Multi target configuration
Manage several firewalls from within the same document. Define targets, set the active target and edit its ruleset as you would for localhost.
Features
Two editors, one ruleset, no scripting.
KMyFirewall provides an easy to use graphical interface for firewall setup. You can build advanced rulesets without writing firewall scripts, and you can have a working ruleset within a few clicks without limiting your possibilities.
Core capabilities
The parts that are common to both graphical editors.
Remote control
Manage remote firewalls over SSH using KDE KIO. Install, run and inspect the configuration on a remote host, with all traffic encrypted.
Auto configuration
Detect network interfaces, application paths and the init system. The auto configuration script can also be used for remote targets.
Two separate interfaces
One interface for normal end users, another for IPTables experts. Both operate on the same document and can export to each other where supported.
Undo and redo
A transaction based, multilevel undo and redo engine. Experiments are easy to reverse, and the engine is fast and reliable.
Predefined rulesets
Start from rule set templates for a workstation, a NAT firewall or a web server. Save your own templates for repeated deployments.
KMyFirewall is designed not to get in the way. It needs no manual scripting, offers an import and export path for rulesets, and can install or uninstall the generated scripts in the init system. The interface integrates closely with KDE and is meant to be almost intuitive.
Generic Interface
An abstract model for personal firewalls and small networks.
The Generic Interface presents an abstract view of what kind of network traffic may or may not pass your computer. You work with zones, hosts and services instead of raw chains and targets.
Rules are generated by a compiler plugin, so the model is operating system and backend independent. Currently only the iptables compiler is implemented, with OpenBSD support planned.
Generic Interface features
- Zone and host based rule creation.
- No port numbers need to be known.
- NAT and simple network router support.
- Special hosts such as trusted and banned hosts.
- Rule inheritance can be enabled or disabled for nested network zones.
- Export a ruleset to the IPTables Interface and preview it there.
IPTables Interface
A close view of the ruleset that will be generated.
The IPTables Interface represents the IPTables ruleset almost one to one. It is meant for experienced system administrators who need very fine grained rulesets, and it is tightly bound to the netfilter and iptables toolkit on Linux.
The interface uses an XML based command generation engine that can be extended by plugins describing a new option. A plugin framework provides editors for rule options, so new IPTables features can be supported without changing the whole application.
IPTables Interface features
- Stateful packet filtering.
- IP, MAC, protocol, TOS and interface based filtering.
- Limiting packet matches, which helps against DoS attacks.
- Logging of dropped packets.
- View the running IPTables configuration.
- NAT configuration with SNAT and DNAT, including masquerading.
- User defined chains and MANGLE configuration.
- Undo and redo.
Planned features
These items were planned by the project. They are not presented as available features.
Both interfaces
- OpenBSD support.
- An improved plugin framework.
- Better documentation.
- More predefined ruleset templates.
- Monitor the running configuration in real time with a system tray applet, Linux only.
- Log file analysis.
- Dynamic insertion of new rules.
- KHotNewStuff support for protocol definitions and ruleset templates.
Interface specific
- Generic Interface: allow host group definitions.
- IPTables Interface: perform a sanity check for the ruleset.
- IPTables Interface: make the GUI more intuitive.
KDE integration
Built for the KDE Desktop Environment, with a plugin architecture based on KParts and XMLGUI.
KMyFirewall uses KDE technologies for its plugin framework, configuration dialogs and remote file access. Almost every function is performed by dynamically loaded plugins, which keeps the code modular and makes extensions easier to write.
Installer plugins allow support for different init systems. The current release implements the Linux installer and the iptables compiler.
For the full technical description, read Features in the handbook, or continue with Download and FAQ.
External background: KDE, IPTables and the SourceForge project.