Global Options Firewall Configuration
Overview
Some firewall settings are global and affect the entire system. This section provides information about these global options that you can configure using the VyOS CLI.
Configuration commands covered in this section:
Configuration
By default, when VyOS receives an ICMP echo request packet destined for itself, it answers with an ICMP echo reply, unless your firewall prevents it.
You can set firewall rules to accept, drop, or reject ICMP in, out, or local traffic. You can also use the firewall global-options all-ping command. This command affects only LOCAL traffic (packets destined for your VyOS system), not IN or OUT traffic.
Note
firewall global-options all-ping affects only LOCAL traffic and always behaves in the most restrictive way
set firewall global-options all-ping enable
When you set this command, VyOS answers every ICMP echo request addressed to itself, but that response occurs only if no other rule drops or rejects local echo requests. In case of conflict, VyOS does not answer ICMP echo requests.
set firewall global-options all-ping disable
When you set this command, VyOS answers no ICMP echo requests addressed to itself, regardless of where they come from or what specific rules accept them.
Apply IPv4 or IPv6 firewall rules to bridged traffic.
Enable or disable the response to ICMP broadcast messages. The system alters the following parameter:
net.ipv4.icmp_echo_ignore_broadcasts
Set whether VyOS accepts packets with a source route option. The following sysctl parameters will be changed:
net.ipv4.conf.all.accept_source_routenet.ipv6.conf.all.accept_source_route
Allow VyOS to accept ICMPv4 and ICMPv6 redirect messages. The following sysctl parameters will be changed:
net.ipv4.conf.all.accept_redirectsnet.ipv6.conf.all.accept_redirects
Allow VyOS to send ICMPv4 redirect messages. The following sysctl parameter will be changed:
net.ipv4.conf.all.send_redirects
Allow VyOS to log martian IPv4 packets. The following sysctl parameter will be changed:
net.ipv4.conf.all.log_martians
Set the IPv4 source validation mode. The following sysctl parameter will be changed:
net.ipv4.conf.all.rp_filter
Allow VyOS to use IPv4 TCP SYN Cookies. The following sysctl parameter will be changed:
net.ipv4.tcp_syncookies
Enable or disable VyOS RFC 1337 conformance. The following sysctl parameter will be changed:
net.ipv4.tcp_rfc1337
Set the global setting for an established connection.
Set the global setting for invalid packets.
VyOS supports setting timeouts for connections by connection type. You can set timeout values for generic connections, ICMP connections, UDP connections, or TCP connections in various states.