<!DOCTYPE article PUBLIC "-//GNOME//DTD DocBook PNG Variant V1.1//EN"[

<!ENTITY version "0.8-CVS"> <!-- replace with application version -->
]>


<!-- 
  Document created using the GNOME Application Template Document
  Maintained by the GNOME Documentation Project
  http://developer.gnome.org/projects/gdp
  Template version: 1.0.3
  Template last modified: Nov 16, 2000
-->


<!-- =============Document Header ============================= -->

<article id="index"> <!-- please do not change the id -->

  <artheader>
    <title>Firestarter 0.8.x Manual</title>
    <copyright><year>2001</year><holder>Paul Drain</holder></copyright>

  <!-- translators: uncomment this:

  <copyright>
   <year>2000</year>
   <holder>Translation Author (Latin translation)</holder>
  </copyright>

   -->

  <!-- do not put authorname in the header except in copyright - use
  section "authors" below -->

  <!-- Use this legal notice for online documents which depend on -->
  <!-- core GNOME packages.                                       -->
  <legalnotice id="legalnotice">
   <para>
    Permission is granted to copy, distribute and/or modify this document
    under the terms of the <ulink type="help" 
    url="gnome-help:fdl"><citetitle>GNU Free Documentation
    License</citetitle></ulink>, Version 1.1 or any later version 
    published by the Free Software Foundation with no Invariant Sections, 
    no Front-Cover Texts, and no Back-Cover Texts.  A copy of the license
    can be found <ulink type="help" url="gnome-help:fdl">here</ulink>.
   </para>
   <para>
    Many of the names used by companies to distinguish their products and
    services are claimed as trademarks. Where those names appear in any
    GNOME documentation, and those trademarks are made aware to the members
    of the GNOME Documentation Project, the names have been printed in caps
    or initial caps.
   </para>
  </legalnotice>

  <!-- This is the manual version, not application version. --> 
    <releaseinfo>
        Version 0.8 of the Firestarter manual.
    </releaseinfo>

  </artheader>

 <!-- ============= Document Body ============================= -->

 <!-- ============= Introduction ============================== -->
  <sect1 id="intro">
    <title>Introduction</title>

    <para>
	<application>Firestarter</application> is a GTK+/GNOME Frontend to
	the various Firewalling applications available under Linux, including
	IPchains <ulink url="http://netfilter.kernelnotes.org/ipchains/" type="http"></ulink>
	and IPTables <ulink url="http://netfilter.kernelnotes.org/" type="http"></ulink>.
	It's aim is to provide a functional, secure yet easy to use frontend for
	these firewalling technologies to the GNOME desktop.
    </para>
    
    <para>
      This document describes version &version; of <application>Firestarter</application>. It
      should be considered as a work in progress. It should also be remembered that <application>Firestarter</application>
      is under heavy development and is therefore not feature-complete or polished to a complete standard.
    </para>

    <para>
      Here's a list of some of <application>Firestarter</application>'s features:
    </para>

    <para>
       GNOME integrated
    </para>
	<para>
         <itemizedlist>
  	    <listitem>
               <para>Uses global GNOME themes and settings</para>
            </listitem>
	    <listitem>
	       <para>Translations available for many languages</para>
	    </listitem>
	    <listitem>
	       <para>CORBA used for automation</para>
	    </listitem>
	    <listitem>
	       <para>Extensive Drag and Drop support</para>
	    </listitem>
	 </itemizedlist>
	</para>    
      <para>
         Supports IPChains & IPTables
      </para>
	<para>
	 <itemizedlist>
	    <listitem>
	       <para>Supports both internal and user-defined rulesets</para>
	    </listitem>
	    <listitem>
	       <para>Inbuilt filtering of known trojan and trouble ports</para>
	    </listitem>
	    <listitem>
	       <para>Support for Individual services configuration</para>
	    </listitem>
	    <listitem>
	       <para>Support for tuning ICMP parameters to stop Denial of Service (DoS) attacks</para>
	    </listitem>
	    <listitem>
	       <para>Support for tuning ToS parameters to improve services for connected client computers</para>
	    </listitem>
	    <listitem>
	       <para>Support for NAT and Masquerading functions</para>
	    </listitem>
	 </itemizedlist>
	 </para>   
      <para>
         Advanced kernel tuning features
      </para>
	<para>
	 <itemizedlist>
	    <listitem>
	       <para>Supports glibc's Sysctl tuning to protect the firewall from flooding, broadcasting & spoofing</para>
	    </listitem>
	    <listitem>
	       <para>Configurable custom logfile support</para>
		</listitem>
     </itemizedlist>
    </para>
  </sect1>


