Attachment #26120 for bug #44541

View | Details | Raw Unified | Return to bug 44541
Collapse All | Expand All




.Fx
STABLE still uses
.Nm ipfw1
unless 
.Cm options IPFW2 ,
and
.Nm /sbin/ipfw
and
.Nm /usr/lib/libalias
are recompiled with
.Cm -DIPFW2
and reinstalled (this can be achieved by adding
.Cm IPFW2=TRUE
to
.Nm /etc/make.conf
before a buildworld) and the kernel is recompiled with
.Cm options IPFW2 .
.Pp
See the
.Sx IPFW2 ENHANCEMENTS
section for a list of features which are not present in
.Nm ipfw1 .
This list can also be provide hints for revising your rules and
writing them more efficiently.
.Pp
An
.Nm

numbered from 1 to 65535.
Packets are passed to
.Nm
from a number of different places in the protocol stack
(depending on the source and destination of the packet,
it is possible that
.Nm

.Sx STATEFUL FIREWALL
and
.Sx EXAMPLES
sections below for more information on the stateful behaviour of
.Nm .
.Pp
All rules (including dynamic ones) have a few associated counters:

.Nm
commands to atomically manipulate sets, such as enable,
disable, swap sets, move all rules in a set to another
one, and delete all rules in a set. These can be useful to
install temporary configurations, or to test them.
See section
.Sx SETS OF RULES
for more information on
.Em sets .

.Ql sh\ /etc/rc.firewall ) ,
or by processing a file of many
.Nm
rules
across a remote login session.
If a
.Cm flush

configuration), it prints a message.
Because all rules are flushed, the message might not be delivered
to the login session, causing the remote login session to be closed
and the remainder of the ruleset to not be processed.
Access to the console would then be required to recover.
.It Fl S
While listing rules, show the

listed.
.It Fl s Op Ar field
While listing pipes, sort according to one of the four
counters (total and current, packets or bytes).
.It Fl t
While listing, show last match timestamp.
.El

.Cm queue
commands are used to configure the traffic shaper, as shown in the
.Sx TRAFFIC SHAPER CONFIGURATION
section below.
.Sh PACKET FLOW
.Nm
can be invoked from multiple places in the protocol stack,

.Nm
is invoked, or the source of the packet.
If a rule contains some match patterns or actions which are not valid
for the place of invocation (e.g. trying
to match a MAC header when
.Nm
is called from

operator in front of such patterns will cause the pattern to
.Em always
match on those packets, which might cause undesired results.
It is thus the responsibility of
the programmer, if necessary, to write a suitable ruleset to
differentiate among the possible places.
.Cm skipto

TCP, UDP, ICMP, etc.
.It Source and dest. addresses and ports
.It Direction
See section
.Sx PACKET FLOW
.It Transmit and receive interface
By name or address

.It ICMP types
for ICMP packets
.It User/group ID
When the packet can be associated with a local socket.
.El
.Pp
Note that some of the above information, e.g. source MAC or IP addresses and

.Ar net.inet.ip.fw.autoinc_step
which defaults to 100.
If this is not possible (e.g. because we would go beyond the
maximum allowed rule number), the number of the last
non-default value is used instead.
.It Cm set Ar set_number
Each rule is associated with a
.Ar set_number
in the range 0..31, with the latter reserved for the
.Em default

(which is the default when the kernel is compiled with
.Dv IPFIREWALL_VERBOSE
) and the number of packets logged so far for that
particular rule does not exceed the
.Cm logamount
parameter.
If no

.Pp
Once the limit is reached, logging can be re-enabled by
clearing the logging counter
or the packet counter for that entry; see the
.Cm resetlog
command.
.Pp

.It Cm fwd | forward Ar ipaddr Ns Op , Ns Ar port
Change the next-hop on matching packets to
.Ar ipaddr ,
which can be an IP address in dotted quad format or a host name.
The search terminates if this rule matches.
.Pp
If

(for bandwidth limitation, delay, etc.).
See the
.Sx TRAFFIC SHAPER CONFIGURATION
section for further information.
The search terminates; however, on exit from the pipe and if
the
.Xr sysctl 8

socket bound to port
.Ar port .
The search terminates and the original packet is accepted
(but see section
.Sx BUGS
below).
.It Cm unreach Ar code

can be used to escape the dash
.Pq Ql -
character in a service name (from a shell, the backslash must be
typed twice to avoid the shell itself interpreting it as an escape
character).
.Pp
.Dl "ipfw add count tcp from any ftp\e\e-data-ftp to any"

.Ar ver .
.It Cm keep-state
Upon a match, the firewall will create a dynamic rule, whose
default behaviour is to match bidirectional traffic between
source and destination IP/port using the same protocol.
The rule has a limited lifetime (controlled by a set of
.Xr sysctl 8

