IPFW(8)

NAME
ipfw - controlling utility for IP firewall / IP accounting facilities.

SYNOPSIS
ipfw [ -n] entry_action chain_entry_pattern
ipfw [ -ans] chain_action chain[s]_type

DESCRIPTION
In the first synopsis form, ipfw controls the firewall and accounting chains. In the second synopsis form, ipfw sets the global firewall / accounting properties and show the chain list's contents.

The following options are available:

-a  While listing, show counter values. This option is the only way to see accounting records. Works only with -s

-n  Do not resolve anything. When setting entries, do not try to resolve a given address. When listing, display addresses in numeric form.

-s  Short listing form. By default, the listing format is compatible with ipfw input string format, so you can save listings to file and then reuse them. With this option list format is much more short but incompatible with the ipfw syntax.

These are the valid entry_actions:

addf[irewall]
    add entry to firewall chain.

delf[irewall]
    remove entry from firewall chain.

adda[ccounting]
    add entry to accounting chain.

dela[ccounting]
    remove entry from accounting chain.

clr[accounting]
    clear counters for accounting chain entry.

If no entry_action is specified, it will default to addf[irewall] or adda[ccounting], depending on the chain_entry_pattern specified.

The valid chain_actions are:

f[lush]
    remove all entries in firewall / accounting chains.

l[ist]
    display all entries in firewall / accounting chains.

z[ero]
    clear chain counters (accounting only).

p[olicy]
    set default policy properties.

The chain_entry_pattern structure is:

    [keyword] [protocol] [address pattern]

For the firewall chain, valid keywords are:

reject
    Reject the packet, and send an ICMP HOST_UNREACHABLE packet to the source.

lreject
    The same as reject, but also log the packets details.

deny
    Reject the packet.

ldeny
    The same as deny, but also log the packets details.

log Accept the packet, and log it.

accept
    Accept the packet (obviously).

pass
    A synonym for accept.

For the accounting chain, valid keywords are:

single
    Log packets matching entry.

bidirectional
    Log packets matching entry and also those going in the opposite direction (from “dst” to “src”).

Each keyword will be recognized by the shortest unambigious prefix.

Recognised protocols are:

all Matches any IP packet.

icmp
    Matches ICMP packets.

tcp Matches TCP packets.

udp Matches UDP packets.

syn Matches the TCP SYN packet used in initiating a TCP connection. It does not match the packet returned from a destination machine which has the SYN and ACK bits set.

The address pattern is:

    from <address/mask>[ports] to <address/mask][ports] [via <interface>]

You can only specify ports with protocols which actually have ports (TCP, UDP and SYN).

The order of ‘from/to/via’ keywords is unimportant. You can skip any of them, which will be then substituted by default entry matching any ‘from/to/via’ packet kind.

The <address/mask> is defined as:

    <address|name>[/mask_bits|:mask_pattern]

mask bits is the decimal number of bits set in the address mask. mask pattern has the form of an IP address to be AND'ed logically with the address given. The keyword any can be used to specify “any IP”. The IP address or name given is NOT checked, and the wrong value causes the entry to not match anything.

The ports to be blocked are specified as:
    port[,port[,...]]
or:
    port:port

to specify a range of ports. The name of a service (from /etc/services) can be used instead of a numeric port value.

The via <interface> entry is optional and may specify IP address/domain name of local IP interface, or interface name (e.g. ed0) to match only packets coming through this interface. The keyword via can be substituted by on, for readability reasons.

The l[ist] command may be passed:

    f[irewall] | a[ccounting]

to list specific chain or none to list all of chains. The long output format (default) is compatible with the syntax used by the ipfw utility.

The f[lush] command may be passed:

    f[irewall] | a[ccounting]

to remove all entries from firewall or from accounting chain. Without an argument it will remove all entries from both chains.

The z[ero] command needs no arguments. This command clears all counters for the entire accounting chain.

The p[olicy] command can be given

    a[ccept] | d[eny]

to set default policy as denial/acceptance. Without an angument, the current policy status is displayed.

EXAMPLES
This command adds an entry which denies all tcp packets from hacker.evil.org to the telnet port of wolf.tambov.su from being forwarded by the host:

    ipfw addf deny tcp from hacker.evil.org to wolf.tambov.su telnet

This one disallows any connection from the entire hackers network to my host:

    ipfw addf deny all from 123.45.67.0/24 to my.host.org

Here is good usage of list command to see accounting records:

    ipfw -sa list accounting

or in short form

    ipfw -sa l a

Many more examples can be found in the file:
    /usr/share/FAQ/ipfw.FAQ
(missing for the moment)

SEE ALSO
gethostbyname(3), getservbyport(3), ip(4), ipfirewall(4), ipaccounting(4), reboot(8), syslogd(8)

BUGS
Currently there is no method for filtering out specific types of ICMP packets. Either you don't filter ICMP at all, or all ICMP packets are filtered.

The system has a rule weighting system for the firewall chain. This means that rules are not used in the order that they are specified. To see what rule ordering is used, use the list command.

WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!

This program can put your computer in rather unusable state. When using it for the first time, work on the console of the computer, and do NOT do anything you don't understand.

Remember that “ipfw flush” can solve all the problems. Bear in mind that “ipfw policy deny” combined with some wrong chain entry (possible the only entry, which is designed to deny some external packets), can close your computer from the outer world for good (or at least until you can get to the console).

HISTORY
Initially this utility was written for BSDI by:

    Daniel Boulet <danny@BouletFermat.ab.ca>

The FreeBSD version is written completely by:

    Ugen J.S.Antsilevich <ugen@FreeBSD.ORG>

while the synopsis is partially compatible with the old one.