<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
                 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
<!-- For license information see sanewall-manual-info.xml.in -->
<refentry id="helpconf-action">

<refmeta>
<refentrytitle>action config helper: sanewall-action</refentrytitle>
<manvolnum>5</manvolnum>
</refmeta>

<refnamediv>
<refdescriptor>sanewall-action</refdescriptor>
<refname>sanewall-action</refname>
<refpurpose>set up custom filter actions</refpurpose>
</refnamediv>

<refsynopsisdiv>
  <cmdsynopsis>
    <command>action</command>
    <arg choice="plain">chain</arg>
    <arg choice="plain"><replaceable>name</replaceable></arg>
    <arg choice="plain"><replaceable>action</replaceable></arg>
  </cmdsynopsis>
</refsynopsisdiv>

<refsect1><title>Description</title>
  <para>
    The <command>action</command> helper command creates an iptables
    chain which can be used to control the action of other firewall
    rules once the firewall is running.
  </para>
  <para>
    For example, you can setup the custom action ACT1, which by default
    is ACCEPT, but can be dynamically changed to DROP, REJECT or RETURN
    (and back) without restarting the firewall.
  </para>
  <para>
    The <option><replaceable>name</replaceable></option> can be any
    chain name accepted by iptables. You should try to keep it within
    5 and 10 characters.
  </para>
  <note><para>
    The <option><replaceable>name</replaceable></option>s created with
    this command are case-sensitive.
  </para></note>
  <para>
    The <option><replaceable>action</replaceable></option> can be any
    of those supported by <application>Sanewall</application> (see
    <xref linkend="ref-actions"/>). Only ACCEPT, REJECT, DROP, RETURN
    have any meaning in this instance.
  </para>
</refsect1>

<refsect1><title>Examples</title>
  <para>
    To create a custom chain and have some rules use it:
    <programlisting>action chain ACT1 accept

interface any world
    server smtp ACT1
    client smtp ACT1
    </programlisting>
  </para>
  <para>
    Once the firewall is running you can dynamically modify the behaviour
    of the chain from the Linux command-line, as detailed below:
  </para>
  <para>
    To insert a DROP action at the start of the chain to override the
    default action (ACCEPT):
    <programlisting>iptables -t filter -I ACT1 -j DROP</programlisting>
  </para>
  <para>
    To delete the DROP action from the start of the chain to return to the
    default action:
    <programlisting>iptables -t filter -D ACT1 -j DROP</programlisting>
  </para>
  <note><para>
    If you delete all of the rules in the chain, the default will be to
    RETURN, in which case the behaviour will be as if any rules with the
    action were not present in the configuration file.
  </para></note>
  <para>
    You can also create multiple chains simultaneously. To create 3
    ACCEPT and 3 DROP chains you can do the following:
    <programlisting>action chain "ACT1 ACT2 ACT3" accept
action chain "ACT4 ACT5 ACT6" drop
    </programlisting>
  </para>
</refsect1>

<refsect1><title>See Also</title>
  <simplelist type="vert">
    <member><xref linkend="sanewall"/></member>
    <member><xref linkend="sanewall.conf"/></member>
    <member><xref linkend="ref-actions"/></member>
    <member>administration tool for IPv4 firewalls: iptables(8)</member>
  </simplelist>
</refsect1>

</refentry>
