# $Id: ipf.objs,v 1.2 2001/02/01 12:27:18 camield Exp $
#
# WARNING: _example_ objects with values
#
# The objects, values and lay-out of this file are overdone and 
# serve to demonstrate the following:
# - you can use whitespace in the objects and values (flags H)
# - the lay-out is flexible
# - a value may be another object ("UNWANTED")
# - the order of objects or values does not matter
#
# Usage: ``ipfmeta ipf.objs <ipf.metarules''
#
# This instructs ipfmeta to read the objects from ipf.objs.
# After this, it will fetch the metarules from stdin, expand
# the objects in the metarules and dump output to stdout.
#
# Debug: ``echo "%dump" | ipfmeta ipf.objs''
#

[BLOCK-TCP]
    23		# telnet
    37		# time
    111		# portmap
    119		# news
    143		# imap
    389		# ldap
    407		# Timbuktu
    513		# 'r' services
    514		# syslog
    5800	# vnc
    5900	# vnc
    6667	# irc
    6668	# irc

[BROADCAST]
    # all broadcast addresses
    0.0.0.0/32
    xxx.yyy.zz1.255/32
    xxx.yyy.zz2.255/32
    xxx.yyy.zz3.255/32
    255.255.255.255/32

[UNWANTED]	PRIVATE	MULTICAST	# other objects

[PRIVATE]
    192.168.0.0/16
    172.16.0.0/12
    127.0.0.0/8
    10.0.0.0/8

[MULTICAST]
    224.0.0.0/4

# Corp. is allowed to manage their own webservers
[CORP-MGMT]
    aaa.bbb.ccc.dd1/32
    aaa.bbb.ccc.dd2/32
    aaa.bbb.ccc.dd3/32
[CORP-WWW]
    xxx.yyy.zz1.10/32
    xxx.yyy.zz1.11/32
    xxx.yyy.zz1.12/32
[CORP-TPT] # tcp ports
    1433 5631
[CORP-UPT] # udp ports
    22 5632

# "TCP handshake"
[flags H]	"flags S/SAFR"

# NetBIOS, SMB CIFS: ports 135-139 inclusive
[NETBIOS]	"134 >< 140"

# shorter
[K-F]	"keep frags"
[K-S]	"keep state"
[K-SF]	"keep state keep frags"

# TCP flags used by nmap
[NMAP]
    SF/SF	# SYN-FIN (can be legitimate if using T/TCP)
    /FSRA	# NULL scan
    FUP		# can be legitimate