793 lines
19 KiB
Groff
793 lines
19 KiB
Groff
.\"
|
|
.\" $FreeBSD$
|
|
.\"
|
|
.Dd July 20, 1996
|
|
.Dt IPFW 8
|
|
.Os FreeBSD
|
|
.Sh NAME
|
|
.Nm ipfw
|
|
.Nd controlling utility for IP firewall
|
|
.Sh SYNOPSIS
|
|
.Nm ipfw
|
|
.Op Fl q
|
|
.Oo
|
|
.Fl p Ar preproc
|
|
.Op Fl D Ar macro Ns Op Ns =value
|
|
.Op Fl U Ar macro
|
|
.Oc
|
|
.Ar file
|
|
.Nm ipfw
|
|
.Oo
|
|
.Fl f
|
|
|
|
|
.Fl q
|
|
.Oc
|
|
flush
|
|
.Nm ipfw
|
|
.Oo
|
|
.Fl q
|
|
.Oc
|
|
zero
|
|
.Op Ar number ...
|
|
.Nm ipfw
|
|
.Oo
|
|
.Fl q
|
|
.Oc
|
|
resetlog
|
|
.Op Ar number ...
|
|
.Nm ipfw
|
|
delete
|
|
.Ar number ...
|
|
.Nm ipfw
|
|
.Op Fl aftN
|
|
list
|
|
.Op Ar number ...
|
|
.Nm ipfw
|
|
.Oo
|
|
.Fl ftN
|
|
.Oc
|
|
show
|
|
.Op Ar number ...
|
|
.Nm ipfw
|
|
.Oo
|
|
.Fl q
|
|
.Oc
|
|
add
|
|
.Op Ar number
|
|
.Op prob match_probability
|
|
.Ar action
|
|
.Op log Op Ar logamount Ar number
|
|
.Ar proto
|
|
from
|
|
.Ar src
|
|
to
|
|
.Ar dst
|
|
.Op via Ar name | ipno
|
|
.Op Ar options
|
|
.Sh DESCRIPTION
|
|
If used as shown in the first synopsis line, the
|
|
.Ar file
|
|
will be read line by line and applied as arguments to the
|
|
.Nm
|
|
command.
|
|
.Pp
|
|
Optionally, a preprocessor can be specified using
|
|
.Fl p Ar preproc
|
|
where
|
|
.Ar file
|
|
is to be piped through. Useful preprocessors include
|
|
.Xr cpp 1
|
|
and
|
|
.Xr m4 1 .
|
|
If
|
|
.Ar preproc
|
|
doesn't start with a slash as its first character, the usual
|
|
.Ev PATH
|
|
name search is performed. Care should be taken with this in environments
|
|
where not all filesystems are mounted (yet) by the time
|
|
.Nm
|
|
is being run (e. g. since they are mounted over NFS). Once
|
|
.Fl p
|
|
has been specified, optional
|
|
.Fl D
|
|
and
|
|
.Fl U
|
|
specifications can follow and will be passed on to the preprocessor.
|
|
This allows for flexible configuration files (like conditionalizing
|
|
them on the local hostname) and the use of macros to centralize
|
|
frequently required arguments like IP addresses.
|
|
.Pp
|
|
Each packet that has been received or is about to be sent goes through
|
|
the
|
|
.Nm
|
|
rules. In the case of a host acting as a gateway, packets that are
|
|
forwarded by the host are processed by
|
|
.Nm
|
|
twice
|
|
.Po
|
|
once when entering, and once when leaving
|
|
.Pc .
