Mdoc style, spelling, grammar and wording fixes. This manpage needs more work.
This commit is contained in:
parent
29986e1bac
commit
cdd14ccabe
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=190026
130
sbin/ipfw/ipfw.8
130
sbin/ipfw/ipfw.8
@ -1,7 +1,7 @@
|
|||||||
.\"
|
.\"
|
||||||
.\" $FreeBSD$
|
.\" $FreeBSD$
|
||||||
.\"
|
.\"
|
||||||
.Dd September 27, 2008
|
.Dd February 7, 2009
|
||||||
.Dt IPFW 8
|
.Dt IPFW 8
|
||||||
.Os
|
.Os
|
||||||
.Sh NAME
|
.Sh NAME
|
||||||
@ -606,10 +606,10 @@ To delete previously applied tag, use the
|
|||||||
keyword.
|
keyword.
|
||||||
.Pp
|
.Pp
|
||||||
Note: since tags are kept with the packet everywhere in kernelspace,
|
Note: since tags are kept with the packet everywhere in kernelspace,
|
||||||
they can be set and unset anywhere in kernel network subsystem
|
they can be set and unset anywhere in the kernel network subsystem
|
||||||
(using
|
(using the
|
||||||
.Xr mbuf_tags 9
|
.Xr mbuf_tags 9
|
||||||
facility), not only by means of
|
facility), not only by means of the
|
||||||
.Xr ipfw 4
|
.Xr ipfw 4
|
||||||
.Cm tag
|
.Cm tag
|
||||||
and
|
and
|
||||||
@ -862,8 +862,8 @@ actions.
|
|||||||
.It Cm setfib Ar fibnum
|
.It Cm setfib Ar fibnum
|
||||||
The packet is tagged so as to use the FIB (routing table)
|
The packet is tagged so as to use the FIB (routing table)
|
||||||
.Ar fibnum
|
.Ar fibnum
|
||||||
in any subsequent forwarding decisions. Initially this is
|
in any subsequent forwarding decisions.
|
||||||
limited to the values 0 through 15. See
|
Initially this is limited to the values 0 through 15, see
|
||||||
.Xr setfib 8 .
|
.Xr setfib 8 .
|
||||||
Processing continues at the next rule.
|
Processing continues at the next rule.
|
||||||
.El
|
.El
|
||||||
@ -1166,7 +1166,7 @@ Destination options
|
|||||||
.Pq Cm dstopt ,
|
.Pq Cm dstopt ,
|
||||||
IPSec authentication headers
|
IPSec authentication headers
|
||||||
.Pq Cm ah ,
|
.Pq Cm ah ,
|
||||||
and IPSec encapsulated security payload headers
|
and IPsec encapsulated security payload headers
|
||||||
.Pq Cm esp .
|
.Pq Cm esp .
|
||||||
.It Cm fib Ar fibnum
|
.It Cm fib Ar fibnum
|
||||||
Matches a packet that has been tagged to use
|
Matches a packet that has been tagged to use
|
||||||
@ -1835,13 +1835,12 @@ A pipe emulates a link with given bandwidth, propagation delay,
|
|||||||
queue size and packet loss rate.
|
queue size and packet loss rate.
|
||||||
Packets are queued in front of the pipe as they come out from the classifier,
|
Packets are queued in front of the pipe as they come out from the classifier,
|
||||||
and then transferred to the pipe according to the pipe's parameters.
|
and then transferred to the pipe according to the pipe's parameters.
|
||||||
.Pp
|
|
||||||
.It Em queue
|
.It Em queue
|
||||||
A queue
|
A queue
|
||||||
is an abstraction used to implement the WF2Q+
|
is an abstraction used to implement the WF2Q+
|
||||||
(Worst-case Fair Weighted Fair Queueing) policy, which is
|
(Worst-case Fair Weighted Fair Queueing) policy, which is
|
||||||
an efficient variant of the WFQ policy.
|
an efficient variant of the WFQ policy.
|
||||||
.br
|
.Pp
|
||||||
The queue associates a
|
The queue associates a
|
||||||
.Em weight
|
.Em weight
|
||||||
and a reference pipe to each flow, and then all backlogged (i.e.,
|
and a reference pipe to each flow, and then all backlogged (i.e.,
|
||||||
@ -1850,8 +1849,8 @@ bandwidth proportionally to their weights.
|
|||||||
Note that weights are not priorities; a flow with a lower weight
|
Note that weights are not priorities; a flow with a lower weight
|
||||||
is still guaranteed to get its fraction of the bandwidth even if a
|
is still guaranteed to get its fraction of the bandwidth even if a
|
||||||
flow with a higher weight is permanently backlogged.
