Initial revision
Release 4.
Made it work on non RedHat systems.
client/server/route now accept many services on the same line.
Other minor fixes and enhancements.
Verified NFS operation.
Service ntp is now both TCP and UDP and accepts clients from default ports.
DNS over TCP is stateful but over UDP is now not stateful. This will not bother your syslog if your DNS server fails to reply within the stateful UDP timeout of iptables.
Added service rsync.
Added service vmwareauth.
Added service vmwareweb.
Added DEFAULT_ROUTER_POLICY to control how firehol handles its routing.
Fixed a bug where firehol script arguments were not passed to /etc/init.d/iptables.
Increased version number to 5.
Added control for unmatched packets using:
UNMATCHED_INPUT_POLICY=
UNMATCHED_OUTPUT_POLICY=
UNMATCHED_ROUTER_POLICY=
and removed DEFAULT_ROUTER_POLICY since iptables accepts only DROP and ACCEPT.

To control what will happen to unmatched packets just set the above variables
in /etc/firehol.conf

Note that in any case (e.g. UMATCHED_ROUTER_POLICY=ACCEPT) the packets will
still be logged to syslog.

Made also various aesthetic changes in the code.

Rules programmers can now include their service names in the
ALL_SHOULD_ALSO_RUN variable and the "all" service will run them
automatically.
Fixed negative expressions in FireHOL statements.
By default, when multiple instances of interfaces/ports/addresses exist
FireHOL produces one rule for each instance. However when negative
expressions were defined the previous approach was producing ORed iptables
statements instead of ANDed statements.
The new code, now produces linked lists of iptables chains for all negative
expressions so that only if ALL the negative are matched, one rule for each
positive expression will be produced.

Example: interface eth0 myname src "1.1.1.1 2.2.2.2"

This will correctly produce two indepedent rules, one for each IP address.
But:

interface eth0 myname src NOT "1.1.1.1 2.2.2.2"

was incorrectly producing two indepedent rules. Now the later statement
produces a linked list that first matches that the source of the packets
is not 1.1.1.1, in which case it forwards the packets to the second chain
in the lists that confirms that the packets are not comming from 2.2.2.2,
which finally sends the packets to their destination to be checked if they
are comming from eth0.

Note: I don't know the overhead of this linked list thing. I hope iptables
is fast enough...
Added services RNDC, FINGER, ECHO, DAYTIME, NNTP
Added file README
Changed TFTP from TCP to UDP.
Removed service TFTP since this requires a kernel module for stateful
operation.

After suggestions by Fco.Felix Belmonte (ffelix@gescosoft.com),
I have added:

a) RESERVED_IPS, PRIVATE_IPS, MULTICAST_IPS and UNROUTABLE_IPS
You can use the above in SRC (not) parameters to match them.
The use of UNROUTABLE_IPS is suggested for cases where an interface is
exclusivelly public.

b) kernel module requirements per complex service and for the
configuration file as a whole.
Now you can use:

# one line for each module, somewhere in your config file
require_kernel_module <kernel_module>

to have FireHOL require some kernel module to succesfully complete
the firewall configuration.

As an option for those running NAT, you can use:

FIREHOL_NAT=1 # put this at the top of your config file

to make the complex services require also the NAT modules for the
services they implement.

Finally, I have added a get-iana.sh script that produces one BASH
statement for RESERVED_IPS.
Added logging options support as suggested by:
Fco.Felix Belmonte <ffelix@gescosoft.com>
Added example config.
Added service IRC.
Extended kernel modules handling to simple services too.
Simple services can now have:

require_myservice_modules="module"
require_myservice_nat_modules="module"

in order to have these modules installed if and when "myservice" is
used.

Added the "masquerade" interfaces subcommand, that gives a shortcut to
masquerade on the output of an interface.

FireHOL, now have a separate rule to match all RELATED sockets on all
chains. This is always added at the top of the firewall.

FireHOL, now DROPs all INVALID packets, as suggested by the iptables
HOW-TO.

Various other minor enhancements.
Added a third interface and moved the client definition to this one.
Now it should be even more generic.
Fixed the typo in the "grep" and fixed the label of the printout.
Added example home-adsl.conf
Now, it rejects idents.
Added home-dialup.conf
Minor fixes in others.
CVS test
Added CVS versioning to all files.
Added support for ICMP floods protection and from BAD TCP flags protection.
This was suggested by: Fco.Felix Belmonte (ffelix@gescosoft.com).