id40986B69" name="ip" netmask="255.255.255.0"/>
        </Interface>
        <Management address="0.0.0.0">
          <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <FirewallOptions>
          <Option name="accept_established">true</Option>
          <Option name="accept_new_tcp_with_no_syn">true</Option>
          <Option name="check_shading">true</Option>
          <Option name="configure_interfaces">true</Option>
          <Option name="eliminate_duplicates">true</Option>
          <Option name="firewall_dir">/etc</Option>
          <Option name="firewall_is_part_of_any_and_networks">true</Option>
          <Option name="freebsd_ip_forward">1</Option>
          <Option name="limit_value">0</Option>
          <Option name="linux24_ip_forward">1</Option>
          <Option name="load_modules">true</Option>
          <Option name="local_nat">false</Option>
          <Option name="log_level">info</Option>
          <Option name="log_prefix">RULE %N -- %A </Option>
          <Option name="loopback_interface">lo0</Option>
          <Option name="macosx_ip_forward">1</Option>
          <Option name="manage_virtual_addr">true</Option>
          <Option name="openbsd_ip_forward">1</Option>
          <Option name="pf_limit_frags">5000</Option>
          <Option name="pf_limit_states">10000</Option>
          <Option name="pf_timeout_frag">30</Option>
          <Option name="pf_timeout_interval">10</Option>
          <Option name="pix_add_clear_statements">true</Option>
          <Option name="pix_assume_fw_part_of_any">true</Option>
          <Option name="pix_default_logint">300</Option>
          <Option name="pix_emblem_log_format">false</Option>
          <Option name="pix_emulate_out_acl">true</Option>
          <Option name="pix_floodguard">true</Option>
          <Option name="pix_include_comments">true</Option>
          <Option name="pix_route_dnat_supported">true</Option>
          <Option name="pix_rule_syslog_settings">false</Option>
          <Option name="pix_security_fragguard_supported">true</Option>
          <Option name="pix_syslog_device_id_supported">false</Option>
          <Option name="pix_use_acl_remarks">true</Option>
          <Option name="solaris_ip_forward">1</Option>
          <Option name="ulog_nlgroup">1</Option>
          <Option name="verify_interfaces">true</Option>
        </FirewallOptions>
      </Firewall>
      <Firewall comment="This is an example of a firewall protecting a host ( a server or a workstation). Only SSH access to the host is permitted. Host has dynamic address." host_OS="unknown_os" id="id409878E4" lastCompiled="0" lastInstalled="0" lastModified="0" name="host fw template 1" platform="unknown" version="">
        <NAT id="id409878E9"/>
        <Policy id="id409878F8">
          <PolicyRule action="Deny" comment="anti spoofing rule" direction="Inbound" disabled="False" id="id4098792D" log="True" position="6">
            <Src neg="False">
              <ObjectRef ref="id409878E4"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id4098792B"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" direction="Both" disabled="False" id="id4098793E" log="False" position="7">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id4098793B"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="SSH Access to the host; useful ICMP&#10;types; ping request" disabled="False" id="id409878F9" log="False" position="2">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id409878E4"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-SSH"/>
              <ServiceRef ref="sg-Useful_ICMP"/>
              <ServiceRef ref="icmp-ping_request"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="" disabled="False" id="id40987917" log="False" position="3">
            <Src neg="False">
              <ObjectRef ref="id409878E4"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" disabled="False" id="id40987921" log="True" position="4">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
        </Policy>
        <Routing id="id409878E4-routing"/>
        <Interface bridgeport="False" comment="" dyn="True" id="id4098792B" label="outside" mgmt="False" name="eth0" security_level="0" unnum="False"/>
        <Interface bridgeport="False" comment="" dyn="False" id="id4098793B" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False">
          <IPv4 address="127.0.0.1" comment="" id="id4098793C" name="lo:ip" netmask="255.0.0.0"/>
        </Interface>
        <Management address="0.0.0.0">
          <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <FirewallOptions>
          <Option name="accept_established">true</Option>
          <Option name="accept_new_tcp_with_no_syn">true</Option>
          <Option name="check_shading">true</Option>
          <Option name="configure_interfaces">true</Option>
          <Option name="eliminate_duplicates">true</Option>
          <Option name="firewall_dir">/etc</Option>
          <Option name="firewall_is_part_of_any_and_networks">true</Option>
          <Option name="freebsd_ip_forward">1</Option>
          <Option name="limit_value">0</Option>
          <Option name="linux24_ip_forward">1</Option>
          <Option name="load_modules">true</Option>
          <Option name="local_nat">false</Option>
          <Option name="log_level">info</Option>
          <Option name="log_prefix">RULE %N -- %A </Option>
          <Option name="loopback_interface">lo0</Option>
          <Option name="macosx_ip_forward">1</Option>
          <Option name="manage_virtual_addr">true</Option>
          <Option name="openbsd_ip_forward">1</Option>
          <Option name="pix_add_clear_statements">true</Option>
          <Option name="pix_assume_fw_part_of_any">true</Option>
          <Option name="pix_default_logint">300</Option>
          <Option name="pix_emblem_log_format">false</Option>
          <Option name="pix_emulate_out_acl">true</Option>
          <Option name="pix_floodguard">true</Option>
          <Option name="pix_include_comments">true</Option>
          <Option name="pix_route_dnat_supported">true</Option>
          <Option name="pix_rule_syslog_settings">false</Option>
          <Option name="pix_security_fragguard_supported">true</Option>
          <Option name="pix_syslog_device_id_supported">false</Option>
          <Option name="pix_use_acl_remarks">true</Option>
          <Option name="solaris_ip_forward">1</Option>
          <Option name="ulog_nlgroup">1</Option>
          <Option name="verify_interfaces">true</Option>
        </FirewallOptions>
      </Firewall>
      <Firewall comment="This firewall is based on Linksys appliance running Sveasoft firmware; it has two interfaces. Interface vlan1 faces outside and has a dynamic address; br0 faces inside.&#10;Policy includes basic rules to permit unrestricted outbound access and anti-spoofing rules. Access to the firewall is permitted only from internal network and only using SSH or HTTP. The firewall uses name servers supplied by the ISP for DNS.  Special rule blocks DHCP requests on external interface without logging to reduce noise in the log.&#10;&#10;Internal network is configured with address 192.168.1.0/255.255.255.0" host_OS="linksys" id="id41293477" lastCompiled="0" lastInstalled="0" lastModified="0" name="linksys firewall" platform="iptables" version="">
        <NAT id="id412934D3">
          <NATRule disabled="False" id="id412934D4" position="0">
            <OSrc neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </OSrc>
            <ODst neg="False">
              <ObjectRef ref="sysid0"/>
            </ODst>
            <OSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </OSrv>
            <TSrc neg="False">
              <ObjectRef ref="id412934E2"/>
            </TSrc>
            <TDst neg="False">
              <ObjectRef ref="sysid0"/>
            </TDst>
            <TSrv neg="False">
              <ServiceRef ref="sysid1"/>
            </TSrv>
            <NATRuleOptions/>
          </NATRule>
        </NAT>
        <Policy id="id4129347C">
          <PolicyRule action="Deny" comment="anti spoofing rule" direction="Inbound" disabled="False" id="id412934E4" log="True" position="8">
            <Src neg="False">
              <ObjectRef ref="id41293477"/>
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id412934E2"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" direction="Both" disabled="False" id="id412934F5" log="False" position="9">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id412934F2"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" disabled="False" id="id4129347D" log="False" position="2">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3F6D115C"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sg-DHCP"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="SSH Access to firewall is permitted&#10;only from internal network" disabled="False" id="id41293488" log="False" position="3">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id41293477"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-SSH"/>
              <ServiceRef ref="tcp-HTTP"/>
              <ServiceRef ref="icmp-ping_request"/>
              <ServiceRef ref="id41291786"/>
              <ServiceRef ref="sg-DHCP"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="need this rule for ping and traceroute" disabled="False" id="id41293496" log="False" position="4">
            <Src neg="False">
              <ObjectRef ref="id41293477"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="icmp-ping_reply"/>
              <ServiceRef ref="icmp-Time_exceeded"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions>
              <Option name="action_on_reject"></Option>
              <Option name="firewall_is_part_of_any_and_networks">False</Option>
              <Option name="limit_burst">0</Option>
              <Option name="limit_suffix"></Option>
              <Option name="limit_value">0</Option>
              <Option name="log_level"></Option>
              <Option name="log_prefix"></Option>
              <Option name="stateless">True</Option>
              <Option name="ulog_nlgroup">1</Option>
            </PolicyRuleOptions>
          </PolicyRule>
          <PolicyRule action="Accept" comment="" disabled="False" id="id412934A1" log="False" position="5">
            <Src neg="False">
              <ObjectRef ref="id41293477"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" comment="All other attempts to connect to&#10;the firewall are denied and logged" disabled="False" id="id412934AB" log="True" position="6">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id41293477"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" disabled="False" id="id412934B5" log="False" position="7">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="icmp-Unreachables"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="" disabled="False" id="id412934BF" log="False" position="8">
            <Src neg="False">
              <ObjectRef ref="id3DC75CE7-1"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" disabled="False" id="id412934C9" log="True" position="9">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
        </Policy>
        <Routing id="id41293477-routing"/>
        <Interface bridgeport="False" comment="" dyn="True" id="id412934E2" label="outside" mgmt="False" name="vlan1" security_level="0" unnum="False"/>
        <Interface bridgeport="False" comment="" dyn="False" id="id412934EF" label="inside" mgmt="True" name="br0" security_level="100" unnum="False">
          <IPv4 address="192.168.1.1" comment="" id="id412934F0" name="linksys firewall:br0:ip" netmask="255.255.255.0"/>
        </Interface>
        <Interface bridgeport="False" comment="" dyn="False" id="id412934F2" label="loopback" mgmt="False" name="lo" security_level="100" unnum="False">
          <IPv4 address="127.0.0.1" comment="" id="id412934F3" name="linksys firewall:lo:ip" netmask="255.0.0.0"/>
        </Interface>
        <Management address="192.168.1.1">
          <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <FirewallOptions>
          <Option name="accept_established">True</Option>
          <Option name="accept_new_tcp_with_no_syn">True</Option>
          <Option name="action_on_reject"></Option>
          <Option name="activationCmd"></Option>
          <Option name="admUser">root</Option>
          <Option name="altAddress"></Option>
          <Option name="bridging_fw">False</Option>
          <Option name="check_shading">True</Option>
          <Option name="clamp_mss_to_mtu">False</Option>
          <Option name="cmdline"></Option>
          <Option name="compiler"></Option>
          <Option name="configure_interfaces">True</Option>
          <Option name="debug">True</Option>
          <Option name="eliminate_duplicates">true</Option>
          <Option name="firewall_dir"></Option>
          <Option name="firewall_is_part_of_any_and_networks">True</Option>
          <Option name="freebsd_ip_forward">1</Option>
          <Option name="ignore_empty_groups">False</Option>
          <Option name="in_out_code">true</Option>
          <Option name="limit_suffix"></Option>
          <Option name="limit_value">0</Option>
          <Option name="linksys_path_ip"></Option>
          <Option name="linksys_path_iptables"></Option>
          <Option name="linksys_path_logger"></Option>
          <Option name="linksys_path_lsmod"></Option>