 <!-- ================ Usage ================================ -->
 <!-- This section should describe basic usage of the application. -->

  <sect1 id="usage">
    <title>Using Firestarter</title>
    <para>
      <application>Firestarter</application> can be used to produce either
      an IPChains or IPTables compatible firewall depending on your kernel
      configuration. The output produced is a simple shell script that can be
      transported to another machine (including machines without X Windows) and
      run normally - or you can use the <application>Firestarter</application> GUI to
      startup, shutdown control or monitor your script in real-time.
    </para>

    <!-- ========= Basic Usage =========================== -->
    <sect2 id="mainwin">
      <title>Basic usage</title>
      <para>
        Starting <application>Firestarter</application> opens the
        <interface>Main window</interface>, shown in <xref
        linkend="mainwindow-fig">. It will then either prompt you to run 
        through the <application>Firestarter</application> Wizard (if you
        have never run <application>Firestarter</application> before) or it will
        start your chosen configuration and begin monitoring your system.

        <!-- ==== Figure ==== -->
        <figure id="mainwindow-fig">
	  <title>Firestarter Main Window</title>
	  <screenshot>
	    <screeninfo>Firestarter Main Window</screeninfo>
	    <graphic fileref="fs-main_window_logging" format="png" srccredit="pd">
            </graphic>
	  </screenshot>
	</figure>
    <!-- ==== End of Figure ==== -->
      </para> 


 <!--  sect3 = options that users have to use menus (and/or) submenus
  to select. Examples of this are the main functions, the preferences
  menu, the firewall hitlists and the help/about menu combo -->

      <sect3 id="fs-main-wizard">
	<title>Re-Running the Wizard</title>
	<para>
          From time to time, you may wish to re-run the initial <application>Firestarter</application>
          wizard in order to change settings, use other network device, check out the 'advanced' mode
          or simply check your configuration is still correct.
          To stop the firewall and restart the <application>Firestarter</application> Wizard - Select:
          <menuchoice>
	    <guisubmenu>Firewall</guisubmenu>
	    <guimenuitem>Run Firewall Wizard</guimenuitem>
	  </menuchoice>,
        This will change the status of the statusbar to "Firewall Stopped". From here the wizard will start
        and you will be able to work through the settings accordingly.
   </para>
   </sect3>
     
      <sect3 id="fs-main-activation">
	<title>Activating your Firewall</title>
	<para>
          From the initial command screen - you can perform all the major operations
          to get <application>Firestarter</application> started.  To start the firewall
          and get the GUI to monitor traffic - Select:
          <menuchoice>
	    <guisubmenu>Firewall</guisubmenu>
	    <guimenuitem>Start Firewall</guimenuitem>
	  </menuchoice>,
        This will change the status of the statusbar to "Firewall Running". From this point
        the GUI will be able to monitor incoming traffic and display the results on screen.
   </para>
   </sect3>
   
      <sect3 id="fs-main-stopping">
	<title>Stopping your Firewall</title>
	<para>
          If you find you need to stop your firewall - Select:
          <menuchoice>
	    <guisubmenu>Firewall</guisubmenu>
	    <guimenuitem>Stop Firewall</guimenuitem>
	  </menuchoice>,
        This will change the status of the statusbar to "Firewall Stopped". From this point
        the GUI will not monitor any new incoming traffic.
   </para>   
   </sect3>
   
      <sect3 id="fs-main-halting">
	<title>Halting your Firewall</title>
	<para>
          Halting <application>Firestarter</application> will cause your Firewall to stop
          (just as it would if you selected "Stop" above) - however, it will also cause your
          machine to kill off any existing connections and refuse to accept any new ones.
          
          If you suspect your machine has been compromised, you should halt your firewall by
          selecting:
          <menuchoice>
	    <guisubmenu>Firewall</guisubmenu>
	    <guimenuitem>Halt Firewall</guimenuitem>
	  </menuchoice>,
        This will change the status of the statusbar to "Firewall Halted". From this point
        the GUI will not monitor any new incoming traffic.
      </para>   

   <warning>
     <title>Halting your Firewall causes <emphasis>your</emphasis> traffic to Halt too</title>
     <para>
           <application>Firestarter</application> has been designed in such a way that it
           will stop all incoming and outgoing connections, while also killing off any
           existing connections that you may have already established.
           
