Usage: stratum firewall <action> [arguments]   (module type: service)

A host firewall with ufw. Stratum manages its own ufw rules (marked with the
comment "stratum: ..."); rules added by hand with ufw stay as they are.
SSH guard: SSH (the ports sshd listens on) is always allowed, unless an own
rule for that port exists - so switching the firewall on does not lock you out.

Every change that could cut the connection (start, enable, settings and
rules while the firewall runs) must be confirmed within 60 seconds with
"stratum firewall confirm" (in the menu: "Keep") - otherwise the previous
state is restored automatically.

Actions:
  status                    state, settings, rules, interfaces, listening
                            services (allowed or blocked), ufw status
  start | stop              firewall on / off now (boot setting unchanged)
  enable | disable          on and at boot / off and not at boot
  restart                   apply the settings and rules again
  confirm | rollback        keep the last change / restore the state before it
  settings                  all settings with their values
  setting <key> <value>:
      type <name>             workstation | server | hypervisor | vm-guest -
                              resets the settings and rules to its defaults
      incoming deny|reject|allow    default for incoming connections
      outgoing allow|deny           default for outgoing connections
      routed deny|allow             forwarding (VMs, containers)
      ipv6 yes|no                   rules also for IPv6
      icmp allow|deny               answer ping
      sshlimit yes|no               rate limit for SSH (6 connections / 30 s)
      logging off|low|medium|high
      docker protect|open           published container ports: follow the
                                    rules (protect) or bypass them (open)
  rules                     the rules, numbered
  rule-add <allow|limit|deny> <service|tcp:PORT|udp:PORT|any:PORT> [interface|any] [from|any]
                            e.g.  rule-add allow web
                                  rule-add allow tcp:8080 ens18 10.0.0.0/24
                                  rule-add limit ssh any 192.168.1.0/24
  rule-remove <number>      remove a rule (see: rules)
  module-rules              rules of other modules (/etc/stratum/firewall.d)
  apply-modules             apply the rules of other modules (no confirmation:
                            they only allow; used by the modules themselves)
  events [hours]            blocked connections (default: 24 h): top sources,
                            top ports and the last 10 (needs logging)
  interfaces                network interfaces with their addresses
  docker-mode               how published Docker container ports are handled
  docker-apply              apply the rules to Docker (DOCKER-USER; also run
                            by stratum-firewall-docker.service when Docker starts)
  port-allowed <proto> <port>   exit status 0 when the port is open to others
  listening                 listening services and whether they are let in
  help                      show this help

Firewall of the guests of a VM Reactor host (nftables, family bridge, table
vmreactor): the module owns the rules in /etc/stratum/firewall/guests/<id>.json
and VM Reactor sends only what the user set. A guest in the LAN mode
(macvtap / macvlan) bypasses the host and has no rules here.
  guest-list                every guest with its rules (JSON)
  guest-get <id>            one stored guest (JSON; exit 1 when it has none)
  guest-set <id>            store the guest from stdin (JSON) and apply
  guest-remove <id>         remove the guest's rules and apply
  guest-counters <id>       packets per verdict of its chains (JSON)
  guest-apply               apply the stored rules again (also at boot)

In Control Desk the guests are one entry - "Guest firewalls" - which lists them
and opens the same windows the rules of the host use: on or off, the two
policies, anti-spoofing, logging, a rule added in five steps, the table shown.

Services for rule-add:
