d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Mdoc style, spelling, grammar and wording fixes. This manpage needs more work.

Browse Source
This commit is contained in:
Christian Brueffer 2009-03-19 10:42:07 +00:00
parent 29986e1bac
commit cdd14ccabe
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=190026
1 changed files with 68 additions and 62 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

130
sbin/ipfw/ipfw.8
View File

@ -1,7 +1,7 @@
.\" .\"
.\" $FreeBSD$ .\" $FreeBSD$
.\" .\"
.Dd September 27, 2008 .Dd February 7, 2009
.Dt IPFW 8 .Dt IPFW 8
.Os .Os
.Sh NAME .Sh NAME
@ -606,10 +606,10 @@ To delete previously applied tag, use the
keyword. keyword.
.Pp .Pp
Note: since tags are kept with the packet everywhere in kernelspace, Note: since tags are kept with the packet everywhere in kernelspace,
they can be set and unset anywhere in kernel network subsystem they can be set and unset anywhere in the kernel network subsystem
(using (using the
.Xr mbuf_tags 9 .Xr mbuf_tags 9
facility), not only by means of facility), not only by means of the
.Xr ipfw 4 .Xr ipfw 4
.Cm tag .Cm tag
and and
@ -862,8 +862,8 @@ actions.
.It Cm setfib Ar fibnum .It Cm setfib Ar fibnum
The packet is tagged so as to use the FIB (routing table) The packet is tagged so as to use the FIB (routing table)
.Ar fibnum .Ar fibnum
in any subsequent forwarding decisions. Initially this is in any subsequent forwarding decisions.
limited to the values 0 through 15. See Initially this is limited to the values 0 through 15, see
.Xr setfib 8 . .Xr setfib 8 .
Processing continues at the next rule. Processing continues at the next rule.
.El .El
@ -1166,7 +1166,7 @@ Destination options
.Pq Cm dstopt , .Pq Cm dstopt ,
IPSec authentication headers IPSec authentication headers
.Pq Cm ah , .Pq Cm ah ,
and IPSec encapsulated security payload headers and IPsec encapsulated security payload headers
.Pq Cm esp . .Pq Cm esp .
.It Cm fib Ar fibnum .It Cm fib Ar fibnum
Matches a packet that has been tagged to use Matches a packet that has been tagged to use
@ -1835,13 +1835,12 @@ A pipe emulates a link with given bandwidth, propagation delay,
queue size and packet loss rate. queue size and packet loss rate.
Packets are queued in front of the pipe as they come out from the classifier, Packets are queued in front of the pipe as they come out from the classifier,
and then transferred to the pipe according to the pipe's parameters. and then transferred to the pipe according to the pipe's parameters.
.Pp
.It Em queue .It Em queue
A queue A queue
is an abstraction used to implement the WF2Q+ is an abstraction used to implement the WF2Q+
(Worst-case Fair Weighted Fair Queueing) policy, which is (Worst-case Fair Weighted Fair Queueing) policy, which is
an efficient variant of the WFQ policy. an efficient variant of the WFQ policy.
.br .Pp
The queue associates a The queue associates a
.Em weight .Em weight
and a reference pipe to each flow, and then all backlogged (i.e., and a reference pipe to each flow, and then all backlogged (i.e.,
@ -1850,8 +1849,8 @@ bandwidth proportionally to their weights.
Note that weights are not priorities; a flow with a lower weight Note that weights are not priorities; a flow with a lower weight
is still guaranteed to get its fraction of the bandwidth even if a is still guaranteed to get its fraction of the bandwidth even if a
flow with a higher weight is permanently backlogged. flow with a higher weight is permanently backlogged.
.Pp
.El .El
.Pp
In practice, In practice,
.Em pipes .Em pipes
can be used to set hard limits to the bandwidth that a flow can use, whereas can be used to set hard limits to the bandwidth that a flow can use, whereas
@ -2101,7 +2100,7 @@ If you are logged in over a network, loading the
version of version of
.Nm .Nm
is probably not as straightforward as you would think. is probably not as straightforward as you would think.
I recommend the following command line: The following command line is recommended:
.Bd -literal -offset indent .Bd -literal -offset indent
kldload ipfw && \e kldload ipfw && \e
ipfw add 32000 allow ip from any to any ipfw add 32000 allow ip from any to any
@ -2141,14 +2140,13 @@ The nat configuration command is the following:
.Ek .Ek
.Ed .Ed
.Pp .Pp
.