           If your machine is acting as a masquerading gateway for internal LAN based machines,
           you may wish to use caution when invoking the "Halt" command.
     </para>
     </warning>
   </sect3>


  <!-- If there are other functions performed from the main window,
       they belong here.   -->

    </sect2>
 
    <!-- ========================================================= 
      Additional Sect2's should describe additional windows, such as
      larger dialog boxes, or functionality that differs significantly
      from the most immediate functions of the application. Make the
      structure logical.
      =============================================================  -->


    <sect2 id="toolbar">
      <title>Toolbar</title>
      <para>
        The toolbar (shown in <xref linkend="figure-usage-toolbar">)
        provides access to several commonly used routines.
        <figure id="figure-usage-toolbar">
	  <title>Firestarter Toolbar</title>
	  <screenshot>
	    <screeninfo>Firestarter Main Window Toolbar</screeninfo>
	    <graphic fileref="fs-main_toolbar.png" format="png"></graphic>
	  </screenshot>
	</figure>
        <variablelist>
	  <varlistentry>
	    <term><guimenuitem>Wizard</guimenuitem></term>
	    <listitem>
	      <para>
                Clicking this icon starts the <interface>Firewall Builder</interface> dialog.
              </para>
	    </listitem>
	  </varlistentry>
	  <varlistentry>
	    <term><guimenuitem>Clear Hitlist</guimenuitem></term>
	    <listitem>
	      <para>
                 Clears the existing hitlist.
               </para>
	    </listitem>
	  </varlistentry>
	  <varlistentry>
	    <term><guimenuitem>Reload Hitlist</guimenuitem></term>
	    <listitem>
	      <para>
	             Reloads the hitlist from an existing file.
               </para>
	    </listitem> 
	  </varlistentry>
	  <varlistentry>
	    <term><guimenuitem>Save Hitlist</guimenuitem></term>
	    <listitem>
	      <para>
	             Saves the hitlist in memory to a new file.
               </para>
	    </listitem> 
	  </varlistentry>
	  <varlistentry>
	    <term><guimenuitem>Restart Firewall</guimenuitem></term>
	    <listitem>
	      <para>
	             Purges and Restarts the firewall script.
               </para>
	    </listitem> 
	  </varlistentry>
	  <varlistentry>
	    <term><guimenuitem>Halt Firewall</guimenuitem></term>
	    <listitem>
	      <para>
	             Purges the firewall script and halts all traffic.
               </para>
	    </listitem> 
	  </varlistentry>	
	</variablelist>
       </para>
    </sect2>
    <!-- ========= Menus =========================== --> 

    <sect2 id="menubar">

       <!-- Describing the menubar ensures comprehensive feature
       coverage. Nest itemizedlists inside variablelists so that each
       menu is easily located by indexing software. Proper indentation
       makes it easier! -->

      <title>Menus</title>
        <para>
        The menu (shown in <xref linkend="figure-usage-menubar">)
        provides access to several commonly used routines.
        <figure id="figure-usage-menubar">
	  <title>Firestarter Menubar</title>
	  <screenshot>
	    <screeninfo>Firestarter Main Window Menubar</screeninfo>
	    <graphic fileref="fs-main_menubar.png" format="png"></graphic>
	  </screenshot>
	</figure>
	 </para>
      <para>
	The menu bar, located at the top of the <interface>Main
	Window</interface>, contains the following menus:
       </para>
      <variablelist>
	<varlistentry>
	  <term><guimenu>Firewall</guimenu></term>
	  <listitem>
	    <para>
	       This menu contains:
	       <itemizedlist>
		<listitem>
		  <para>
	            <menuchoice>
		      <shortcut>
			<keycap>R</keycap>
		      </shortcut>
		      <guimenuitem>Run Firewall Wizard</guimenuitem>
		     </menuchoice>
	             &mdash; This restarts the initial <application>Firestarter</application> Wizard.
	           </para>
		</listitem>
		<listitem>
		  <para>
	            <menuchoice>
		      <shortcut>
			<keycap>F</keycap>
		      </shortcut>
		      <guimenuitem>Start Firewall</guimenuitem>
		     </menuchoice>
	             &mdash; This executes the generated script and begins the firewall monitoring.
	           </para>
		</listitem>
		<listitem>
		  <para>
	             <menuchoice>
		      <shortcut>
			<keycap>S</keycap>
		      </shortcut>
		      <guimenuitem>Stop Firewall</guimenuitem>
		    </menuchoice>
	            &mdash; This stops the generated script, reverts your policy to 'ACCEPT' and
	            stops the firewall monitoring.
	          </para>
		</listitem>
		<listitem>
		  <para>
	             <menuchoice>
		      <shortcut>
			<keycap>H</keycap>
		      </shortcut>
		      <guimenuitem>Halt Firewall</guimenuitem>
		    </menuchoice>
	            &mdash; This stops the generated script, sets your policy to 'DENY' and
	            stops the firewall monitoring.
	          </para>
		</listitem>
		<listitem>
		  <para>
	            <menuchoice>
		      <shortcut>
			<keycap>P</keycap>
		      </shortcut>
		      <guimenuitem>Preferences</guimenuitem>
		    </menuchoice>
	            &mdash; This option loads the preferences dialog, allowing you to change
	            the settings of your generated firewall.
	          </para>
		</listitem>
	      </itemizedlist>
	  </para>
	  </listitem>
	</varlistentry>
	