          <Option name="linksys_path_modprobe"></Option>
          <Option name="linux24_accept_redirects"></Option>
          <Option name="linux24_accept_source_route"></Option>
          <Option name="linux24_icmp_echo_ignore_all"></Option>
          <Option name="linux24_icmp_echo_ignore_broadcasts"></Option>
          <Option name="linux24_icmp_ignore_bogus_error_responses"></Option>
          <Option name="linux24_ip_dynaddr"></Option>
          <Option name="linux24_ip_forward">1</Option>
          <Option name="linux24_log_martians"></Option>
          <Option name="linux24_path_ip">/usr/sbin/ip</Option>
          <Option name="linux24_path_iptables">/usr/sbin/iptables</Option>
          <Option name="linux24_path_logger">/usr/bin/logger</Option>
          <Option name="linux24_path_lsmod">/sbin/lsmod</Option>
          <Option name="linux24_path_modprobe">/sbin/modprobe</Option>
          <Option name="linux24_rp_filter"></Option>
          <Option name="linux24_tcp_ecn"></Option>
          <Option name="linux24_tcp_fack"></Option>
          <Option name="linux24_tcp_fin_timeout">0</Option>
          <Option name="linux24_tcp_keepalive_interval">0</Option>
          <Option name="linux24_tcp_sack"></Option>
          <Option name="linux24_tcp_syncookies"></Option>
          <Option name="linux24_tcp_timestamps"></Option>
          <Option name="linux24_tcp_window_scaling"></Option>
          <Option name="load_modules">True</Option>
          <Option name="local_nat">False</Option>
          <Option name="log_all">False</Option>
          <Option name="log_ip_opt">False</Option>
          <Option name="log_level">info</Option>
          <Option name="log_prefix">RULE %N -- %A </Option>
          <Option name="log_tcp_opt">False</Option>
          <Option name="log_tcp_seq">False</Option>
          <Option name="loopback_interface">lo0</Option>
          <Option name="macosx_ip_forward">1</Option>
          <Option name="manage_virtual_addr">True</Option>
          <Option name="mgmt_addr"></Option>
          <Option name="mgmt_ssh">False</Option>
          <Option name="openbsd_ip_forward">1</Option>
          <Option name="pass_all_out">false</Option>
          <Option name="pf_limit_frags">5000</Option>
          <Option name="pf_limit_states">10000</Option>
          <Option name="pf_scrub_maxmss">1460</Option>
          <Option name="pf_timeout_frag">30</Option>
          <Option name="pf_timeout_interval">10</Option>
          <Option name="pix_add_clear_statements">true</Option>
          <Option name="pix_assume_fw_part_of_any">true</Option>
          <Option name="pix_default_logint">300</Option>
          <Option name="pix_emblem_log_format">false</Option>
          <Option name="pix_emulate_out_acl">true</Option>
          <Option name="pix_floodguard">true</Option>
          <Option name="pix_include_comments">true</Option>
          <Option name="pix_route_dnat_supported">true</Option>
          <Option name="pix_rule_syslog_settings">false</Option>
          <Option name="pix_security_fragguard_supported">true</Option>
          <Option name="pix_syslog_device_id_supported">false</Option>
          <Option name="pix_use_acl_remarks">true</Option>
          <Option name="prompt1">$ </Option>
          <Option name="prompt2"> # </Option>
          <Option name="solaris_ip_forward">1</Option>
          <Option name="ulog_cprange">0</Option>
          <Option name="ulog_nlgroup">1</Option>
          <Option name="ulog_qthreshold">1</Option>
          <Option name="use_ULOG">False</Option>
          <Option name="use_numeric_log_levels">False</Option>
          <Option name="verify_interfaces">True</Option>
        </FirewallOptions>
      </Firewall>
      <Firewall comment="" host_OS="linux24" id="id4129355E" lastCompiled="0" lastInstalled="0" lastModified="0" name="web server" platform="iptables" version="">
        <NAT id="id41293598"/>
        <Policy id="id41293563">
          <PolicyRule action="Deny" direction="Inbound" disabled="False" id="id4129359C" log="True" position="10">
            <Src neg="False">
              <ObjectRef ref="id4129355E"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id41293599"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" direction="Both" disabled="False" id="id412935A9" log="False" position="11">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="id412935A6"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" disabled="False" id="id41293564" log="False" position="2">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id4129355E"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-HTTP"/>