(i.e. one or more comma-separated single values or ranges).
You can use symbolic names for known values such as
.Em vlan , ipv4, ipv6 .
Values can be entered as decimal or hexadecimal (if prefixed by 0x),
and they are always printed as hexadecimal (unless the
.Cm -N
option is used, in which case symbolic resolution will be attempted).
.It Cm proto Ar protocol
Matches packets with the corresponding IPv4 protocol.
.It Cm recv | xmit | via Brq Ar ifX | Ar if Ns Cm * | Ar ipno | Ar any
Matches packets received, transmitted or going through,
respectively, the interface specified by exact name
.Ns No ( Ar ifX Ns No ),
by device name

Command execution is atomic on all the sets specified in the command.
By default, all sets are enabled.
.Pp
When you disable a set, its rules behave as if they do not exist
in the firewall configuration, with only one exception:
.Bl -bullet
.It

.Pp
See the
.Sx EXAMPLES
section on some possible uses of sets of rules.
.Sh STATEFUL FIREWALL
Stateful operation is a way for the firewall to dynamically
create rules for specific flows when packets that

of the flow and the setting of some
.Cm sysctl
variables.
See section
.Sx SYSCTL VARIABLES
for more details.
For TCP sessions, dynamic rules can be instructed to periodically
send keepalive packets to refresh the state of the rule when it is
about to expire.
.Pp
See section
.Sx EXAMPLES
for more examples on how to use dynamic rules.
.Sh TRAFFIC SHAPER CONFIGURATION

.Sm on
.Pp
A value of 0 (default) means unlimited bandwidth.
The unit must immediately follow the number, as in
.Pp
.Dl "ipfw pipe 1 config bw 300Kbit/s"
.Pp

Default is no.
.El
.Sh IPFW2 ENHANCEMENTS
This section lists the features that have been introduced in
.Nm ipfw2
which were not present in
.Nm ipfw1 .
We list them in order of the potential impact that they can
have on writing rulesets.
You might want to consider using these features in order to
write your rulesets in a more efficient way.
.Bl -tag -width indent

.Pp
The
.Cm layer2
option might seem redundant, but it is necessary -- packets
passed to the firewall from layer3 will not have a MAC header,
so the
.Cm mac-type ip

does not implement sets of rules.
.It MAC header filtering and Layer-2 firewalling.
.Nm ipfw1
does not implement filtering on MAC header fields, nor is it
invoked on packets from
.Cm ether_demux()
and

.Sh EXAMPLES
There are far too many possible uses of
.Nm
so this section will only give a small set of examples.
.Pp
.Ss BASIC PACKET FILTERING
This command adds an entry which denies all tcp packets from

.Pp
.Dl "ipfw add deny tcp from cracker.evil.org to wolf.tambov.su telnet"
.Pp
This one disallows any connection from the entire cracker's
network to my host:
.Pp
.Dl "ipfw add deny ip from 123.45.67.0/24 to my.host.org"

rule.
A
.Cm check-state
rule should usually be placed near the beginning of the
ruleset to minimize the amount of work scanning the ruleset.
Your mileage may vary.
.Pp

.Nm
rules are checked both on incoming and outgoing packets.
.Pp
Should we want to simulate a bidirectional link with bandwidth
limitations, the correct way is the following:
.Pp
.Dl "ipfw add pipe 1 ip from any to any out"

.Dl "ipfw pipe 2 config bw 64Kbit/s queue 10Kbytes"
.Pp
The above can be very useful, e.g. if you want to see how
your fancy Web page will look for a residential user who
is connected only through a slow link.
You should not use only one pipe for both directions, unless
you want to simulate a half-duplex medium (e.g. AppleTalk,

It is not necessary that both pipes have the same configuration,
so we can also simulate asymmetric links.
.Pp
Should we want to verify network performance with the RED queue
management algorithm:
.Pp
.Dl "ipfw add pipe 1 ip from any to any"

.Pp
Another typical application of the traffic shaper is to
introduce some delay in the communication.
This can signficantly affect applications which do a lot of Remote
Procedure Calls, and where the round-trip-time of the
connection often becomes a limiting factor much more than
bandwidth:

.Sh BUGS
The syntax has grown over the years and sometimes it might be confusing.
Unfortunately, backward compatibility prevents cleaning up mistakes
made in the definition of the syntax.
.Pp
.Em !!! WARNING !!!
.Pp
Misconfiguring the firewall can put your computer in an unusable state,
possibly shutting down network services and requiring console access to
regain control of it.
.Pp
Incoming packet fragments diverted by
.Cm divert

Return to bug 44541