	<varlistentry>
	  <term><guimenu>Hit List</guimenu></term>
	  <listitem>
	    <para>
	   This menu contains:
	   <itemizedlist>
		<listitem>
		  <para>
	            <menuchoice>
		      <shortcut>
			<keycap>C</keycap>
		      </shortcut>
		      <guimenuitem>Clear Firewall Hit List</guimenuitem>
		    </menuchoice>
	            &mdash; This clears the main window hit list dialog.
	          </para>
		</listitem>
		<listitem>
		  <para>
	            <menuchoice>
		      <shortcut>
			<keycap>E</keycap>
		      </shortcut>
		      <guimenuitem>Reload Entire Firewall Hit List</guimenuitem>
		    </menuchoice>
	            &mdash; This reloads the main window hit list - useful after
	            making changes to the firewall via the wizard or the preferences
	            window.
	          </para>
		</listitem>
		<listitem>
		  <para>
	           <menuchoice>
		      <shortcut>
			<keycap>S</keycap>
		      </shortcut>
		      <guimenuitem>Save Current Firewall Hit List</guimenuitem>
		    </menuchoice>
	            &mdash; This saves the contents of the existing firewall list to
	            a file.
          </para>
   		</listitem>
	      </itemizedlist>
	    </para>
	  </listitem>
	</varlistentry>

	<varlistentry>
	  <term><guimenu>Help</guimenu></term>
	  <listitem>
	    <para>
	      This menu contains:
	       <itemizedlist>
		<listitem>
		  <para>
	             <guimenuitem>Manual</guimenuitem> &mdash; This
    	              opens the <application>GNOME Help
    	              Browser</application> and displays this manual.
	          </para>
		</listitem>
		
		<listitem>
		  <para>
	            <guimenuitem>About</guimenuitem> &mdash; This
    	            opens the <interface>About</interface> dialog
    	            which shows basic information about
    	            <application>Firestarter</application>, such as
    	            the author's name, the <application>Firestarter</application> revision,
    	            and the URL for the <application>Firestarter</application> Web page.
	          </para>
		</listitem>
	      </itemizedlist>
            </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </sect2>
  </sect1>

 <!-- ============= Wizard Introduction============================= -->

 <sect1 id="wizard">
  <title>Using the Wizard to Setup your Firewall</title>
  <para>  
    The following chapter steps through the process of configuring your
    firewall using the wizard interface provided. 
  </para>  
  <para>
    <application>Firestarter</application> uses a gnome-druid interface 
    to let the user configure various aspects of their setup.
  </para>
  <para>
   The first time you start <application>Firestarter</application>, the Firewall Wizard will 
   automatically start & configure your firewall. 
   If you wish to re-configure your firewall for any reason, the procedure is the same - simply select:
   <menuchoice>
    <guimenu>Firewall</guimenu>
    <guimenuitem>Run Firewall Wizard</guimenuitem>
   </menuchoice>
  </para>
  <para>
   ...and the dialog shown in <xref linkend="wizard-begin"> will appear.
  </para>
  <figure id="wizard-begin">
   <title>Introduction to the Wizard</title>
   <screenshot>
    <screeninfo>Wizard Introduction</screeninfo>
    <graphic fileref="fs-wizard_begin" format="png"
     srccredit="pd">
    </graphic>
   </screenshot>
  </figure>

  <para>
   Press <guilabel>Next</guilabel> to begin the wizard. 
   You will now be asked for your skill level as shown in <xref linkend="wizard-skills">.
  </para>

  <figure id="wizard-skills">
   <title>Skill Selection Screen</title>
   <screenshot>
    <screeninfo>Skill Selection Screen</screeninfo>
    <graphic fileref="fs-wizard_skill" format="png"
     srccredit="pd">
    </graphic>
   </screenshot>
  </figure>

	       <itemizedlist>
		<listitem>
		  <para>
	             <guimenuitem>Simple</guimenuitem>&mdash; Selecting this option will cause <application>Firestarter</application> to build a firewall that
                is suitable for a single-NIC or Dialup Connection. The Wizard will assume reasonable defaults
                for the other options that are not shown.
	          </para>
		</listitem>
		