              <ServiceRef ref="tcp-SSH"/>
              <ServiceRef ref="sg-Useful_ICMP"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="server needs DNS to back-resolve clients IPs.&#10;Even if it does not log host names during its&#10;normal operations, statistics scripts such as&#10;webalizer need it for reporting." disabled="False" id="id41293570" log="False" position="3">
            <Src neg="False">
              <ObjectRef ref="id4129355E"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="id3F530CC8"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Accept" comment="this rule allows the server to send&#10;statistics and reports via email. Disable&#10;this rule if you do not need it." disabled="False" id="id4129357A" log="False" position="4">
            <Src neg="False">
              <ObjectRef ref="id4129355E"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-SMTP"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Reject" comment="this rejects auth (ident) queries that remote&#10;mail relays may send to this server when it&#10;tries to send email out." disabled="False" id="id41293584" log="False" position="5">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="id4129355E"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="tcp-Auth"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
          <PolicyRule action="Deny" disabled="False" id="id4129358E" log="True" position="6">
            <Src neg="False">
              <ObjectRef ref="sysid0"/>
            </Src>
            <Dst neg="False">
              <ObjectRef ref="sysid0"/>
            </Dst>
            <Srv neg="False">
              <ServiceRef ref="sysid1"/>
            </Srv>
            <Itf neg="False">
              <ObjectRef ref="sysid0"/>
            </Itf>
            <When neg="False">
              <IntervalRef ref="sysid2"/>
            </When>
            <PolicyRuleOptions/>
          </PolicyRule>
        </Policy>
        <Routing id="id4129355E-routing"/>
        <Interface bridgeport="False" comment="" dyn="False" id="id41293599" label="outside" mgmt="True" name="eth0" security_level="0" unnum="False">
          <IPv4 address="192.168.1.10" id="id4129359A" name="web server:eth0:ip" netmask="255.255.255.0"/>
        </Interface>
        <Interface bridgeport="False" dyn="False" id="id412935A6" label="loopback" name="lo" security_level="100" unnum="False">
          <IPv4 address="127.0.0.1" id="id412935A7" name="web server:lo:ip" netmask="255.0.0.0"/>
        </Interface>
        <Management address="192.168.1.10">
          <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
          <FWBDManagement enabled="False" identity="" port="-1"/>
          <PolicyInstallScript arguments="" command="" enabled="False"/>
        </Management>
        <FirewallOptions>
          <Option name="accept_established">True</Option>
          <Option name="accept_new_tcp_with_no_syn">True</Option>
          <Option name="action_on_reject"></Option>
          <Option name="bridging_fw">False</Option>
          <Option name="check_shading">True</Option>
          <Option name="cmdline"></Option>
          <Option name="compiler"></Option>
          <Option name="configure_interfaces">True</Option>
          <Option name="debug">False</Option>
          <Option name="eliminate_duplicates">true</Option>
          <Option name="firewall_dir">/etc/fw</Option>
          <Option name="firewall_is_part_of_any_and_networks">True</Option>
          <Option name="freebsd_ip_forward">1</Option>
          <Option name="ignore_empty_groups">False</Option>
          <Option name="limit_suffix"></Option>
          <Option name="limit_value">0</Option>
          <Option name="linux24_ip_forward">1</Option>
          <Option name="load_modules">True</Option>
          <Option name="local_nat">False</Option>
          <Option name="log_all">False</Option>
          <Option name="log_all_dropped">False</Option>
          <Option name="log_ip_opt">False</Option>
          <Option name="log_level">info</Option>
          <Option name="log_prefix">RULE %N -- %A </Option>
          <Option name="log_tcp_opt">False</Option>
          <Option name="log_tcp_seq">False</Option>
          <Option name="loopback_interface">lo0</Option>