|
flow with a higher weight is permanently backlogged.
|
||||||
.Pp
|
|
||||||
.El
|
.El
|
||||||
|
.Pp
|
||||||
In practice,
|
In practice,
|
||||||
.Em pipes
|
.Em pipes
|
||||||
can be used to set hard limits to the bandwidth that a flow can use, whereas
|
can be used to set hard limits to the bandwidth that a flow can use, whereas
|
||||||
@ -2101,7 +2100,7 @@ If you are logged in over a network, loading the
|
|||||||
version of
|
version of
|
||||||
.Nm
|
.Nm
|
||||||
is probably not as straightforward as you would think.
|
is probably not as straightforward as you would think.
|
||||||
I recommend the following command line:
|
The following command line is recommended:
|
||||||
.Bd -literal -offset indent
|
.Bd -literal -offset indent
|
||||||
kldload ipfw && \e
|
kldload ipfw && \e
|
||||||
ipfw add 32000 allow ip from any to any
|
ipfw add 32000 allow ip from any to any
|
||||||
@ -2141,14 +2140,13 @@ The nat configuration command is the following:
|
|||||||
.Ek
|
.Ek
|
||||||
.Ed
|
.Ed
|
||||||
.Pp
|
.Pp
|
||||||
.
|
|
||||||
The following parameters can be configured:
|
The following parameters can be configured:
|
||||||
.Bl -tag -width indent
|
.Bl -tag -width indent
|
||||||
.It Cm ip Ar ip_address
|
.It Cm ip Ar ip_address
|
||||||
Define an ip address to use for aliasing.
|
Define an ip address to use for aliasing.
|
||||||
.It Cm if Ar nic
|
.It Cm if Ar nic
|
||||||
Use ip addres of NIC for aliasing, dynamically changing
|
Use ip address of NIC for aliasing, dynamically changing
|
||||||
it if NIC's ip address change.
|
it if NIC's ip address changes.
|
||||||
.It Cm log
|
.It Cm log
|
||||||
Enable logging on this nat instance.
|
Enable logging on this nat instance.
|
||||||
.It Cm deny_in
|
.It Cm deny_in
|
||||||
@ -2171,27 +2169,26 @@ To let the packet continue after being (de)aliased, set the sysctl variable
|
|||||||
.Va net.inet.ip.fw.one_pass
|
.Va net.inet.ip.fw.one_pass
|
||||||
to 0.
|
to 0.
|
||||||
For more information about aliasing modes, refer to
|
For more information about aliasing modes, refer to
|
||||||
.Xr libalias 3
|
.Xr libalias 3 .
|
||||||
.
|
|
||||||
See Section
|
See Section
|
||||||
.Sx EXAMPLES
|
.Sx EXAMPLES
|
||||||
for some examples about nat usage.
|
for some examples about nat usage.
|
||||||
.Sh REDIRECT AND LSNAT SUPPORT IN IPFW
|
.Sh REDIRECT AND LSNAT SUPPORT IN IPFW
|
||||||
Redirect and LSNAT support follow closely the syntax used in
|
Redirect and LSNAT support follow closely the syntax used in
|
||||||
.Xr natd 8
|
.Xr natd 8 .
|
||||||
.
|
|
||||||
See Section
|
See Section
|
||||||
.Sx EXAMPLES
|
.Sx EXAMPLES
|
||||||
for some examples on how to do redirect and lsnat.
|
for some examples on how to do redirect and lsnat.
|
||||||
.Sh SCTP NAT SUPPORT
|
.Sh SCTP NAT SUPPORT
|
||||||
Sctp nat can be configured in a simillar manner to TCP through the
|
SCTP nat can be configured in a similar manner to TCP through the
|
||||||
ipfw command line tool
|
.Nm
|
||||||
.Xr ipfw 8
|
command line tool.
|
||||||
, the main difference is that
|
The main difference is that
|
||||||
.Nm sctp nat
|
.Nm sctp nat
|
||||||
does not do port
|
does not do port translation.
|
||||||
translation. Since the local and global side ports will be the same,
|
Since the local and global side ports will be the same,
|
||||||
there is no need to specify both. Ports are redirected as follows:
|
there is no need to specify both.
|
||||||
|
Ports are redirected as follows:
|
||||||
.Bd -ragged -offset indent
|
.Bd -ragged -offset indent
|
||||||
.Bk -words
|
.Bk -words
|
||||||
.Cm nat
|
.Cm nat
|
||||||
@ -2203,15 +2200,16 @@ there is no need to specify both. Ports are redirected as follows:
|
|||||||
.Ek
|
.Ek
|
||||||
.Ed
|
.Ed
|
||||||
.Pp
|
.Pp
|
||||||
.
