|
Lines 7-13
Link Here
|
| 7 |
.Sh NAME |
7 |
.Sh NAME |
| 8 |
.Nm ipfw |
8 |
.Nm ipfw |
| 9 |
.Nd User interface for firewall, traffic shaper, packet scheduler, |
9 |
.Nd User interface for firewall, traffic shaper, packet scheduler, |
| 10 |
in-kernel NAT. |
10 |
in-kernel NAT |
| 11 |
.Sh SYNOPSIS |
11 |
.Sh SYNOPSIS |
| 12 |
.Ss FIREWALL CONFIGURATION |
12 |
.Ss FIREWALL CONFIGURATION |
| 13 |
.Nm |
13 |
.Nm |
|
Lines 387-393
Link Here
|
| 387 |
for the place of invocation (e.g.\& trying to match a MAC header within |
387 |
for the place of invocation (e.g.\& trying to match a MAC header within |
| 388 |
.Cm ip_input |
388 |
.Cm ip_input |
| 389 |
or |
389 |
or |
| 390 |
.Cm ip6_input ), |
390 |
.Cm ip6_input ) , |
| 391 |
the match pattern will not match, but a |
391 |
the match pattern will not match, but a |
| 392 |
.Cm not |
392 |
.Cm not |
| 393 |
operator in front of such patterns |
393 |
operator in front of such patterns |
|
Lines 843-849
Link Here
|
| 843 |
and |
843 |
and |
| 844 |
.Cm return |
844 |
.Cm return |
| 845 |
actions don't do any jumps and simply go to the next rule if memory |
845 |
actions don't do any jumps and simply go to the next rule if memory |
| 846 |
can't be allocated or stack overflowed/undeflowed. |
846 |
can't be allocated or stack overflowed/underflowed. |
| 847 |
.Pp |
847 |
.Pp |
| 848 |
Internally stack for rule numbers is implemented using |
848 |
Internally stack for rule numbers is implemented using |
| 849 |
.Xr mbuf_tags 9 |
849 |
.Xr mbuf_tags 9 |
|
Lines 914-920
Link Here
|
| 914 |
where |
914 |
where |
| 915 |
.Ar code |
915 |
.Ar code |
| 916 |
is a number from 0, 1, 3 or 4, or one of these aliases: |
916 |
is a number from 0, 1, 3 or 4, or one of these aliases: |
| 917 |
.Cm no-route, admin-prohib, address |
917 |
.Cm no-route , admin-prohib , address |
| 918 |
or |
918 |
or |
| 919 |
.Cm port . |
919 |
.Cm port . |
| 920 |
The search terminates. |
920 |
The search terminates. |
|
Lines 1525-1531
Link Here
|
| 1525 |
.Cm port numbers |
1525 |
.Cm port numbers |
| 1526 |
(i.e., one or more comma-separated single values or ranges). |
1526 |
(i.e., one or more comma-separated single values or ranges). |
| 1527 |
You can use symbolic names for known values such as |
1527 |
You can use symbolic names for known values such as |
| 1528 |
.Em vlan , ipv4, ipv6 . |
1528 |
.Em vlan , ipv4 , ipv6 . |
| 1529 |
Values can be entered as decimal or hexadecimal (if prefixed by 0x), |
1529 |
Values can be entered as decimal or hexadecimal (if prefixed by 0x), |
| 1530 |
and they are always printed as hexadecimal (unless the |
1530 |
and they are always printed as hexadecimal (unless the |
| 1531 |
.Cm -N |
1531 |
.Cm -N |
|
Lines 1781-1791
Link Here
|
| 1781 |
The |
1781 |
The |
| 1782 |
.Cm tablearg |
1782 |
.Cm tablearg |
| 1783 |
argument can be used with the following actions: |
1783 |
argument can be used with the following actions: |
| 1784 |
.Cm nat, pipe , queue, divert, tee, netgraph, ngtee, fwd, skipto, setfib, |
1784 |
.Cm nat, pipe , queue , divert , tee , netgraph , ngtee , fwd , skipto , setfib , |
| 1785 |
action parameters: |
1785 |
action parameters: |
| 1786 |
.Cm tag, untag, |
1786 |
.Cm tag , untag , |
| 1787 |
rule options: |
1787 |
rule options: |
| 1788 |
.Cm limit, tagged. |
1788 |
.Cm limit , tagged . |
| 1789 |
.Pp |
1789 |
.Pp |
| 1790 |
When used with |
1790 |
When used with |
| 1791 |
.Cm fwd |
1791 |
.Cm fwd |
|
Lines 1883-1889
Link Here
|
| 1883 |
are used here only to denote the initial match addresses, but they |
1883 |
are used here only to denote the initial match addresses, but they |
| 1884 |
are completely equivalent afterwards). |
1884 |
are completely equivalent afterwards). |
| 1885 |
Dynamic rules will be checked at the first |
1885 |
Dynamic rules will be checked at the first |
| 1886 |
.Cm check-state, keep-state |
1886 |
.Cm check-state , keep-state |
| 1887 |
or |
1887 |
or |
| 1888 |
.Cm limit |
1888 |
.Cm limit |
| 1889 |
occurrence, and the action performed upon a match will be the same |
1889 |
occurrence, and the action performed upon a match will be the same |
|
Lines 2713-2719
Link Here
|
| 2713 |
Global tracking is disabled |
2713 |
Global tracking is disabled |
| 2714 |
.It Cm >1 |
2714 |
.It Cm >1 |
| 2715 |
Enables tracking, the maximum number of addresses tracked for each |
2715 |
Enables tracking, the maximum number of addresses tracked for each |
| 2716 |
association is limited to this value |
2716 |
association is limited to this value. |
| 2717 |
.El |
2717 |
.El |
| 2718 |
.Pp |
2718 |
.Pp |
| 2719 |
This variable is fully dynamic, the new value will be adopted for all newly |
2719 |
This variable is fully dynamic, the new value will be adopted for all newly |
|
Lines 2789-2795
Link Here
|
| 2789 |
.It Va net.inet.ip.fw.default_rule : No 65535 |
2789 |
.It Va net.inet.ip.fw.default_rule : No 65535 |
| 2790 |
The default rule number (read-only). |
2790 |
The default rule number (read-only). |
| 2791 |
By the design of |
2791 |
By the design of |
| 2792 |
.Nm , the default rule is the last one, so its number |
2792 |
.Nm , |
|
|
2793 |
the default rule is the last one, so its number |
| 2793 |
can also serve as the highest number allowed for a rule. |
2794 |
can also serve as the highest number allowed for a rule. |
| 2794 |
.It Va net.inet.ip.fw.dyn_buckets : No 256 |
2795 |
.It Va net.inet.ip.fw.dyn_buckets : No 256 |
| 2795 |
The number of buckets in the hash table for dynamic rules. |
2796 |
The number of buckets in the hash table for dynamic rules. |