|
|
Each packet can be filtered based on the following information that is
|
|
associated with it:
|
|
.Pp
|
|
.Bl -tag -offset indent -compact -width xxxx
|
|
.It Receive Interface Pq Ar recv
|
|
Interface over which the packet was received
|
|
.It Transmit Interface Pq Ar xmit
|
|
Interface over which the packet would be transmitted
|
|
.It Incoming Pq Ar in
|
|
Packet was just received
|
|
.It Outgoing Pq Ar out
|
|
Packet would be transmitted
|
|
.It Source IP Address
|
|
Sender's IP Address
|
|
.It Destination IP Address
|
|
Target's IP Address
|
|
.It Protocol
|
|
IP protocol, including but not limited to IP
|
|
.Pq Ar ip ,
|
|
UDP
|
|
.Pq Ar udp ,
|
|
TCP
|
|
.Pq Ar tcp ,
|
|
or
|
|
ICMP
|
|
.Pq Ar icmp
|
|
.It Source Port
|
|
Sender's UDP or TCP port
|
|
.It Destination Port
|
|
Target's UDP or TCP port
|
|
.It Connection Setup Flag Pq Ar setup
|
|
This packet is a request to setup a TCP connection
|
|
.It Connection Established Flag Pq Ar established
|
|
This packet is part of an established TCP connection
|
|
.It All TCP Flags Pq Ar tcpflags
|
|
One or more of the TCP flags: close connection
|
|
.Pq Ar fin ,
|
|
open connection
|
|
.Pq Ar syn ,
|
|
reset connection
|
|
.Pq Ar rst ,
|
|
push
|
|
.Pq Ar psh ,
|
|
acknowledgment
|
|
.Pq Ar ack ,
|
|
and
|
|
urgent
|
|
.Pq Ar urg
|
|
.It Fragment Flag Pq Ar frag
|
|
This packet is a fragment of an IP packet
|
|
.It IP Options Pq Ar ipoptions
|
|
One or more of the IP options: strict source route
|
|
.Pq Ar ssrr ,
|
|
loose source route
|
|
.Pq Ar lsrr ,
|
|
record route
|
|
.Pq Ar rr ,
|
|
and timestamp
|
|
.Pq Ar ts
|
|
.It ICMP Types Pq Ar icmptypes
|
|
One or more of the ICMP types: echo reply
|
|
.Pq Ar 0 ,
|
|
destination unreachable
|
|
.Pq Ar 3 ,
|
|
source quench
|
|
.Pq Ar 4 ,
|
|
redirect
|
|
.Pq Ar 5 ,
|
|
echo request
|
|
.Pq Ar 8 ,
|
|
router advertisement
|
|
.Pq Ar 9 ,
|
|
router solicitation
|
|
.Pq Ar 10 ,
|
|
time-to-live exceeded
|
|
.Pq Ar 11 ,
|
|
IP header bad
|
|
.Pq Ar 12 ,
|
|
timestamp request
|
|
.Pq Ar 13 ,
|
|
timestamp reply
|
|
.Pq Ar 14 ,
|
|
information request
|
|
.Pq Ar 15 ,
|
|
information reply
|
|
.Pq Ar 16 ,
|
|
address mask request
|
|
.Pq Ar 17 ,
|
|
and address mask reply
|
|
.Pq Ar 18
|
|
.El
|
|
.Pp
|
|
Note that may be dangerous to filter on the source IP address or
|
|
source TCP/UDP port because either or both could easily be spoofed.
|
|
.Pp
|
|
The
|
|
.Nm
|
|
code works by going through the rule-list for each packet
|
|
until a match is found.
|
|
All rules have two associated counters, a packet count and
|
|
a byte count.
|
|
These counters are updated when a packet matches the rule.
|
|
.Pp
|
|
If a rule has the optional
|
|
.Dq prob match_probability
|
|
specifier, where the match_probability is a floating point number
|
|
between 0 and 1, a match is only declared with the specified
|
|
probability. This can be useful for a number of applications
|
|
such as random packet drop or (in conjunction with
|
|
.Xr dummynet 4
|
|
) to simulate the effect of multiple paths leading to out-of-order
|
|
packet delivery.
|
|
.Pp
|
|
The rules are ordered by a
|
|
.Dq line-number
|
|
from 1 to 65534 that is used
|
|
to order and delete rules. Rules are tried in increasing order, and the
|
|
first rule that matches a packet applies.
|
|
Multiple rules may share the same number and apply in
|
|
the order in which they were added.
|
|
.Pp
|
|
If a rule is added without a number, it is numbered 100 higher than the highest
|
|
defined rule number, unless the highest defined rule number is 65435 or
|
|
greater, in which case new rules are given that same number.
|
|
.Pp
|
|
The delete operation deletes the first rule with number
|
|
.Ar number ,
|
|
if any.