The following parameters can be configured: The following parameters can be configured:
.Bl -tag -width indent .Bl -tag -width indent
.It Cm ip Ar ip_address .It Cm ip Ar ip_address
Define an ip address to use for aliasing. Define an ip address to use for aliasing.
.It Cm if Ar nic .It Cm if Ar nic
Use ip addres of NIC for aliasing, dynamically changing Use ip address of NIC for aliasing, dynamically changing
it if NIC's ip address change. it if NIC's ip address changes.
.It Cm log .It Cm log
Enable logging on this nat instance. Enable logging on this nat instance.
.It Cm deny_in .It Cm deny_in
@ -2171,27 +2169,26 @@ To let the packet continue after being (de)aliased, set the sysctl variable
.Va net.inet.ip.fw.one_pass .Va net.inet.ip.fw.one_pass
to 0. to 0.
For more information about aliasing modes, refer to For more information about aliasing modes, refer to
.Xr libalias 3 .Xr libalias 3 .
.
See Section See Section
.Sx EXAMPLES .Sx EXAMPLES
for some examples about nat usage. for some examples about nat usage.
.Sh REDIRECT AND LSNAT SUPPORT IN IPFW .Sh REDIRECT AND LSNAT SUPPORT IN IPFW
Redirect and LSNAT support follow closely the syntax used in Redirect and LSNAT support follow closely the syntax used in
.Xr natd 8 .Xr natd 8 .
.
See Section See Section
.Sx EXAMPLES .Sx EXAMPLES
for some examples on how to do redirect and lsnat. for some examples on how to do redirect and lsnat.
.Sh SCTP NAT SUPPORT .Sh SCTP NAT SUPPORT
Sctp nat can be configured in a simillar manner to TCP through the SCTP nat can be configured in a similar manner to TCP through the
ipfw command line tool .Nm
.Xr ipfw 8 command line tool.
, the main difference is that The main difference is that
.Nm sctp nat .Nm sctp nat
does not do port does not do port translation.
translation. Since the local and global side ports will be the same, Since the local and global side ports will be the same,
there is no need to specify both. Ports are redirected as follows: there is no need to specify both.
Ports are redirected as follows:
.Bd -ragged -offset indent .Bd -ragged -offset indent
.Bk -words .Bk -words
.Cm nat .Cm nat
@ -2203,15 +2200,16 @@ there is no need to specify both. Ports are redirected as follows:
.Ek .Ek
.Ed .Ed
.Pp .Pp
.
Most Most
.B sctp nat .Nm sctp nat
configuration can be done in real-time through the configuration can be done in real-time through the
.B sysctl(8) .Xr sysctl 8
interface. All may be changed dynamically, though the hash_table size will only interface.
change for new All may be changed dynamically, though the hash_table size will only
.Nm nat change for new
instances. See .Nm nat
instances.
See
.Sx SYSCTL VARIABLES .Sx SYSCTL VARIABLES
for more info. for more info.
.Sh SYSCTL VARIABLES .Sh SYSCTL VARIABLES
@ -2238,22 +2236,23 @@ ports and vtags match but global address does not)
will accept and process all OOTB global AddIP messages. will accept and process all OOTB global AddIP messages.
.El .El
.Pp .Pp
Option 1 should never be selected as this forms a security risk. An attacker can Option 1 should never be selected as this forms a security risk.
An attacker can
establish multiple fake associations by sending AddIP messages. establish multiple fake associations by sending AddIP messages.
.It Va net.inet.ip.alias.sctp.chunk_proc_limit: No 5 .It Va net.inet.ip.alias.sctp.chunk_proc_limit: No 5
Defines the maximum number of chunks in an SCTP packet that will be parsed for a Defines the maximum number of chunks in an SCTP packet that will be parsed for a
packet that matches an existing association. This value is enforced to be greater or equal packet that matches an existing association.
than This value is enforced to be greater or equal than
.Cm net.inet.ip.alias.sctp.initialising_chunk_proc_limit . .Cm net.inet.ip.alias.sctp.initialising_chunk_proc_limit .
A high value is A high value is
a DoS risk yet setting too low a value may result in important control chunks in a DoS risk yet setting too low a value may result in important control chunks in
the packet not being located and parsed. the packet not being located and parsed.