		<listitem>
		  <para>
	            <guimenuitem>Advanced</guimenuitem> &mdash; Selecting this option will cause <application>Firestarter</application> to allow you to customise
               all available settings.
	          </para>
		</listitem>
	      </itemizedlist>

   <important>
     <title>If you are using a Cable / DSL service</title>
     <para>
           Users of Cable or DSL connections to the Internet should be sure to select the <emphasis>Advanced</emphasis> option
           to configure your Firewall. There are some 'features' contained in the advanced dialogues that allows the
           generated scripts to workaround these issues - however, there is currently no way of implementing these
           without affecting dial-up users.
     </para>
     </important>
  <para>
    After you have selected your skill level, click on
    <guibutton>Next</guibutton> to apply the changes and proceed to the Firewall setup.
    To cancel the changes and return to previous values, click the
    <guibutton>Cancel</guibutton> button.
  </para>

 </sect1>

 <!-- ============= Wizard (Simple Mode)============================= -->

 <sect1 id="wizard-simple">
  <title>Simple Configuration using the Wizard</title>
  <para>
   The following section lists the steps that <application>Firestarter</application> takes when you select the
   'simple' Firewall configuration.  If you have asked the wizard to proceed in <xref
   linkend="wizard-advanced"> you should proceed to the next section. 
  </para>

  <figure id="wizard-intro">
   <title>Introduction to the Wizard</title>
   <screenshot>
    <screeninfo>Wizard Introduction</screeninfo>
    <graphic fileref="fs-wizard_begin" format="png"
     srccredit="pd">
    </graphic>
   </screenshot>
  </figure>

  <para>
   Press <guilabel>Next</guilabel> to begin the wizard.
  </para>
 	 
 <!-- ==== Figure ==== -->
    <figure id="wizard-netconfig">
	  <title>Network Device Configuration Window</title>
	  <screenshot>
	    <screeninfo>Network Device Configuration Window</screeninfo>
		<graphic fileref="fs-wizard_devices" format="png"
		 srccredit="pd">
		</graphic>
		</screenshot>
		</figure>
 <!-- ==== End of Figure ==== -->
	    <para>
	    The wizard attempts to discover all interfaces that are
	  	currently active on your machine. Generally, you should use either
	  	PPPxx or ETHxx devices unless you are an advanced user and know
	  	you should be selecting something else. 	  
        </para>
		 
	    In addition, the following two options are available:
		 
       <itemizedlist>
  	    <listitem>
        <para>
         <emphasis>Start the Firewall on dial-out</emphasis>
          - If you have a dialup (PPP) interface or a VPN-style interface where
          the connection will be down occasionally, you should select this 
          option.
        </para>
       </listitem>
       
	   <listitem>
	    <para>
	     <emphasis>IP address is assigned via DHCP</emphasis>
	       - If your interface discovers it's IP address via DHCP, you should
	      check this box. Typically, this is used for ISP's and internal
	      company networks.
	    </para>
	    </listitem>
       </itemizedlist>

     <important>
     <title>Starting the Firewall on PPP Connections</title>
     <para>
     As of 0.8.x &mdash <application>Firestarter</application> will <emphasis>not</emphasis> automatically adjust your PPP
     dialup scripts to start the firewall for you, nor will it attempt to restart your firewall if your PPP connection
     is dropped for any reason.
     </para>
     <para>
     See the 'Frequently Asked Questions' section of this document for a temporary solution to this problem
     <!-- the FAQ section should be linked here -->
     </para>
     </important>

      <para>
        After you have selected the interfaces you wish to firewall, click on
        <guibutton>Next</guibutton> to apply the changes and proceed to the ICMP configuration.
        To cancel the changes and return to previous values, click the
        <guibutton>Cancel</guibutton> button.
      </para>	    
	
 <!-- ==== Figure ==== -->
    <figure id="wizard-icmpconfig">
	  <title>ICMP Filtering Configuration Window</title>
	  <screenshot>
	    <screeninfo>ICMP Filtering Configuration Window</screeninfo>
		<graphic fileref="fs-wizard_icmp" format="png"
		 srccredit="pd">
		</graphic>
		</screenshot>
		</figure>
 <!-- ==== End of Figure ==== -->
	    <para>
	  
