Global Options Firewall Configuration
Overview
Some firewall settings are global and have an affect on the whole system. In this section there’s useful information about these global-options that can be configured using vyos cli.
Configuration commands covered in this section:
Configuration
By default, when VyOS receives an ICMP echo request packet destined for itself, it will answer with an ICMP echo reply, unless you prevent it through its firewall.
With the firewall you can set rules to accept, drop or reject ICMP in, out or local traffic. You can also use the general firewall all-ping command. This command affects only to LOCAL (packets destined for your VyOS system), not to IN or OUT traffic.
Note
firewall global-options all-ping affects only to LOCAL and it always behaves in the most restrictive way
set firewall global-options all-ping enable
When the command above is set, VyOS will answer every ICMP echo request addressed to itself, but that will only happen if no other rule is applied dropping or rejecting local echo requests. In case of conflict, VyOS will not answer ICMP echo requests.
set firewall global-options all-ping disable
When the command above is set, VyOS will answer no ICMP echo request addressed to itself at all, no matter where it comes from or whether more specific rules are being applied to accept them.
Use these commands to also use IPv4, or IPv6 firewall rules for bridged traffic
This setting enables or disables the response to icmp broadcast messages. The following system parameter will be altered:
net.ipv4.icmp_echo_ignore_broadcasts
This setting handles if VyOS accepts packets with a source route option. The following system parameters will be altered:
net.ipv4.conf.all.accept_source_route
net.ipv6.conf.all.accept_source_route
Enable or disable ICMPv4 or ICMPv6 redirect messages being accepted by VyOS. The following system parameters will be altered:
net.ipv4.conf.all.accept_redirects
net.ipv6.conf.all.accept_redirects
Enable or disable ICMPv4 redirect messages being sent by VyOS The following system parameter will be altered:
net.ipv4.conf.all.send_redirects
Enable or disable the logging of martian IPv4 packets. The following system parameter will be altered:
net.ipv4.conf.all.log_martians
Set the IPv4 source validation mode. The following system parameter will be altered:
net.ipv4.conf.all.rp_filter
Enable or disable if VyOS uses IPv4 TCP SYN Cookies. The following system parameter will be altered:
net.ipv4.tcp_syncookies
Enable or Disable VyOS to be RFC 1337 conformant. The following system parameter will be altered:
net.ipv4.tcp_rfc1337
Set the global setting for an established connection.
Set the global setting for invalid packets.
VyOS supports setting timeouts for connections according to the connection type. You can set timeout values for generic connections, for ICMP connections, UDP connections, or for TCP connections in a number of different states.