.It Va net.inet.ip.alias.sctp.error_on_ootb: No 1 .It Va net.inet.ip.alias.sctp.error_on_ootb: No 1
Defines when the Defines when the
.Nm nat .Nm nat
responds to any Out-of-the-Blue (OOTB) packets with ErrorM responds to any Out-of-the-Blue (OOTB) packets with ErrorM packets.
packets. An OOTB packet is a packet that arrives with no existing association An OOTB packet is a packet that arrives with no existing association
registered in the registered in the
.Nm nat .Nm nat
and is not an INIT or ASCONF-AddIP packet: and is not an INIT or ASCONF-AddIP packet:
.Bl -tag -width indent .Bl -tag -width indent
@ -2263,8 +2262,8 @@ ErrorM is never sent in response to OOTB packets.
ErrorM is only sent to OOTB packets received on the local side. ErrorM is only sent to OOTB packets received on the local side.
.It Cm 2 .It Cm 2
ErrorM is sent to the local side and on the global side ONLY if there is a ErrorM is sent to the local side and on the global side ONLY if there is a
partial match (ports and vtags match but the source global IP does not). This partial match (ports and vtags match but the source global IP does not).
value is only useful if the This value is only useful if the
.Nm nat .Nm nat
is tracking global IP addresses. is tracking global IP addresses.
.It Cm 3 .It Cm 3
@ -2273,20 +2272,21 @@ ErrorM is sent in response to all OOTB packets on both the local and global side
.El .El
.Pp .Pp
At the moment the default is 0, since the ErrorM packet is not yet At the moment the default is 0, since the ErrorM packet is not yet
supported by most SCTP stacks. When it is supported, and if not tracking supported by most SCTP stacks.
When it is supported, and if not tracking
global addresses, we recommend setting this value to 1 to allow global addresses, we recommend setting this value to 1 to allow
multi-homed local hosts to function with the multi-homed local hosts to function with the
.Nm nat . .Nm nat .
To track global addresses, we recommend setting this value to 2 to To track global addresses, we recommend setting this value to 2 to
allow global hosts to be informed when they need to (re)send an allow global hosts to be informed when they need to (re)send an
ASCONF-AddIP. Value 3 should never be chosen (except for debugging) as ASCONF-AddIP.
the Value 3 should never be chosen (except for debugging) as the
.Nm nat .Nm nat
will respond to all OOTB global packets (a DoS risk). will respond to all OOTB global packets (a DoS risk).
.It Va net.inet.ip.alias.sctp.hashtable_size: No 2003 .It Va net.inet.ip.alias.sctp.hashtable_size: No 2003
Size of hash tables used for Size of hash tables used for
.Nm nat .Nm nat
lookups (100 < prime_number > 1000001) lookups (100 < prime_number > 1000001).
This value sets the This value sets the
.Nm hash table .Nm hash table
size for any future created size for any future created
@ -2294,26 +2294,33 @@ size for any future created
instance and therefore must be set prior to creating a instance and therefore must be set prior to creating a
.Nm nat .Nm nat
instance. instance.
The table sizes my be changed to suit specific needs. If there will be few The table sizes may be changed to suit specific needs.
concurrent associations, and memory is scarce, you may make these smaller. If If there will be few
there will be many thousands (or millions) of concurrent associations, you concurrent associations, and memory is scarce, you may make these smaller.
should make these larger. A prime number is best for the table size. The sysctl If there will be many thousands (or millions) of concurrent associations, you
should make these larger.
A prime number is best for the table size.
The sysctl
update function will adjust your input value to the next highest prime number. update function will adjust your input value to the next highest prime number.
.It Va net.inet.ip.alias.sctp.holddown_time: No 0 .It Va net.inet.ip.alias.sctp.holddown_time: No 0
Hold association in table for this many seconds after receiving a Hold association in table for this many seconds after receiving a
SHUTDOWN-COMPLETE. This allows endpoints to correct shutdown gracefully if a SHUTDOWN-COMPLETE.
This allows endpoints to correct shutdown gracefully if a
shutdown_complete is lost and retransmissions are required. shutdown_complete is lost and retransmissions are required.
.It Va net.inet.ip.alias.sctp.init_timer: No 15 .It Va net.inet.ip.alias.sctp.init_timer: No 15
Timeout value while waiting for (INIT-ACK|AddIP-ACK). Timeout value while waiting for (INIT-ACK|AddIP-ACK).
