Commit Graph

48 Commits

Author SHA1 Message Date
Archie Cobbs
6f206f2ef2 Fix misleading wording in ipfw(8) man page.
PR: docs/9603
1999-01-21 19:51:04 +00:00
Guy Helmer
b46dfa405c Mention affect of securelevel 3 and higher on attempts to change filter lists.
Prompted by:	PR docs/7785
1998-12-16 17:10:03 +00:00
Archie Cobbs
b31a38612b Disallow ipfw "tee" rules until it is actually implemented.
PR:		bin/8471
1998-12-07 05:54:37 +00:00
Joerg Wunsch
aa045fa499 Preprocessor support for `ipfw [-q] ... file'.
This allows for more flexible ipfw configuration files using
`variables' to describe frequently used items in the file, like the
local IP address(es), interface names etc.  Both m4 and cpp are useful
and supported; with m4 being a little more unusual to the common C
programmer, things like automatic rule numbering can be achieved
fairly easy.

While i was at it, i've also untangled some of the ugly style inside
main(), and fixed a bug or two (like not being able to use blank lines
when running with -q).

A typical call with preprocessor invocation looks like

	ipfw -p m4 -Dhostname=$(hostname) /etc/fwrules

Someone should probably add support for this feature to /etc/rc.firewall.
1998-11-23 10:54:28 +00:00
Peter Hawkins
62cf03cd85 PR: 7475
Added support for -q (suppress output) when firewall rules are taken from a
file. Solves PR 7475
1998-08-04 14:41:37 +00:00
Julian Elischer
f9e354df42 Support for IPFW based transparent forwarding.
Any packet that can be matched by a ipfw rule can be redirected
transparently to another port or machine. Redirection to another port
mostly makes sense with tcp, where a session can be set up
between a proxy and an unsuspecting client. Redirection to another machine
requires that the other machine also be expecting to receive the forwarded
packets, as their headers will not have been modified.

/sbin/ipfw must be recompiled!!!

Reviewed by:	Peter Wemm <peter@freebsd.org>
Submitted by: Chrisy Luke <chrisy@flix.net>
1998-07-06 03:20:19 +00:00
Daniel O'Callaghan
dcf2c48fc9 Reminded by: Alex Nash
Bring man page up to date with -q flag behaviour.
1998-05-19 12:50:35 +00:00
Masafumi Max NAKANE
432a1104b6 Typo fix. 1998-05-19 03:10:14 +00:00
Martin Cracauer
d6b37778e9 (evil) hackers -> crackers 1998-04-08 12:00:48 +00:00
Philippe Charnier
68085a0ef1 .Sh AUTHOR -> .Sh AUTHORS. Use .An/.Aq. 1998-03-19 07:46:04 +00:00
Alexander Langer
ce78a1f6dd Alter ipfw's behavior with respect to fragmented packets when the packet
offset is non-zero:

  - Do not match fragmented packets if the rule specifies a port or
    TCP flags
  - Match fragmented packets if the rule does not specify a port and
    TCP flags

Since ipfw cannot examine port numbers or TCP flags for such packets,
it is now illegal to specify the 'frag' option with either ports or
tcpflags.  Both kernel and ipfw userland utility will reject rules
containing a combination of these options.

BEWARE: packets that were previously passed may now be rejected, and
vice versa.

Reviewed by:	Archie Cobbs <archie@whistle.com>
1998-02-12 00:57:06 +00:00
Alexander Langer
19b7e28d58 Support listing/showing specific rules supplied on the command line.
Use error codes from <sysexits.h>.
1998-01-07 02:23:04 +00:00
Julian Elischer
c7a0bf0440 Allow ipfw to accept comments and blank lines.
This makes ipfw config files a LOT more readable.
1997-12-05 02:43:26 +00:00
Wolfram Schneider
bf5cbf3551 Sort cross refereces in section SEE ALSO. 1997-09-29 19:11:55 +00:00
Peter Wemm
ff486369c7 Mention the IPFIREWALL_DEFAULT_TO_ACCEPT option and it's effect on
rule 65535
1997-09-10 04:02:37 +00:00
Peter Wemm
875a6115c1 Fix typo (65434 -> 65534) 1997-09-10 03:52:50 +00:00
Daniel O'Callaghan
39f5ba2def Bring comment on '-a' flag in line with reality. 1997-08-21 07:30:08 +00:00
Julian Elischer
135a88d805 Allow ipfw to look up service names from /etc/services (or NIS if turned on)
note.. this would be dangerous if your ipfw was blocking NIS access :)

Submitted by: archie@whistle.com (Archie Cobbs)
1997-06-23 22:32:13 +00:00
Julian Elischer
e4676ba603 Submitted by: Whistle Communications (archie Cobbs)
these are quite extensive additions to the ipfw code.
they include a change to the API because the old method was
broken, but the user view is kept the same.

The new code allows a particular match to skip forward to a particular
line number, so that blocks of rules can be
used without checking all the intervening rules.
There are also many more ways of rejecting
connections especially TCP related, and
many many more ...

see the man page for a complete description.
1997-06-02 05:02:37 +00:00
Masafumi Max NAKANE
20aaa0e700 Typo.
PR:		3600
Submitted by:	Josh Gilliam <soil@quick.net>
1997-05-15 09:00:39 +00:00
Alexander Langer
c6a01512c6 Minor rewording of the examples section. 1997-05-15 00:51:08 +00:00
Daniel O'Callaghan
f607e2c314 Add '-q' quiet flag for flush/add/zero commands; add 'show' command as
synonym for '-a list'; stop SEGV when specifying 'via' with no interface;
change 2 instances of strcpy() to strncpy().