|
|
||||||
Most
|
Most
|
||||||
.B sctp nat
|
.Nm sctp nat
|
||||||
configuration can be done in real-time through the
|
configuration can be done in real-time through the
|
||||||
.B sysctl(8)
|
.Xr sysctl 8
|
||||||
interface. All may be changed dynamically, though the hash_table size will only
|
interface.
|
||||||
change for new
|
All may be changed dynamically, though the hash_table size will only
|
||||||
.Nm nat
|
change for new
|
||||||
instances. See
|
.Nm nat
|
||||||
|
instances.
|
||||||
|
See
|
||||||
.Sx SYSCTL VARIABLES
|
.Sx SYSCTL VARIABLES
|
||||||
for more info.
|
for more info.
|
||||||
.Sh SYSCTL VARIABLES
|
.Sh SYSCTL VARIABLES
|
||||||
@ -2238,22 +2236,23 @@ ports and vtags match but global address does not)
|
|||||||
will accept and process all OOTB global AddIP messages.
|
will accept and process all OOTB global AddIP messages.
|
||||||
.El
|
.El
|
||||||
.Pp
|
.Pp
|
||||||
Option 1 should never be selected as this forms a security risk. An attacker can
|
Option 1 should never be selected as this forms a security risk.
|
||||||
|
An attacker can
|
||||||
establish multiple fake associations by sending AddIP messages.
|
establish multiple fake associations by sending AddIP messages.
|
||||||
.It Va net.inet.ip.alias.sctp.chunk_proc_limit: No 5
|
.It Va net.inet.ip.alias.sctp.chunk_proc_limit: No 5
|
||||||
Defines the maximum number of chunks in an SCTP packet that will be parsed for a
|
Defines the maximum number of chunks in an SCTP packet that will be parsed for a
|
||||||
packet that matches an existing association. This value is enforced to be greater or equal
|
packet that matches an existing association.
|
||||||
than
|
This value is enforced to be greater or equal than
|
||||||
.Cm net.inet.ip.alias.sctp.initialising_chunk_proc_limit .
|
.Cm net.inet.ip.alias.sctp.initialising_chunk_proc_limit .
|
||||||
A high value is
|
A high value is
|
||||||
a DoS risk yet setting too low a value may result in important control chunks in
|
a DoS risk yet setting too low a value may result in important control chunks in
|
||||||
the packet not being located and parsed.
|
the packet not being located and parsed.
|
||||||
.It Va net.inet.ip.alias.sctp.error_on_ootb: No 1
|
.It Va net.inet.ip.alias.sctp.error_on_ootb: No 1
|
||||||
Defines when the
|
Defines when the
|
||||||
.Nm nat
|
.Nm nat
|
||||||
responds to any Out-of-the-Blue (OOTB) packets with ErrorM
|
responds to any Out-of-the-Blue (OOTB) packets with ErrorM packets.
|
||||||
packets. An OOTB packet is a packet that arrives with no existing association
|
An OOTB packet is a packet that arrives with no existing association
|
||||||
registered in the
|
registered in the
|
||||||
.Nm nat
|
.Nm nat
|
||||||
and is not an INIT or ASCONF-AddIP packet:
|
and is not an INIT or ASCONF-AddIP packet:
|
||||||
.Bl -tag -width indent
|
.Bl -tag -width indent
|
||||||
@ -2263,8 +2262,8 @@ ErrorM is never sent in response to OOTB packets.
|
|||||||
ErrorM is only sent to OOTB packets received on the local side.
|
ErrorM is only sent to OOTB packets received on the local side.
|
||||||
.It Cm 2
|
.It Cm 2
|
||||||
ErrorM is sent to the local side and on the global side ONLY if there is a
|
ErrorM is sent to the local side and on the global side ONLY if there is a
|
||||||
partial match (ports and vtags match but the source global IP does not). This
|
partial match (ports and vtags match but the source global IP does not).
|
||||||
value is only useful if the
|
This value is only useful if the
|
||||||
.Nm nat
|
.Nm nat
|
||||||
is tracking global IP addresses.
|
is tracking global IP addresses.
|
||||||
.It Cm 3
|
.It Cm 3
|
||||||
@ -2273,20 +2272,21 @@ ErrorM is sent in response to all OOTB packets on both the local and global side
|
|||||||
.El
|
.El
|
||||||
.Pp
|
.Pp
|
||||||
At the moment the default is 0, since the ErrorM packet is not yet
|
At the moment the default is 0, since the ErrorM packet is not yet
|
||||||
supported by most SCTP stacks. When it is supported, and if not tracking
|
supported by most SCTP stacks.