|
|
.Pp
|
|
The list command prints out the current rule set.
|
|
.Pp
|
|
The show command is equivalent to
|
|
.Sq ipfw -a list .
|
|
.Pp
|
|
The zero operation zeroes the counters associated with rule number
|
|
.Ar number .
|
|
.Pp
|
|
The resetlog operation resets the logging counters associated with
|
|
rule number
|
|
.Ar number .
|
|
.Pp
|
|
The flush operation removes all rules.
|
|
.Pp
|
|
Any command beginning with a
|
|
.Sq # ,
|
|
or being all blank, is ignored.
|
|
.Pp
|
|
One rule is always present:
|
|
.Bd -literal -offset center
|
|
65535 deny all from any to any
|
|
.Ed
|
|
.Pp
|
|
This rule is the default policy, i.e., don't allow anything at all.
|
|
Your job in setting up rules is to modify this policy to match your
|
|
needs.
|
|
.Pp
|
|
However, if the kernel option
|
|
.Dq IPFIREWALL_DEFAULT_TO_ACCEPT
|
|
is active, the rule is instead:
|
|
.Bd -literal -offset center
|
|
65535 allow all from any to any
|
|
.Ed
|
|
.Pp
|
|
This variation lets everything pass through. This option should only be
|
|
activated in particular circumstances, such as if you use the firewall
|
|
system as an on-demand denial-of-service filter that is normally wide open.
|
|
.Pp
|
|
The following options are available:
|
|
.Bl -tag -width indent
|
|
.It Fl a
|
|
While listing, show counter values. See also
|
|
.Dq show
|
|
command.
|
|
.It Fl f
|
|
Don't ask for confirmation for commands that can cause problems if misused
|
|
(i.e. flush).
|
|
.Ar Note ,
|
|
if there is no tty associated with the process, this is implied.
|
|
.It Fl q
|
|
While adding, zeroing, resetlogging or flushing, be quiet about actions (implies
|
|
.Fl f Ns ).
|
|
This is useful for adjusting rules by executing multiple
|
|
.Nm
|
|
commands in a script
|
|
.Po
|
|
e.g.,
|
|
.Sq sh /etc/rc.firewall
|
|
.Pc ,
|
|
or by processing a file of many
|
|
.Nm
|
|
rules,
|
|
across a remote login session. If a flush is performed in normal
|
|
(verbose) mode (with the default kernel configuration), it prints a message.
|
|
Because all rules are flushed, the
|
|
message cannot be delivered to the login session. This causes the
|
|
remote login session to be closed and the remainder of the ruleset is
|
|
not processed. Access to the console is required to recover.
|
|
.It Fl t
|
|
While listing, show last match timestamp.
|
|
.It Fl N
|
|
Try to resolve addresses and service names in output.
|
|
.El
|
|
.Pp
|
|
.Ar action :
|
|
.Bl -hang -offset flag -width 1234567890123456
|
|
.It Ar allow
|
|
Allow packets that match rule.
|
|
The search terminates. Aliases are
|
|
.Ar pass ,
|
|
.Ar permit ,
|
|
and
|
|
.Ar accept .
|
|
.It Ar deny
|
|
Discard packets that match this rule.
|
|
The search terminates.
|
|
.Ar Drop
|
|
is an alias for
|
|
.Ar deny .
|
|
.It Ar reject
|
|
(Deprecated.) Discard packets that match this rule, and try to send an ICMP
|
|
host unreachable notice.
|
|
The search terminates.
|
|
.It Ar unreach code
|
|
Discard packets that match this rule, and try to send an ICMP
|
|
unreachable notice with code
|
|
.Ar code ,
|
|
where
|
|
.Ar code
|
|
is a number from zero to 255, or one of these aliases:
|
|
.Ar net ,
|
|
.Ar host ,
|
|
.Ar protocol ,
|
|
.Ar port ,
|
|
.Ar needfrag ,
|
|
.Ar srcfail ,
|
|
.Ar net-unknown ,
|
|
.Ar host-unknown ,
|
|
.Ar isolated ,
|
|
.Ar net-prohib ,
|
|
.Ar host-prohib ,
|
|
.Ar tosnet ,
|
|
.Ar toshost ,
|
|
.Ar filter-prohib ,
|
|
.Ar host-precedence ,
|
|
or
|
|
.Ar precedence-cutoff .
