modules (according to the previously choosen installation method), you

      modules (according to the previously choosen installation method), you

      have to make some changes to the <filename>/etc/rc.conf</filename>

      have to make some changes to the <filename>/etc/rc.conf</filename>

      configuration file. The default rule of the firewall is to reject all IP

      configuration file. The default rule of the firewall is to reject all IP

      its operation without any issue related to packet filtering (in case you

      its operation without any issue related to packet filtering (in case you

      are going to execute this procedure remotely, such configuration will

      are going to execute this procedure remotely, such configuration will

      avoid you to remain isolated from the network). Put these lines in

      avoid you to remain isolated from the network). Put these lines in

    <para>The first row will enable the firewall (and will load the module

    <para>The first row will enable the firewall (and will load the module

      <filename>ipfw.ko</filename> if it is not compiled in the kernel), the

      <filename>ipfw.ko</filename> if it is not compiled in the kernel), the

      <filename>/etc/rc.firewall</filename>), the third one to not show rules

      <filename>/etc/rc.firewall</filename>), the third one to not show rules

      loading and the fourth one to enable logging support.</para>

      loading and the fourth one to enable logging support.</para>

    <para>Now it's time to reboot the system and use it as before: there will

    <para>Now it's time to reboot the system and use it as before: there will

      be some new messages about the bridge and the firewall, but the bridge

      be some new messages about the bridge and the firewall, but the bridge

      avoid any operations.</para>

      avoid any operations.</para>

    <para>If there are any problems, you should sort them out now

    <para>If there are any problems, you should sort them out now

      are being received by the local machine. In general, incoming packets

      are being received by the local machine. In general, incoming packets

      are run through the firewall only once, not twice as is normally the

      are run through the firewall only once, not twice as is normally the

      case; in fact they are filtered only upon receipt, so rules that use

      case; in fact they are filtered only upon receipt, so rules that use

      older syntax, but one that has a sense when you read it. Another

      older syntax, but one that has a sense when you read it. Another

      commands for packets filtered by a bridge.  Sophisticated things like

      commands for packets filtered by a bridge.  Sophisticated things like

      still be used, but only on traffic to or from the bridge machine itself

      still be used, but only on traffic to or from the bridge machine itself

      (if it has an IP address).</para>

      (if it has an IP address).</para>

      exact same set of IP addresses and port numbers (but with source and

      exact same set of IP addresses and port numbers (but with source and

      destination reversed, of course). For firewalls that have no

      destination reversed, of course). For firewalls that have no

      statekeeping, there is almost no way to deal with this sort of traffic

      statekeeping, there is almost no way to deal with this sort of traffic

      <acronym>UDP</acronym> packet and, for the next few minutes, allow a

      <acronym>UDP</acronym> packet and, for the next few minutes, allow a

      response, handling <acronym>UDP</acronym> services is trivial. The

      response, handling <acronym>UDP</acronym> services is trivial. The

      following example shows how to do it. It's possible to do the same thing

      following example shows how to do it. It's possible to do the same thing

      have to care for them anymore. Custom rules should be put in a separate

      have to care for them anymore. Custom rules should be put in a separate

      file (say <filename>/etc/rc.firewall.local</filename>) and loaded at

      file (say <filename>/etc/rc.firewall.local</filename>) and loaded at

      system startup, by modifying the row of

      system startup, by modifying the row of

      firewall:</para>

      firewall:</para>

    <programlisting>firewall_type="/etc/rc.firewall.local"</programlisting>

    <programlisting>firewall_type="/etc/rc.firewall.local"</programlisting>

      server, if you have them. Obviously the whole rule set should be

      server, if you have them. Obviously the whole rule set should be

      flavored to personal taste, this is only a specific example (rule format

      flavored to personal taste, this is only a specific example (rule format

      is described accurately in the &man.ipfw.8; man page). Note that in

      is described accurately in the &man.ipfw.8; man page). Note that in

      <emphasis>before</emphasis> the bridge is enabled. This is an example of

      <emphasis>before</emphasis> the bridge is enabled. This is an example of

      making sure that you set the IP on the correct network card.

      making sure that you set the IP on the correct network card.

      Alternatively it is possible to specify the IP address instead of the

      Alternatively it is possible to specify the IP address instead of the

      host name (required if the machine is IP-less).</para>

      host name (required if the machine is IP-less).</para>

    <para>People that are used to setting up firewalls are probably also used

    <para>People that are used to setting up firewalls are probably also used

      (<acronym>TCP</acronym> port 113). Unfortunately, this is not an

      (<acronym>TCP</acronym> port 113). Unfortunately, this is not an

      applicable option with the bridge, so the best thing is to simply pass

      applicable option with the bridge, so the best thing is to simply pass

      them to their destination. As long as that destination machine is not

      them to their destination. As long as that destination machine is not

      of traffic will take different paths through the kernel and into the

      of traffic will take different paths through the kernel and into the

      packet filter. The inside net will go through the bridge, while the

      packet filter. The inside net will go through the bridge, while the

      local machine will use the normal IP stack to speak. Thus the two rules

      local machine will use the normal IP stack to speak. Thus the two rules

      exception for locally generated packets, because they did not come in

      exception for locally generated packets, because they did not come in

      via any of our interfaces.</para>

      via any of our interfaces.</para>

  </sect1>

  </sect1>