|
||||||
|
When it is supported, and if not tracking
|
||||||
global addresses, we recommend setting this value to 1 to allow
|
global addresses, we recommend setting this value to 1 to allow
|
||||||
multi-homed local hosts to function with the
|
multi-homed local hosts to function with the
|
||||||
.Nm nat .
|
.Nm nat .
|
||||||
To track global addresses, we recommend setting this value to 2 to
|
To track global addresses, we recommend setting this value to 2 to
|
||||||
allow global hosts to be informed when they need to (re)send an
|
allow global hosts to be informed when they need to (re)send an
|
||||||
ASCONF-AddIP. Value 3 should never be chosen (except for debugging) as
|
ASCONF-AddIP.
|
||||||
the
|
Value 3 should never be chosen (except for debugging) as the
|
||||||
.Nm nat
|
.Nm nat
|
||||||
will respond to all OOTB global packets (a DoS risk).
|
will respond to all OOTB global packets (a DoS risk).
|
||||||
.It Va net.inet.ip.alias.sctp.hashtable_size: No 2003
|
.It Va net.inet.ip.alias.sctp.hashtable_size: No 2003
|
||||||
Size of hash tables used for
|
Size of hash tables used for
|
||||||
.Nm nat
|
.Nm nat
|
||||||
lookups (100 < prime_number > 1000001)
|
lookups (100 < prime_number > 1000001).
|
||||||
This value sets the
|
This value sets the
|
||||||
.Nm hash table
|
.Nm hash table
|
||||||
size for any future created
|
size for any future created
|
||||||
@ -2294,26 +2294,33 @@ size for any future created
|
|||||||
instance and therefore must be set prior to creating a
|
instance and therefore must be set prior to creating a
|
||||||
.Nm nat
|
.Nm nat
|
||||||
instance.
|
instance.
|
||||||
The table sizes my be changed to suit specific needs. If there will be few
|
The table sizes may be changed to suit specific needs.
|
||||||
concurrent associations, and memory is scarce, you may make these smaller. If
|
If there will be few
|
||||||
there will be many thousands (or millions) of concurrent associations, you
|
concurrent associations, and memory is scarce, you may make these smaller.
|
||||||
should make these larger. A prime number is best for the table size. The sysctl
|
If there will be many thousands (or millions) of concurrent associations, you
|
||||||
|
should make these larger.
|
||||||
|
A prime number is best for the table size.
|
||||||
|
The sysctl
|
||||||
update function will adjust your input value to the next highest prime number.
|
update function will adjust your input value to the next highest prime number.
|
||||||
.It Va net.inet.ip.alias.sctp.holddown_time: No 0
|
.It Va net.inet.ip.alias.sctp.holddown_time: No 0
|
||||||
Hold association in table for this many seconds after receiving a
|
Hold association in table for this many seconds after receiving a
|
||||||
SHUTDOWN-COMPLETE. This allows endpoints to correct shutdown gracefully if a
|
SHUTDOWN-COMPLETE.
|
||||||
|
This allows endpoints to correct shutdown gracefully if a
|
||||||
shutdown_complete is lost and retransmissions are required.
|
shutdown_complete is lost and retransmissions are required.
|
||||||
.It Va net.inet.ip.alias.sctp.init_timer: No 15
|
.It Va net.inet.ip.alias.sctp.init_timer: No 15
|
||||||
Timeout value while waiting for (INIT-ACK|AddIP-ACK).
|
Timeout value while waiting for (INIT-ACK|AddIP-ACK).
|
||||||
This value cannot be 0.
|
This value cannot be 0.
|
||||||
.It Va net.inet.ip.alias.sctp.initialising_chunk_proc_limit: No 2
|
.It Va net.inet.ip.alias.sctp.initialising_chunk_proc_limit: No 2
|
||||||
Defines the maximum number of chunks in an SCTP packet that will be parsed when
|
Defines the maximum number of chunks in an SCTP packet that will be parsed when
|
||||||
no existing association exists that matches that packet. Ideally this packet
|
no existing association exists that matches that packet.
|
||||||
will only be an INIT or ASCONF-AddIP packet. A higher value may become a DoS
|
Ideally this packet
|
||||||
|
will only be an INIT or ASCONF-AddIP packet.
|
||||||
|
A higher value may become a DoS
|
||||||
risk as malformed packets can consume processing resources.
|
risk as malformed packets can consume processing resources.