          <Option name="macosx_ip_forward">1</Option>
          <Option name="manage_virtual_addr">True</Option>
          <Option name="openbsd_ip_forward">1</Option>
          <Option name="pix_add_clear_statements">true</Option>
          <Option name="pix_assume_fw_part_of_any">true</Option>
          <Option name="pix_default_logint">300</Option>
          <Option name="pix_emblem_log_format">false</Option>
          <Option name="pix_emulate_out_acl">true</Option>
          <Option name="pix_floodguard">true</Option>
          <Option name="pix_include_comments">true</Option>
          <Option name="pix_route_dnat_supported">true</Option>
          <Option name="pix_rule_syslog_settings">false</Option>
          <Option name="pix_security_fragguard_supported">true</Option>
          <Option name="pix_syslog_device_id_supported">false</Option>
          <Option name="pix_use_acl_remarks">true</Option>
          <Option name="solaris_ip_forward">1</Option>
          <Option name="ulog_cprange">0</Option>
          <Option name="ulog_nlgroup">1</Option>
          <Option name="ulog_qthreshold">1</Option>
          <Option name="use_ULOG">False</Option>
          <Option name="use_numeric_log_levels">False</Option>
          <Option name="verify_interfaces">True</Option>
        </FirewallOptions>
      </Firewall>
    </ObjectGroup>
    <IntervalGroup id="id4070BBA9" name="Time"/>
  </Library>
  <Library color="#d4f8ff" comment="Standard objects" id="syslib000" name="Standard" ro="False">
    <ObjectGroup id="stdid01" name="Objects">
      <ObjectGroup id="stdid03" name="Networks">
        <Network comment="192.168.1.0/24 - Address often used for home and small office networks.&#10;" id="id3DC75CE7-1" name="net-192.168.1.0" address="192.168.1.0" netmask="255.255.255.0"/>
        <Network comment="192.168.2.0/24 - Address often used for home and small office networks.&#10;" id="id3DC75CE7-2" name="net-192.168.2.0" address="192.168.2.0" netmask="255.255.255.0"/>
      </ObjectGroup>
      <ObjectGroup id="stdid15" name="Address Ranges">
        <AddressRange comment="" id="id3F6D115D" name="old-broadcast" start_address="0.0.0.0" end_address="0.0.0.0"/>
        <AddressRange comment="" id="id3F6D115C" name="broadcast" start_address="255.255.255.255" end_address="255.255.255.255"/>
      </ObjectGroup>
      <ObjectGroup id="stdid02" name="Hosts">
        <Host comment="This host is used in examples and template objects" id="id3D84EECE" name="internal server">
          <Interface bridgeport="False" dyn="False" id="id3D84EED2" name="eth0" security_level="0" unnum="False">
            <IPv4 address="192.168.1.10" id="id3D84EED3" name="ip" netmask="255.255.255.0"/>
          </Interface>
          <Management address="192.168.1.10">
            <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
            <FWBDManagement enabled="False" identity="" port="-1"/>
            <PolicyInstallScript arguments="" command="" enabled="False"/>
          </Management>
          <HostOptions>
            <Option name="snmp_contact"></Option>
            <Option name="snmp_description"></Option>
            <Option name="snmp_location"></Option>
            <Option name="use_mac_addr">false</Option>
            <Option name="use_mac_addr_filter">False</Option>
          </HostOptions>
        </Host>
        <Host comment="This host is used in examples and template objects" id="id3D84EECF" name="server on dmz">
          <Interface bridgeport="False" dyn="False" id="id3D84EEE3" name="eth0" security_level="0" unnum="False">
            <IPv4 address="192.168.2.10" id="id3D84EEE4" name="ip" netmask="255.255.255.0"/>
          </Interface>
          <Management address="192.168.2.10">
            <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
            <FWBDManagement enabled="False" identity="" port="-1"/>
            <PolicyInstallScript arguments="" command="" enabled="False"/>
          </Management>
          <HostOptions>
            <Option name="snmp_contact"></Option>
            <Option name="snmp_description"></Option>
            <Option name="snmp_location"></Option>
            <Option name="use_mac_addr">false</Option>
            <Option name="use_mac_addr_filter">False</Option>
          </HostOptions>
        </Host>
      </ObjectGroup>
    </ObjectGroup>
    <AnyNetwork comment="Any Network" id="sysid0" name="Any" address="0.0.0.0" netmask="0.0.0.0"/>