This is a candidate for 2.2
1997-02-10 15:36:54 +00:00
Adam David
839cc09e53 implement "not" keyword for inverting the address logic 1997-01-16 21:04:29 +00:00
Mike Pritchard
bc41bb3f92 Minor mdoc/style fixes. 1996-12-23 02:03:15 +00:00
John Polstra
00f1098194 Fix a spelling error.
2.2 Candidate.
1996-11-05 22:27:33 +00:00
Alexander Langer
7de7ab65b6 Note that -N is only effective when ipfw is displaying chain entries. 1996-09-15 00:08:30 +00:00
Nate Williams
1285c95c4b Because 'ipfw flush' is such a dangerous command (given that most
firewalls are remote, and this command will kill the network connection
to them), prompt the user for confirmation of this command.

Also, add the '-f' flag which ignores the need for confirmation the
command, and if there is no controlling tty (isatty(STDIN_FILENO) !=0)
assume '-f'.

If anyone is using ipfw flush in scripts it shouldn't affect them, but you
may want to change the script to use a 'ipfw -f flush'.

Reviewed by:	alex
1996-08-31 17:58:23 +00:00
Mike Pritchard
85cf659a76 Use the .Fx macro where appropriate. 1996-08-23 00:57:08 +00:00
Paul Traina
978eb210d1 Completely rewrite handling of protocol field for firewalls, things are
now completely consistent across all IP protocols and should be quite a
bit faster.

Use getprotoname() extensively, performed minor cleanups of admin utility.
The admin utility could use a good kick in the pants.

Basicly, these were the minimal changes I could make to the code
to get it up to tollerable shape.  There will be some future commits
to clean up the basic architecture of the firewall code, and if
I'm feeling ambitious, I may pull in changes like NAT from Linux
and make the firewall hooks comletely generic so that a user can
either load the ipfw module or the ipfilter module (cf Darren Reed).

Discussed with: fenner & alex
1996-08-13 19:43:24 +00:00
Alexander Langer
593f7481aa Filter by IP protocol.
Submitted by: fenner (with modifications by me)

Bring in the interface unit wildcard flag fix from rev 1.15.4.8.
1996-08-05 02:38:51 +00:00
Julian Elischer
93e0e11657 Adding changes to ipfw and the kernel to support ip packet diversion..
This stuff should not be too destructive if the IPDIVERT is not compiled in..
 be aware that this changes the size of the ip_fw struct
so ipfw needs to be recompiled to use it.. more changes coming to clean this up.
1996-07-10 19:44:30 +00:00
Alexander Langer
f8cc1596e7 Correct definition of 'established' keyword. 1996-07-02 00:29:22 +00:00
Alexander Langer
700061451a Fix port specification syntax.
Submitted by:	nate
1996-06-29 01:21:07 +00:00
Alexander Langer
a85b3068a1 Fix a typo in the view accounting records example. 1996-06-15 23:01:44 +00:00
Alexander Langer
3f21e4122d Bring the man page more into line with reality. 1996-06-15 01:38:51 +00:00
Poul-Henning Kamp
72ee2a8b10 Update to match kernel code. 1996-02-24 13:39:46 +00:00
Poul-Henning Kamp
41955e9114 Update -current ipfw program as well.
I hope it all compiles...
1996-02-23 15:52:28 +00:00
Poul-Henning Kamp
cfe3bbfda2 Document that the firewall will no longer reorder the rules. 1996-02-13 15:20:20 +00:00
Mike Pritchard
e71057d8d0 Fix a bunch of spelling errors. 1996-01-29 23:52:43 +00:00
Nate Williams
01fc1ee969 Convert manpage to -mandoc macros.
Submitted by:	Gary Palmer <gary@palmer.demon.co.uk>

Minor cleanup by me in the English.
1995-10-26 05:36:24 +00:00
Gary Palmer
38a98b2254 Correct minor nit - to filter out SYN packets, the keyword is
`syn' not `tcpsyn' (which matches `tcp' which blocks all tcp
packets)
1995-08-31 21:12:05 +00:00
Ugen J.S. Antsilevich
009f85df0b Update manpage..BTW,if somebody wit good English
would go through it and fix it would be a really good idea.
1995-03-03 12:59:47 +00:00
Ugen J.S. Antsilevich
ce83f1d6d8 Fixed manpage..ldeny,lreject and log options are there
and others not..
Submitted by:	torstenb@FreeBSD.ORG
1995-02-27 10:52:22 +00:00
Ugen J.S. Antsilevich
ab7d7f5827 Change utility to accept interface name
along with IP as "via" argument
1995-02-24 14:32:45 +00:00
Ugen J.S. Antsilevich
96fd3f53e8 Finally document "via" feature.. 1995-02-17 15:44:08 +00:00
Ugen J.S. Antsilevich
742d9f28f7 Ok..at least this man page is up to date now
To be continued..
1995-02-09 13:13:18 +00:00
Andreas Schulz
2a7abc9144 Changed a reboot(1) to a reboot(8). 1994-12-11 23:27:59 +00:00
Jordan K. Hubbard
c9a156d596 New man pages from Ugen. Delete my old, first attempt. I only hope
that the english in Ugen's two replacement pages is not too impenetrable! :-)
[Note:  Poul - please pull these into the BETA branch along with the
other firewall changes]

Submitted by:	ugen
1994-11-17 09:50:30 +00:00