|
|
The search terminates.
|
|
.It Ar reset
|
|
TCP packets only. Discard packets that match this rule,
|
|
and try to send a TCP reset
|
|
.Pq RST
|
|
notice.
|
|
The search terminates.
|
|
.It Ar count
|
|
Update counters for all packets that match rule.
|
|
The search continues with the next rule.
|
|
.It Ar divert port
|
|
Divert packets that match this rule to the
|
|
.Xr divert 4
|
|
socket bound to port
|
|
.Ar port .
|
|
The search terminates.
|
|
.It Ar tee port
|
|
Send a copy of packets matching this rule to the
|
|
.Xr divert 4
|
|
socket bound to port
|
|
.Ar port .
|
|
The search continues with the next rule. This feature is not yet implemented.
|
|
.It Ar fwd ipaddr Op ,port
|
|
Change the next-hop on matching packets to
|
|
.Ar ipaddr ,
|
|
which can be an IP address in dotted quad or a host name.
|
|
If
|
|
.Ar ipaddr
|
|
is not a directly-reachable address, the route
|
|
as found in the local routing table for that IP is used
|
|
instead.
|
|
If
|
|
.Ar ipaddr
|
|
is a local address, then on a packet entering the system from a remote
|
|
host it will be diverted to
|
|
.Ar port
|
|
on the local machine, keeping the local address of the socket set
|
|
to the original IP address the packet was destined for. This is intended
|
|
for use with transparent proxy servers. If the IP is not
|
|
a local address then the port number (if specified) is ignored and
|
|
the rule only applies to packets leaving the system. This will
|
|
also map addresses to local ports when packets are generated locally.
|
|
The search terminates if this rule matches. If the port number is not
|
|
given then the port number in the packet is used, so that a packet for
|
|
an external machine port Y would be forwarded to local port Y. The kernel
|
|
must have been compiled with options IPFIREWALL_FORWARD.
|
|
.It Ar pipe pipe_nr
|
|
Pass packet to a
|
|
.Xr dummynet 4
|
|
``pipe'' (for bandwidth limitation, delay etc.). See the
|
|
.Xr dummynet 4
|
|
manpage for further information. The search terminates; however,
|
|
on exit from the pipe and if the sysctl variable
|
|
net.inet.ip.fw.one_pass is not set, the packet is passed again to
|
|
the firewall code starting from the next rule.
|
|
.It Ar skipto number
|
|
Skip all subsequent rules numbered less than
|
|
.Ar number .
|
|
The search continues with the first rule numbered
|
|
.Ar number
|
|
or higher.
|
|
.It Ar uid user
|
|
Match all TCP or UDP packets sent by or received for a
|
|
.Ar user .
|
|
A
|
|
.Ar user
|
|
may be matched by name or identification number.
|
|
.It Ar gid group
|
|
Match all TCP or UDP packets sent by or received for a
|
|
.Ar group .
|
|
A
|
|
.Ar group
|
|
may be matched by name or identification number.
|
|
.El
|
|
.Pp
|
|
If a packet matches more than one
|
|
.Ar divert
|
|
and/or
|
|
.Ar tee
|
|
rule, all but the last are ignored.
|
|
.Pp
|
|
If the kernel was compiled with
|
|
.Dv IPFIREWALL_VERBOSE ,
|
|
then when a packet matches a rule with the
|
|
.Ar log
|
|
keyword or a clear/resetlog is performed, a message will be logged to
|
|
.Xr syslogd 8 ,
|
|
or, if that fails, to the console. If the kernel was compiled with the
|
|
.Dv IPFIREWALL_VERBOSE_LIMIT
|
|
option, then by default logging will cease after the number
|
|
of packets specified by the option are received for that
|
|
particular chain entry. However, if
|
|
.Ar logamount Ar number
|
|
is used, that
|
|
.Ar number
|
|
will be the default logging limit rather than
|
|
.Dv IPFIREWALL_VERBOSE_LIMIT .