This value cannot be 0. This value cannot be 0.
.It Va net.inet.ip.alias.sctp.initialising_chunk_proc_limit: No 2 .It Va net.inet.ip.alias.sctp.initialising_chunk_proc_limit: No 2
Defines the maximum number of chunks in an SCTP packet that will be parsed when Defines the maximum number of chunks in an SCTP packet that will be parsed when
no existing association exists that matches that packet. Ideally this packet no existing association exists that matches that packet.
will only be an INIT or ASCONF-AddIP packet. A higher value may become a DoS Ideally this packet
will only be an INIT or ASCONF-AddIP packet.
A higher value may become a DoS
risk as malformed packets can consume processing resources. risk as malformed packets can consume processing resources.
.It Va net.inet.ip.alias.sctp.param_proc_limit: No 25 .It Va net.inet.ip.alias.sctp.param_proc_limit: No 25
Defines the maximum number of parameters within a chunk that will be parsed in a Defines the maximum number of parameters within a chunk that will be parsed in a
packet. As for other similar sysctl variables, larger values pose a DoS risk. packet.
As for other similar sysctl variables, larger values pose a DoS risk.
.It Va net.inet.ip.alias.sctp.log_level: No 0 .It Va net.inet.ip.alias.sctp.log_level: No 0
Level of detail in the system log messages (0 \- minimal, 1 \- event, Level of detail in the system log messages (0 \- minimal, 1 \- event,
2 \- info, 3 \- detail, 4 \- debug, 5 \- max debug). May be a good 2 \- info, 3 \- detail, 4 \- debug, 5 \- max debug). May be a good
@ -2335,7 +2342,7 @@ association is limited to this value
.El .El
.Pp .Pp
This variable is fully dynamic, the new value will be adopted for all newly This variable is fully dynamic, the new value will be adopted for all newly
arriving associations, existing association are treated as they were previously. arriving associations, existing associations are treated as they were previously.
Global tracking will decrease the number of collisions within the Global tracking will decrease the number of collisions within the
.Nm nat .Nm nat
at a cost at a cost
@ -2552,10 +2559,10 @@ by adding the following to the top of a ruleset:
This rule drops all incoming packets that appear to be coming from another This rule drops all incoming packets that appear to be coming from another
directly connected system but on the wrong interface. directly connected system but on the wrong interface.
For example, a packet with a source address of For example, a packet with a source address of
.Li 192.168.0.0/24 .Li 192.168.0.0/24 ,
, configured on configured on
.Li fxp0 .Li fxp0 ,
, but coming in on but coming in on
.Li fxp1 .Li fxp1
would be dropped. would be dropped.
.Ss DYNAMIC RULES .Ss DYNAMIC RULES
@ -2875,14 +2882,13 @@ Work on
.Nm dummynet .Nm dummynet
traffic shaper supported by Akamba Corp. traffic shaper supported by Akamba Corp.
.Pp .Pp
Sctp SCTP
.Nm nat .Nm nat
support has been developed by support has been developed by
.An The Centre for Advanced Internet Architectures (CAIA) Aq http://www.caia.swin.edu.au . .An The Centre for Advanced Internet Architectures (CAIA) Aq http://www.caia.swin.edu.au .
The primary developers and maintainers are David Hayes and Jason But. The primary developers and maintainers are David Hayes and Jason But.
For further information visit: For further information visit:
.Aq http://www.caia.swin.edu.au/urp/SONATA .Aq http://www.caia.swin.edu.au/urp/SONATA
.
.Sh BUGS .Sh BUGS
The syntax has grown over the years and sometimes it might be confusing. The syntax has grown over the years and sometimes it might be confusing.
Unfortunately, backward compatibility prevents cleaning up mistakes Unfortunately, backward compatibility prevents cleaning up mistakes
@ -2933,8 +2939,8 @@ or quoted appropriately.
.Pp .Pp
Due to the architecture of Due to the architecture of
.Xr libalias 3 , .Xr libalias 3 ,
ipfw nat is not compatible with the tcp segmentation offloading ipfw nat is not compatible with the TCP segmentation offloading (TSO).
(TSO). Thus, to reliably nat your network traffic, please disable TSO Thus, to reliably nat your network traffic, please disable TSO
on your NICs using on your NICs using
.Xr ifconfig 8 . .Xr ifconfig 8 .
.Pp .Pp