The firewalls GuardDog generates are based on a "what is not explicitly allowed, is denied" philosophy.
A problem with a lot of these protocols is that they require very large ranges of ports to be opened which.
The 'protocoldatabase' file contains information about network protocols and which TCP and UDP connections need to be permitted in order to allow them through the firewall.
It typically looks like this (short version):
# GuardDog Protocol Database
#
# by Simon Edwards
# simon@simonzone.com
#
# Port lists can not contain spaces. Ports maybe separated with ','s
# and ranges may be used with the ':' char. Use a singe dash if no
# ports need to be specified. '*' indicates any port while '+' indicates
# non-reserved ports 1024:65535.
#
# In_Port_List is the list of ports that incoming packets are allowed to use.
# In_Source_Port_List is the list of ports that incoming packets are allowed to come from.
# Out_Port_List is the list of ports that outgoing packets are allowed to go to.
# Out_Source_Port_List is the list of ports that outgoing packets are allowed to be from.
# Name In_TCP In_Src_TCP Out_TCP Out_Src_TCP In_UDP In_Src_UDP Out_UDP Out_Src_UDP Description
#
[Clients]
domain - - 53 * * 53 53 * "Domain Name Service (recommended)"
HTTP - - 80,8000,8080 + - - - - "World Wide Web"
FTP 1024:5999,6010:65535 20 21 + - - - - "FTP - File Transfer Protocol"
PassiveFTP - - 21 + - - - - "Passive FTP - Web style FTP"
ICQ + + + + + 4000 4000 + "ICQ"
SMTP - - 25 + - - - - "SMTP mail"
[Servers]
domain * 53 53 * 53 * * 53 "Domain Name Service"
HTTP 80 * - - - - - - "HTTP server"
FTP 21 * 1024:5999,6010:65535 20 - - - - "FTP - File Transfer Protocol"
Telnet 23 * - - - - - - "Telnet login"
SMTP 25 * - - - - - - "SMTP mail server"
The file itself is simply a text file. Lines beginning with a '#' are treated as comments and ignored. Blank lines are also ignored. It is divided into two sections, Clients and Servers. The clients section corresponds to the clients pane in the GUI and holds information about protocols where the the firewalled machine is acting as a client. The servers section matches the servers pane. Each section is introduced with a line containing only '[Clients]' or '[Servers]'. Each section consists of one line 'records', one for each protocol. The format of a protocol record is:
Values for In_TCP, In_Src_TCP, Out_TCP, Out_Src_TCP, In_UDP, In_Src_UDP, Out_UDP and Out_Src_UDP can be a port(s) specification or one of the following short-hand symbols:
Ports ranges can be specified using a ':' (colon) between the start of the range and the end of the
range. The range is inclusive. Multiple port numbers and port ranges can be specified and separated
by commas (','). Port numbers must be specified in decimal, names for well known ports from
/etc/services
are not permitted.
Lets go through a real world example.
# Name In_TCP In_Src_TCP Out_TCP Out_Src_TCP In_UDP In_Src_UDP Out_UDP Out_Src_UDP Description
[Clients]
domain - - 53 * * 53 53 * "Domain Name Service (recommended)"
This is the specification for a client using the Domain Name System (DNS). With In_TCP and In_Src_TCP both set to -, meaning no port, no incoming connections are needed or permitted. Out_TCP is set to 53, and Out_Src_TCP is set to * meaning any port. This means that out going connections to port 53 on the Name Server from any source port on our firewalled client machine are permitted.
Lets skip ahead slightly to Out_UDP and Out_Src_UDP. They are set to 53 and "any port" respectively. This just means that outgoing UDP packets to port 53 on the Name Server from any source port on our firewalled client machine are permitted. Now just because we have allowed some UDP packets out doesn't mean we have allowed any replies in. This is why In_UDP and In_Src_UDP are set to "any port" and 53 respectively. This is to allow the reply UDP packets from the Name Server back in.
If you write a protocol record please email it to me so that I can add it to the GuardDog protocol database.