|
|
When this limit is reached, the limit and rule number will be logged.
|
|
Logging may then be re-enabled by clearing the logging counter
|
|
or the packet counter for that entry.
|
|
.Pp
|
|
The
|
|
.Xr syslogd 8
|
|
logging and the default log limit are adjustable dynamically through the
|
|
.Xr sysctl 8
|
|
interface in the MIB base of
|
|
.Dv net.inet.ip.fw .
|
|
.Pp
|
|
.Ar proto :
|
|
.Bl -hang -offset flag -width 1234567890123456
|
|
.It Ar ip
|
|
All packets match. The alias
|
|
.Ar all
|
|
has the same effect.
|
|
.It Ar tcp
|
|
Only TCP packets match.
|
|
.It Ar udp
|
|
Only UDP packets match.
|
|
.It Ar icmp
|
|
Only ICMP packets match.
|
|
.It Ar <number|name>
|
|
Only packets for the specified protocol matches (see
|
|
.Pa /etc/protocols
|
|
for a complete list).
|
|
.El
|
|
.Pp
|
|
.Ar src
|
|
and
|
|
.Ar dst :
|
|
.Bl -hang -offset flag
|
|
.It Ar <address/mask>
|
|
.Op Ar ports
|
|
.El
|
|
.Pp
|
|
The
|
|
.Em <address/mask>
|
|
may be specified as:
|
|
.Bl -hang -offset flag -width 1234567890123456
|
|
.It Ar ipno
|
|
An ipnumber of the form 1.2.3.4.
|
|
Only this exact ip number match the rule.
|
|
.It Ar ipno/bits
|
|
An ipnumber with a mask width of the form 1.2.3.4/24.
|
|
In this case all ip numbers from 1.2.3.0 to 1.2.3.255 will match.
|
|
.It Ar ipno:mask
|
|
An ipnumber with a mask width of the form 1.2.3.4:255.255.240.0.
|
|
In this case all ip numbers from 1.2.0.0 to 1.2.15.255 will match.
|
|
.El
|
|
.Pp
|
|
The sense of the match can be inverted by preceding an address with the
|
|
.Dq not
|
|
modifier, causing all other addresses to be matched instead. This
|
|
does not affect the selection of port numbers.
|
|
.Pp
|
|
With the TCP and UDP protocols, optional
|
|
.Em ports
|
|
may be specified as:
|
|
.Pp
|
|
.Bl -hang -offset flag
|
|
.It Ns {port|port-port} Ns Op ,port Ns Op ,...
|
|
.El
|
|
.Pp
|
|
Service names (from
|
|
.Pa /etc/services )
|
|
may be used instead of numeric port values.
|
|
A range may only be specified as the first value,
|
|
and the length of the port list is limited to
|
|
.Dv IP_FW_MAX_PORTS
|
|
(as defined in
|
|
.Pa /usr/src/sys/netinet/ip_fw.h )
|
|
ports.
|
|
A
|
|
.Ql \e
|
|
can be used to escape the
|
|
.Ql -
|
|
character in a service name:
|
|
.Pp
|
|
.Dl ipfw add count tcp from any ftp\e\e-data-ftp to any
|
|
.Pp
|
|
Fragmented packets which have a non-zero offset (i.e. not the first
|
|
fragment) will never match a rule which has one or more port
|
|
specifications. See the
|
|
.Ar frag
|
|
option for details on matching fragmented packets.
|
|
.Pp
|
|
Rules can apply to packets when they are incoming, or outgoing, or both.
|
|
The
|
|
.Ar in
|
|
keyword indicates the rule should only match incoming packets.
|
|
The
|
|
.Ar out
|
|
keyword indicates the rule should only match outgoing packets.
|
|
.Pp
|
|
To match packets going through a certain interface, specify
|
|
the interface using
|
|
.Ar via :
|
|
.Bl -hang -offset flag -width 1234567890123456
|
|
.It Ar via ifX
|
|
Packet must be going through interface
|
|
.Ar ifX.
|
|
.It Ar via if*
|
|
Packet must be going through interface
|
|
.Ar ifX ,
|
|
where X is any unit number.
|
|
.It Ar via any
|
|
Packet must be going through
|
|
.Em some
|
|
interface.
