NARC
NARC (Netfilter Automatic Rules Configurator) is a free firewalling package for Netfilter/Iptables, released under the BSD license. It attempts to simplify the setup of a firewall (stateful packet filter) via the iptables tools. It is a bash shellscript that generates (hopefully) sensible and secure rules for Netfilter based on a simple configuration file. It features quick setup via a simple configuration file, connection tracking (and fragmentation reassembly), customized logging, probe detection (TCP & UDP), and much more.
| Tags | Security |
|---|---|
| Licenses | BSD Original |
| Operating Systems | POSIX Linux |
| Implementation | Unix Shell bash |
Recent releases
- 12 Aug 2004 20:52
Changes: This release implements IPLIMIT so that it works with 2.4 and 2.6 kernels, implements port forwarding to other interfaces (no longer limited to DMZ), fixes an error in the install script that omitted a mkdir, and removes the TCP port 445 (microsoft-ds) from TCP_PROBE.
- 12 Nov 2002 09:40
Changes: Even more sanity checking was added. A new experimental install script was added. The default logging level was changed from kern.=info to kern.=debug in narc.conf. Please modify your syslog.conf to accommodate the change. The LOG_LIMIT_EXCEED option was added to log TCP connections that exceed the LIMIT_RATE in narc.conf.
- 07 Oct 2002 16:32
Changes: Errant detection of the ipchains module has been fixed. Modules detection has been changed to include /lib for certain distributions. An AUTOGET_EXTERNAL_IP option has been added for narc-forward.conf. More typos have been fixed.
- 19 Feb 2002 14:19
Changes: rp_filter (ingress filtering) and ENABLE_IPLIMIT have been fixed. This is the first NARC release to be compatible with the previous (0.6) narc.conf file.
- 17 Jan 2002 10:32
Changes: The NARC executable path is now configurable (used by /etc/init.d/iptables). NARC was rewritten to make adding future options easier. Support for general rate limiting was added. Support for IP/network based connection limit (TCP only) was added. More logging options were added (ICMP, packet length, iplimit). General code cleanup and optimizations were made.
