added netfilter-default config option in /etc/firejail/firejail.config

1 files changed, 7 insertions, 0 deletions

diff --git a/etc/firejail.config b/etc/firejail.config
index 59bbd77a5..20c4d7a5f 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -27,6 +27,13 @@
 # --netfilter only to root user. Regular users are only allowed --net=none.
 # restricted-network no
 
+# Change default netfilter configuration. When using --netfilter option without
+# a file argument, the default filter is hardcoded (see man 1 firejail). This
+# configuration entry allows the user to change the default by specifying
+# a file containing the filter configuration. The filter file format is the
+# format of  iptables-save  and iptable-restore commands. Example:
+# netfilter-default /etc/iptables.iptables.rules
+
 # Enable or disable seccomp support, default enabled.
 # seccomp yes