        </para>

<para>
This option allows you to select which ICMP options you would like to receive on the external interface. 
By default, Firestarter allows all forms of ICMP messages through the firewall, including some uncommon 
or seldomly used options ( such as <emphasis>address masking </emphasis>). 
</para>
<para></para>
<para>
If you are concerned about people performing ping scans, floods or probes on your network - it is 
advised to at least filter some forms of ICMP communication.
</para>
<para></para>
<para>
Firestarter has the following ICMP filtering options are available:
</para>
<para></para>

<itemizedlist>
<listitem>
<para>
<emphasis>Echo </emphasis>- &nbsp;Commonly used in ping flood attacks and fingerprinting 
techniques, it is advisable to filter these unless you are &nbsp;performing network diagnostics, running 
an NTP ( <emphasis>time server</emphasis> ) server, playing network games or are configuring a network 
for the first time.
</para>
</listitem>

<listitem>
<para> 
<emphasis>Traceroute</emphasis><emphasis> &amp;&nbsp;MS Traceroute </emphasis>- Used to find the 
paths between networks. Useful for configuring networks for Quality of Service as well as detecting 
network dropouts. 
Microsoft Traceroute should be filtered if you (or your uplink) do not operate Microsoft DNS servers. 
Standard Traceroute should be filtered if you are running a personal network and probably left 
alone otherwise.
</para>
</listitem>

<listitem>
<para>
<emphasis>Unreachable </emphasis>- &nbsp;Sometimes used in Fingerprinting attacks, Unreachable
messages are sent when a destination host is not responding to a request from your machine. 
Unreachable requests should not be filtered unless you are running DMZ services on your machine.
</para>
</listitem>

<listitem>
<para>
<emphasis>Timestamping </emphasis>- &nbsp;Timestamping is used by internet gateways to 
assess how long a packet destined for a host should remain active before being discarded.
</para>
</listitem>
</itemizedlist>

<para>
<important>
<title>Timestamping is used by many @home providers for Statistics Tracking</title>
<para>
Users of the @home Cable network should <emphasis>not</emphasis> filter Timestamping requests, as these
are commonly used to maintain statistics tracking and keepalives throughout the networks
</para>
</important>
</para>

<itemizedlist>
<listitem>
<para>
<emphasis>Address Masking </emphasis>- &nbsp;No longer used in Linux 2.2 or 2.4, you should 
filter these requests unless you have Linux 2.0 boxes on your internal network. 
</para>
</listitem>

<listitem>
<para>
<emphasis>Redirection </emphasis>- &nbsp;Used in inter-network traffic, Redirection is useful 
if you have networks connected in different locations (possibly different countries) connected via a 
VPN or other networking service. 
In these cases, the gateways can provide redirection for incoming packets, informing them that the 
destination host is actually on the same logical network, and should therefore be forwarded.  If 
you are not in this situation, you may filter these packets. 
</para>
</listitem>

<listitem>
<para>
<emphasis>Source Quenches </emphasis>- &nbsp;No longer used in Linux 2.2 or 2.4, you should 
filter these requests unless you have proprietary UNIX boxes on your internal network that are able
to respond to these. 
</para>
</listitem>
</itemizedlist>       

<para>
<important>
<title>Some LAN Manager Requests require Source Quenches</title>
<para>
Some earlier implemenations of the OS/2 LAN Manager stack (Warp 3.0 and 2.1/Connect) require Source Quenches
to be enabled - we are still unsure why this is, but OS/2->OS/2 communication will silently fail if you enable
filtering of these packets.
</para>
</important>
</para>

<para>
After you have selected the ICMP packets you wish to firewall, click on
<guibutton>Next</guibutton> to apply the changes and proceed to the Services configuration.
To cancel the changes and return to previous values, click the
<guibutton>Cancel</guibutton> button.
</para>	  

</sect1>


 <!-- ============= Customization ============================= -->

 <sect1 id="prefs">
  <title>Customization</title>
  <para>
   To change the application settings, select
   <menuchoice>
    <guimenu>Settings</guimenu>
    <guimenuitem>Preferences...</guimenuitem>
   </menuchoice>.  This opens the
   <interface>Preferences</interface> dialog, shown in <xref
   linkend="preferences-fig">.
  </para>

  <figure id="preferences-fig">
   <title>Preferences Dialog</title>
   <screenshot>
    <screeninfo>Preferences Dialog</screeninfo>
    <graphic fileref="SCREENSHOT" format="png"
     srccredit="ME">
    </graphic>
   </screenshot>
  </figure>

  <para>
   The properties in the <guilabel>PREFSTABNAME</guilabel> tab are:
   
   <!--many people use itemizedlists in cases like this. Variablelists
   are more appropriate -->

      <variablelist>
	<varlistentry>
	  <term> <guilabel>Default Text Style</guilabel></term>
	  <listitem>
	    <para>
              Select the default text style for statements in your
              proof.  You can still change the style for individual
              proofs or sections of a proof at a later date.
            </para>
	  </listitem>
	</varlistentry>
	<varlistentry>
	  <term>(Configuration Item Label)</term>
	  <listitem>
	    <para>
             (Description of Configuration)
             </para>
	  </listitem>
	</varlistentry>
	<varlistentry>
	  <term>(Configuration Item Label)</term>
	  <listitem>
	    <para>
             (Description of Configuration)
             </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </para>

    <para>
     The properties in the <guilabel>SECONDTABNAME</guilabel> tab are:
       <variablelist>
	<varlistentry>
	  <term>(Configuration Item Label)</term>
	  <listitem>
	    <para>
             (Description of Configuration)
             </para>
	  </listitem>
	</varlistentry>
	<varlistentry>
	  <term>(Configuration Item Label)</term>
	  <listitem>
	    <para>
             (Description of Configuration)
             </para>
	  </listitem>
	</varlistentry>
      </variablelist>
    </para>

  <para>
    After you have made all the changes you want, click on
    <guibutton>OK</guibutton> to apply the changes and close the
    <interface>Properties</interface> dialog. To cancel the changes
    and return to previous values, click the
    <guibutton>Close</guibutton> button.
  </para>

 </sect1>


 <!-- ============= Various Sections ============================= -->

 <!-- Here you should add, if necessary, several more sect1's,
 describing other windows (besides the main one), file formats,
 preferences dialogs,  etc. as appropriate. Try not to make any of
 these sections too long. -->

 <!-- ============= Bugs ================================== -->
 <!-- This section should describe known bugs and limitations of
      the program if there are any - please be frank and list all
      problems you know of. -->
 <sect1 id="bugs">
  <title>Known Bugs and Limitations</title>
  <para>
  <itemizedlist>
    <listitem>
    
      <para>
        The Port Forwarding rules currently filter both incoming and outgoing
        packets using the same rule if you use the 'Simple Mode' firewall. 
        (Which assumes several defaults for single-homed boxes).
        
        Therefore, If you intend on using Firestarter to portforward a box that 
        requires outbound traffic to be established on the same port that it
        originated from (eg. SMTP) - Be sure to use the 'Advanced Mode' firewall
        settings in the wizard.
      </para>        
    </listitem>
    <listitem>
      <para>
        The Subseven trojan will still work on the outbound filter if
        activated from another Linux machine that has had the 'don't fragment'
        flag set.
        
        Firestarter now includes Sysctl behaviours to workaround this issue. If you
        wish to stop internal hosts from sending data to the firewall on ports that
        may be affected by this issue, please enable the 'Advanced Mode' firewall settings
        and choose 'Always Defragment Packets from the Miscellanous menu of 'Sysctl Options'
     </para>
    </listitem>
  </itemizedlist>

    <application>Firestarter</application> is still beta software. This means
    that sometimes it may crash and sometimes it may not work as
    expected. However, we encourage you to test it and report any bugs
    you find. This will help us make <application>Firestarter</application>
    as bug-free as possible.  Of course, if you have the inclination and
    the ability, patches to the source code are always welcome.
  </para>
 </sect1>


 <!-- ============= Compiling from CVS =========================== -->
 <!-- This section should describe the general way to compile the
 application from CVS -->
 
 <appendix id="CVS">
  <title>Compiling Firestarter from CVS</title>
 
  <para>
  <warning>
    The following section is intended for testers, developers and users seeking the most bleeding-edge code
    available. 

  <para>
    CVS releases of <application>Firestarter</application> are not stable, release quality code. If you are
    interested in obtaining the latest, stable release - you can download a tarball of the source code from
    the <application>Firestarter</application> homepage at
    <ulink url="http://sourceforge.net/projects/firestarter/" type="http">Sourceforge</ulink>
  </para>
  
  </warning>
  </para>
  
  <para>
    You also can checkout the most recent <application>Firestarter</application>
    sources from the CVS server at Sourceforge.
    Here are the commands you need to enter in a terminal:
  </para>
  
    <para>
    <screen>
      <prompt>[bash]$ </prompt><userinput>export CVSROOT=':pserver:anonymous@cvs.firestarter.sourceforge.net:/cvsroot/firestarter'</userinput>
      <prompt>[bash]$ </prompt><userinput>cvs login</userinput>
      (Logging in to anonymous@cvs.firestarter.sourceforge.net)
      CVS password:
    </screen>
    </para>