|
||||||
.It Va net.inet.ip.alias.sctp.param_proc_limit: No 25
|
.It Va net.inet.ip.alias.sctp.param_proc_limit: No 25
|
||||||
Defines the maximum number of parameters within a chunk that will be parsed in a
|
Defines the maximum number of parameters within a chunk that will be parsed in a
|
||||||
packet. As for other similar sysctl variables, larger values pose a DoS risk.
|
packet.
|
||||||
|
As for other similar sysctl variables, larger values pose a DoS risk.
|
||||||
.It Va net.inet.ip.alias.sctp.log_level: No 0
|
.It Va net.inet.ip.alias.sctp.log_level: No 0
|
||||||
Level of detail in the system log messages (0 \- minimal, 1 \- event,
|
Level of detail in the system log messages (0 \- minimal, 1 \- event,
|
||||||
2 \- info, 3 \- detail, 4 \- debug, 5 \- max debug). May be a good
|
2 \- info, 3 \- detail, 4 \- debug, 5 \- max debug). May be a good
|
||||||
@ -2335,7 +2342,7 @@ association is limited to this value
|
|||||||
.El
|
.El
|
||||||
.Pp
|
.Pp
|
||||||
This variable is fully dynamic, the new value will be adopted for all newly
|
This variable is fully dynamic, the new value will be adopted for all newly
|
||||||
arriving associations, existing association are treated as they were previously.
|
arriving associations, existing associations are treated as they were previously.
|
||||||
Global tracking will decrease the number of collisions within the
|
Global tracking will decrease the number of collisions within the
|
||||||
.Nm nat
|
.Nm nat
|
||||||
at a cost
|
at a cost
|
||||||
@ -2552,10 +2559,10 @@ by adding the following to the top of a ruleset:
|
|||||||
This rule drops all incoming packets that appear to be coming from another
|
This rule drops all incoming packets that appear to be coming from another
|
||||||
directly connected system but on the wrong interface.
|
directly connected system but on the wrong interface.
|
||||||
For example, a packet with a source address of
|
For example, a packet with a source address of
|
||||||
.Li 192.168.0.0/24
|
.Li 192.168.0.0/24 ,
|
||||||
, configured on
|
configured on
|
||||||
.Li fxp0
|
.Li fxp0 ,
|
||||||
, but coming in on
|
but coming in on
|
||||||
.Li fxp1
|
.Li fxp1
|
||||||
would be dropped.
|
would be dropped.
|
||||||
.Ss DYNAMIC RULES
|
.Ss DYNAMIC RULES
|
||||||
@ -2875,14 +2882,13 @@ Work on
|
|||||||
.Nm dummynet
|
.Nm dummynet
|
||||||
traffic shaper supported by Akamba Corp.
|
traffic shaper supported by Akamba Corp.
|
||||||
.Pp
|
.Pp
|
||||||
Sctp
|
SCTP
|
||||||
.Nm nat
|
.Nm nat
|
||||||
support has been developed by
|
support has been developed by
|
||||||
.An The Centre for Advanced Internet Architectures (CAIA) Aq http://www.caia.swin.edu.au .
|
.An The Centre for Advanced Internet Architectures (CAIA) Aq http://www.caia.swin.edu.au .
|
||||||
The primary developers and maintainers are David Hayes and Jason But.
|
The primary developers and maintainers are David Hayes and Jason But.
|
||||||
For further information visit:
|
For further information visit:
|
||||||
.Aq http://www.caia.swin.edu.au/urp/SONATA
|
.Aq http://www.caia.swin.edu.au/urp/SONATA
|
||||||
.
|
|
||||||
.Sh BUGS
|
.Sh BUGS
|
||||||
The syntax has grown over the years and sometimes it might be confusing.
|
The syntax has grown over the years and sometimes it might be confusing.
|
||||||
Unfortunately, backward compatibility prevents cleaning up mistakes
|
Unfortunately, backward compatibility prevents cleaning up mistakes
|
||||||
@ -2933,8 +2939,8 @@ or quoted appropriately.
|
|||||||
.Pp
|
.Pp
|
||||||
Due to the architecture of
|
Due to the architecture of
|
||||||
.Xr libalias 3 ,
|
.Xr libalias 3 ,
|
||||||
ipfw nat is not compatible with the tcp segmentation offloading
|
ipfw nat is not compatible with the TCP segmentation offloading (TSO).
|
||||||
(TSO). Thus, to reliably nat your network traffic, please disable TSO
|
Thus, to reliably nat your network traffic, please disable TSO
|
||||||
on your NICs using
|
on your NICs using
|
||||||
.Xr ifconfig 8 .
|
.Xr ifconfig 8 .
|
||||||
.Pp
|
.Pp
|
||||||
|
Loading…
Reference in New Issue
Block a user