<para>Sample kernel config IPF option statements are in the

      <para>Sample kernel config IPF option statements are in the

       <filename>/usr/src/sys/conf/NOTES</filename> kernel source

       <filename>/usr/src/sys/conf/NOTES</filename> kernel source

       (<filename>/usr/src/sys/<replaceable>arch</replaceable>/conf/LINT</filename>

       (<filename>/usr/src/sys/<replaceable>arch</replaceable>/conf/LINT</filename>

      <programlisting>options IPFILTER

      <programlisting>options IPFILTER

options IPFILTER_LOG

options IPFILTER_LOG

                                  # n = map IP & port to names</programlisting>

                                  # n = map IP & port to names</programlisting>

      <para>If you have a LAN behind this firewall that uses the

      <para>If you have a LAN behind this firewall that uses the

        reserved private IP address ranges, then you need to add the

        reserved private IP address ranges, then you need to add the

      <programlisting>gateway_enable="YES"              # Enable as Lan gateway

      <programlisting>gateway_enable="YES"              # Enable as Lan gateway

ipnat_enable="YES"                # Start ipnat function

ipnat_enable="YES"                # Start ipnat function

     <para>The ipf command is used to load your rules file. Normally

     <para>The ipf command is used to load your rules file. Normally

       you create a file containing your custom rules and use this

       you create a file containing your custom rules and use this

       command to replace in mass the currently running firewall

       command to replace in mass the currently running firewall

     <programlisting><command>ipf -Fa -f /etc/ipf.rules</command></programlisting>

     <programlisting><command>ipf -Fa -f /etc/ipf.rules</command></programlisting>

         rotate system logs. That is why outputting the log information to

         rotate system logs. That is why outputting the log information to

         syslogd is better than the default of outputting to a regular

         syslogd is better than the default of outputting to a regular

         file. In the default <filename>rc.conf</filename> file you see the

         file. In the default <filename>rc.conf</filename> file you see the

       <programlisting>ipmon_flags="-Ds" # D = start as daemon

       <programlisting>ipmon_flags="-Ds" # D = start as daemon

                  # s = log to syslog

                  # s = log to syslog

         and <quote>level.</quote> IPMON in <option>-Ds</option> mode uses 

         and <quote>level.</quote> IPMON in <option>-Ds</option> mode uses 

         <quote>facility</quote> name. All IPMON logged data goes to

         <quote>facility</quote> name. All IPMON logged data goes to

         <literal>local0</literal>. The following levels can be used to further 

         <literal>local0</literal>. The following levels can be used to further 

       <screen>LOG_INFO - packets logged using the "log" keyword as the action rather 

       <screen>LOG_INFO - packets logged using the "log" keyword as the action rather 

LOG_NOTICE - packets logged which are also passed

LOG_NOTICE - packets logged which are also passed

         considerable flexibility in how syslog will deal with system

         considerable flexibility in how syslog will deal with system

         messages issued by software applications like IPF.</para>

         messages issued by software applications like IPF.</para>

       <programlisting>local0.* /var/log/ipfilter.log</programlisting>

       <programlisting>local0.* /var/log/ipfilter.log</programlisting>

       <para>Add a script like the following to your <filename>

       <para>Add a script like the following to your <filename>

         /usr/local/etc/rc.d/</filename> startup directory. The script

         /usr/local/etc/rc.d/</filename> startup directory. The script

       <programlisting>#!/bin/sh

       <programlisting>#!/bin/sh

sh /etc/ipf.rules.script</programlisting>

sh /etc/ipf.rules.script</programlisting>

           <para>There is no way to match ranges of IP addresses which

           <para>There is no way to match ranges of IP addresses which

             do not express themselves easily as mask-length. See this

             do not express themselves easily as mask-length. See this

             web page for help on writing mask-length:

             web page for help on writing mask-length:

         </sect3>

         </sect3>

         <sect3>

         <sect3>

      <para>Check out this link for port numbers used by Trojans

      <para>Check out this link for port numbers used by Trojans

        <ulink

        <ulink

      <para>The following rule set is a complete very secure

      <para>The following rule set is a complete very secure

        'inclusive' type of firewall rule set that I have used on my

        'inclusive' type of firewall rule set that I have used on my

        <acronym>NAT</acronym>ed private LAN IP address. According to

        <acronym>NAT</acronym>ed private LAN IP address. According to

        RFC 1918, you can use the following IP ranges for private nets

        RFC 1918, you can use the following IP ranges for private nets

        which will never be routed directly to the public

        which will never be routed directly to the public

        <informaltable frame="none" pgwide="1">

        <informaltable frame="none" pgwide="1">

          <tgroup cols="2">

          <tgroup cols="2">

          IP<acronym>NAT</acronym> to only use source ports in a

          IP<acronym>NAT</acronym> to only use source ports in a

          range. For example the following rule will tell

          range. For example the following rule will tell

          IP<acronym>NAT</acronym> to modify the source port to be

          IP<acronym>NAT</acronym> to modify the source port to be

        <programlisting>map dc0 192.168.1.0/24 -> 0.32 portmap tcp/udp 

        <programlisting>map dc0 192.168.1.0/24 -> 0.32 portmap tcp/udp 

        <programlisting>map dc0 20.20.20.5/32 port 80 -> 10.0.10.25 port 

        <programlisting>map dc0 20.20.20.5/32 port 80 -> 10.0.10.25 port 

        <programlisting>map dc0 0/32 port 80 -> 10.0.10.25 port 80</programlisting>

        <programlisting>map dc0 0/32 port 80 -> 10.0.10.25 port 80</programlisting>

          role="ipaddr">10.0.10.33</hostid> that needs to receive

          role="ipaddr">10.0.10.33</hostid> that needs to receive

        <programlisting>map dc0 20.20.20.5/32 port 53 -> 10.0.10.33 port 53 

        <programlisting>map dc0 20.20.20.5/32 port 53 -> 10.0.10.33 port 53 

    </sect2>

    </sect2>