|
|
.It Ar via ipno
|
|
Packet must be going through the interface having IP address
|
|
.Ar ipno .
|
|
.El
|
|
.Pp
|
|
The
|
|
.Ar via
|
|
keyword causes the interface to always be checked.
|
|
If
|
|
.Ar recv
|
|
or
|
|
.Ar xmit
|
|
is used instead of
|
|
.Ar via ,
|
|
then the only receive or transmit interface (respectively) is checked.
|
|
By specifying both, it is possible to match packets based on both receive
|
|
and transmit interface, e.g.:
|
|
.Pp
|
|
.Dl "ipfw add 100 deny ip from any to any out recv ed0 xmit ed1"
|
|
.Pp
|
|
The
|
|
.Ar recv
|
|
interface can be tested on either incoming or outgoing packets, while the
|
|
.Ar xmit
|
|
interface can only be tested on outgoing packets. So
|
|
.Ar out
|
|
is required (and
|
|
.Ar in
|
|
invalid) whenever
|
|
.Ar xmit
|
|
is used. Specifying
|
|
.Ar via
|
|
together with
|
|
.Ar xmit
|
|
or
|
|
.Ar recv
|
|
is invalid.
|
|
.Pp
|
|
A packet may not have a receive or transmit interface: packets originating
|
|
from the local host have no receive interface. while packets destined for
|
|
the local host have no transmit interface.
|
|
.Pp
|
|
Additional
|
|
.Ar options :
|
|
.Bl -hang -offset flag -width 1234567890123456
|
|
.It frag
|
|
Match if the packet is a fragment and this is not the first fragment
|
|
of the datagram.
|
|
.Ar frag
|
|
may not be used in conjunction with either
|
|
.Ar tcpflags
|
|
or TCP/UDP port specifications.
|
|
.It in
|
|
Match if this packet was on the way in.
|
|
.It out
|
|
Match if this packet was on the way out.
|
|
.It ipoptions Ar spec
|
|
Match if the IP header contains the comma separated list of
|
|
options specified in
|
|
.Ar spec .
|
|
The supported IP options are:
|
|
.Ar ssrr
|
|
(strict source route),
|
|
.Ar lsrr
|
|
(loose source route),
|
|
.Ar rr
|
|
(record packet route), and
|
|
.Ar ts
|
|
(timestamp).
|
|
The absence of a particular option may be denoted
|
|
with a
|
|
.Dq ! .
|
|
.It established
|
|
Match packets that have the RST or ACK bits set.
|
|
TCP packets only.
|
|
.It setup
|
|
Match packets that have the SYN bit set but no ACK bit.
|
|
TCP packets only.
|
|
.It tcpflags Ar spec
|
|
Match if the TCP header contains the comma separated list of
|
|
flags specified in
|
|
.Ar spec .
|
|
The supported TCP flags are:
|
|
.Ar fin ,
|
|
.Ar syn ,
|
|
.Ar rst ,
|
|
.Ar psh ,
|
|
.Ar ack ,
|
|
and
|
|
.Ar urg .
|
|
The absence of a particular flag may be denoted
|
|
with a
|
|
.Dq ! .
|
|
A rule which contains a
|
|
.Ar tcpflags
|
|
specification can never match a fragmented packet which has
|
|
a non-zero offset. See the
|
|
.Ar frag
|
|
option for details on matching fragmented packets.
|
|
.It icmptypes Ar types
|
|
Match if the ICMP type is in the list
|
|
.Ar types .
|
|
The list may be specified as any combination of ranges
|
|
or individual types separated by commas.
|
|
.El
|
|
.Sh CHECKLIST
|
|
Here are some important points to consider when designing your
|
|
rules:
|
|
.Bl -bullet -hang -offset flag
|
|
.It
|
|
Remember that you filter both packets going in and out.
|
|
Most connections need packets going in both directions.
|
|
.It
|
|
Remember to test very carefully.
|
|
It is a good idea to be near the console when doing this.
|
|
.It
|
|
Don't forget the loopback interface.
|
|
.El
|
|
.Sh FINE POINTS
|
|
There is one kind of packet that the firewall will always discard,
|
|
that is an IP fragment with a fragment offset of one.