    <AnyIPService comment="Any IP Service" id="sysid1" name="Any" protocol_num="0"/>
    <AnyInterval comment="Any Interval" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" id="sysid2" name="Any" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1"/>
    <ServiceGroup id="stdid05" name="Services">
      <ServiceGroup id="stdid09" name="TCP">
        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="22" dst_range_start="22" fin_flag="False" fin_flag_mask="False" id="tcp-SSH" name="ssh" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="113" dst_range_start="113" fin_flag="False" fin_flag_mask="False" id="tcp-Auth" name="auth" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="25" dst_range_start="25" fin_flag="False" fin_flag_mask="False" id="tcp-SMTP" name="smtp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="80" dst_range_start="80" fin_flag="False" fin_flag_mask="False" id="tcp-HTTP" name="http" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="53" dst_range_start="53" fin_flag="False" fin_flag_mask="False" id="tcp-DNS" name="domain" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
        <TCPService ack_flag="False" ack_flag_mask="False" comment="" dst_range_end="5000" dst_range_start="5000" fin_flag="False" fin_flag_mask="False" id="id41291784" name="upnp" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
        <TCPService ack_flag="False" ack_flag_mask="False" comment="Although UPnP specification say it should use TCP port 5000, Linksys running Sveasoft firmware listens on port 5431" dst_range_end="5431" dst_range_start="5431" fin_flag="False" fin_flag_mask="False" id="id41291785" name="upnp-5431" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
        <TCPService ack_flag="False" ack_flag_mask="False" comment="Sometimes this protocol is called icslap, but Microsoft does not call it that and just says that DSPP uses port 2869 in Windows XP SP2" dst_range_end="2869" dst_range_start="2869" fin_flag="False" fin_flag_mask="False" id="id412Z18A9" name="icslap" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" src_range_end="0" src_range_start="0" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False"/>
      </ServiceGroup>
      <ServiceGroup id="stdid10" name="Groups">
        <ServiceGroup id="id3F530CC8" name="DNS">
          <ServiceRef ref="udp-DNS"/>
          <ServiceRef ref="tcp-DNS"/>
        </ServiceGroup>
        <ServiceGroup comment="" id="sg-DHCP" name="DHCP">
          <ServiceRef ref="udp-bootpc"/>
          <ServiceRef ref="udp-bootps"/>
        </ServiceGroup>
        <ServiceGroup comment="" id="sg-Useful_ICMP" name="Useful_ICMP">
          <ServiceRef ref="icmp-Time_exceeded"/>
          <ServiceRef ref="icmp-Time_exceeded_in_transit"/>
          <ServiceRef ref="icmp-ping_reply"/>
          <ServiceRef ref="icmp-Unreachables"/>
        </ServiceGroup>
        <ServiceGroup comment="" id="id41291786" name="UPnP">
          <ServiceRef ref="id41291784"/>
          <ServiceRef ref="id41291785"/>
          <ServiceRef ref="id41291783"/>
          <ServiceRef ref="id412Z18A9"/>
        </ServiceGroup>
      </ServiceGroup>
      <ServiceGroup id="stdid07" name="ICMP">
        <ICMPService code="0" comment="" id="icmp-ping_request" name="ping request" type="8"/>
        <ICMPService code="0" comment="" id="icmp-ping_reply" name="ping reply" type="0"/>
        <ICMPService code="0" comment="ICMP messages of this type are needed for traceroute" id="icmp-Time_exceeded" name="time exceeded" type="11"/>
        <ICMPService code="-1" comment="" id="icmp-Unreachables" name="all ICMP unreachables" type="3"/>
        <ICMPService code="1" comment="" id="icmp-Time_exceeded_in_transit" name="time exceeded in transit" type="11"/>
      </ServiceGroup>
      <ServiceGroup id="stdid08" name="UDP">
        <UDPService comment="" dst_range_end="53" dst_range_start="53" id="udp-DNS" name="domain" src_range_end="0" src_range_start="0"/>
        <UDPService comment="" dst_range_end="68" dst_range_start="68" id="udp-bootpc" name="bootpc" src_range_end="0" src_range_start="0"/>
        <UDPService comment="" dst_range_end="67" dst_range_start="67" id="udp-bootps" name="bootps" src_range_end="0" src_range_start="0"/>
        <UDPService comment="Simple Service Discovery Protocol (used for UPnP)" dst_range_end="1900" dst_range_start="1900" id="id41291783" name="SSDP" src_range_end="0" src_range_start="0"/>
      </ServiceGroup>
    </ServiceGroup>
  </Library>
</FWObjectDatabase>