  <para>Simply press enter here, there is no password.</para>

  <screen>
    <prompt>[bash]$ </prompt><userinput>cvs -z3 checkout firestarter</userinput>
  </screen>

  <para>
    The source code will be downloaded to the 'firestarter' subdirectory.  To compile, 
    change to the 'firestarter' subdirectory and type the following commands:
  </para>

  <screen>
    <prompt>[bash]$ </prompt><userinput>./autogen.sh</userinput>
    <prompt>[bash]$ </prompt><userinput>make</userinput>
  </screen>

  <para>If all goes well, su to root and type:</para>

  <screen>
    <prompt>[bash]$ </prompt><userinput>make install</userinput>
  </screen>

  <para>
    If you already have a recent CVS <application>Firestarter</application> checkout from 
    the CVS server at Sourceforge - You can simply enter the following commands to update
    it to the current version.
  </para>

    <screen>
      <prompt>[bash]$ </prompt><userinput>cd [copy_of_current_CVS_source_code]/</userinput>
      <prompt>[bash]$ </prompt><userinput>export CVSROOT=':pserver:anonymous@cvs.firestarter.sourceforge.net:/cvsroot/firestarter'</userinput>
      <prompt>[bash]$ </prompt><userinput>cvs login</userinput>
      (Logging in to anonymous@cvs.firestarter.sourceforge.net)
      CVS password:
    </screen>

  <para>Again, simply press enter here, there is no password.</para>

  <screen>
    <prompt>[bash]$ </prompt><userinput>cvs -z3 update -Pd firestarter</userinput>
  </screen>

  <para>
    CVS will update source code to the latest revision from CVS.
  </para>

 </appendix>


<!-- ============= Authors ================================ -->

 <sect1 id="authors">
  <title>Authors</title>
  <para>
   <application>Firestarter</application> was written by Tomas Junnonen
   (<email>majix@sci.fi</email>) and Paul Drain (<email>pd@cipherfunk.org</email>). 
   To find more information about <application>Firestarter</application>, please visit 
   the <ulink url="http://firestarter.sourceforge.net" type="http">Firestarter Web
   page</ulink>.  Please send all comments, suggestions, and bug
   reports to the <ulink url="http://bugs.gnome.org" type="http">GNOME
   bug tracking database</ulink>.  (Instructions for submitting bug
   reports can be found <ulink
   url="http://bugs.gnome.org/Reporting.html" type="http">
   on-line</ulink>.)  You can also use <application>Bug Report
   Tool</application> (<command>bug-buddy</command>), available in the
   <guisubmenu>Utilities</guisubmenu> submenu of <guimenu>Main
   Menu</guimenu>, for submitting bug reports.
  </para>

  <para>
   This manual was written by Paul Drain
   (<email>pd@cipherfunk.org</email>). Please send all comments and
   suggestions regarding this manual to the <ulink type="http"
   url="http://developer.gnome.org/projects/gdp">GNOME Documentation
   Project</ulink> by sending an email to
   <email>docs@gnome.org</email>. You can also add your comments
   online by using the <ulink type="http"
   url="http://developer.gnome.org/projects/gdp/doctable/">GNOME
   Documentation Status Table</ulink>.
  </para>

  <!-- For translations: uncomment this:

  <para>
   Latin translation was done by ME
   (<email>MYNAME@MYADDRESS</email>). Please send all  comments  and
   suggestions regarding this translation to SOMEWHERE.
  </para>

  -->

 </sect1>

 <!-- ============= Application License ============================= -->

 <sect1 id="license">
  <title>License</title>
  <para>
   This program is free software; you can redistribute it and/or
   modify it under the terms of the  <ulink type="help" url="gnome-help:gpl">
    <citetitle>GNU General Public License</citetitle></ulink> as
   published by the Free Software Foundation; 
   either version 2 of the License, or (at your option) any later
   version.
  </para>
  <para>
   This program is distributed in the hope that it will be useful, but
   WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   <citetitle>GNU General Public License</citetitle> for more details.
  </para>
  <para>
   A copy of the <citetitle>GNU General Public License</citetitle> is
   included as an appendix to the <citetitle>GNOME Users
   Guide</citetitle>.  You may also obtain a copy of the
   <citetitle>GNU General Public License</citetitle> from the Free
   Software Foundation by visiting <ulink type="http"
   url="http://www.fsf.org">their Web site</ulink> or by writing to
   <address>
    Free Software Foundation, Inc.
    <street>59 Temple Place</street> - Suite 330
    <city>Boston</city>, <state>MA</state> <postcode>02111-1307</postcode>
    <country>USA</country>
   </address>
  </para>
 </sect1>

</article>