|
|
This is a valid packet, but it only has one use, to try to circumvent
|
|
firewalls.
|
|
.Pp
|
|
If you are logged in over a network, loading the KLD version of
|
|
.Nm
|
|
is probably not as straightforward as you would think.
|
|
I recommend this command line:
|
|
.Bd -literal -offset center
|
|
kldload /modules/ipfw.ko && \e
|
|
ipfw add 32000 allow all from any to any
|
|
.Ed
|
|
.Pp
|
|
Along the same lines, doing an
|
|
.Bd -literal -offset center
|
|
ipfw flush
|
|
.Ed
|
|
.Pp
|
|
in similar surroundings is also a bad idea.
|
|
.Pp
|
|
The IP filter list may not be modified if the system security level
|
|
is set to 3 or higher
|
|
.Po
|
|
see
|
|
.Xr init 8
|
|
for information on system security levels
|
|
.Pc .
|
|
.Sh PACKET DIVERSION
|
|
A divert socket bound to the specified port will receive all packets diverted
|
|
to that port; see
|
|
.Xr divert 4 .
|
|
If no socket is bound to the destination port, or if the kernel
|
|
wasn't compiled with divert socket support, diverted packets are dropped.
|
|
.Sh EXAMPLES
|
|
This command adds an entry which denies all tcp packets from
|
|
.Em cracker.evil.org
|
|
to the telnet port of
|
|
.Em wolf.tambov.su
|
|
from being forwarded by the host:
|
|
.Pp
|
|
.Dl ipfw add deny tcp from cracker.evil.org to wolf.tambov.su 23
|
|
.Pp
|
|
This one disallows any connection from the entire crackers network to
|
|
my host:
|
|
.Pp
|
|
.Dl ipfw add deny all from 123.45.67.0/24 to my.host.org
|
|
.Pp
|
|
Here is a good usage of the
|
|
.Ar list
|
|
command to see accounting records
|
|
and timestamp information:
|
|
.Pp
|
|
.Dl ipfw -at l
|
|
.Pp
|
|
or in short form without timestamps:
|
|
.Pp
|
|
.Dl ipfw -a l
|
|
.Pp
|
|
This rule diverts all incoming packets from 192.168.2.0/24 to divert port 5000:
|
|
.Pp
|
|
.Dl ipfw divert 5000 all from 192.168.2.0/24 to any in
|
|
.Sh SEE ALSO
|
|
.Xr cpp 1 ,
|
|
.Xr m4 1 ,
|
|
.Xr divert 4 ,
|
|
.Xr dummynet 4 ,
|
|
.Xr ip 4 ,
|
|
.Xr ipfirewall 4 ,
|
|
.Xr protocols 5 ,
|
|
.Xr services 5 ,
|
|
.Xr init 8 ,
|
|
.Xr kldload 8 ,
|
|
.Xr reboot 8 ,
|
|
.Xr sysctl 8 ,
|
|
.Xr syslogd 8 .
|
|
.Sh BUGS
|
|
.Pp
|
|
.Em WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!
|
|
.Pp
|
|
This program can put your computer in rather unusable state. When
|
|
using it for the first time, work on the console of the computer, and
|
|
do
|
|
.Em NOT
|
|
do anything you don't understand.
|
|
.Pp
|
|
When manipulating/adding chain entries, service and protocol names are
|
|
not accepted.
|
|
.Pp
|
|
Incoming packet fragments diverted by
|
|
.Ar divert
|
|
are reassembled before delivery to the socket, whereas fragments diverted via
|
|
.Ar tee
|
|
are not.
|
|
.Pp
|
|
The
|
|
.Dq tee
|
|
action is unimplemented.
|
|
.Sh AUTHORS
|
|
.An Ugen J. S. Antsilevich ,
|
|
.An Poul-Henning Kamp ,
|
|
.An Alex Nash ,
|
|
.An Archie Cobbs .
|
|
API based upon code written by
|
|
.An Daniel Boulet
|
|
for BSDI.
|
|
.Sh HISTORY
|
|
.Nm Ipfw
|
|
first appeared in
|
|
.Fx 2.0 .
|