Bug 129024
| Summary: | [patch] ipfw(8) improvements | ||
|---|---|---|---|
| Product: | Documentation | Reporter: | kes-kes |
| Component: | Manual Pages | Assignee: | Gordon Bergling <gbe> |
| Status: | In Progress --- | ||
| Severity: | Affects Only Me | CC: | doc, gbe, lwhsu |
| Priority: | Normal | Keywords: | patch |
| Version: | Latest | ||
| Hardware: | Any | ||
| OS: | Any | ||
| See Also: | https://reviews.freebsd.org/D27221 | ||
Responsible Changed From-To: freebsd-bugs->freebsd-doc Reclassify. Responsible Changed From-To: freebsd-doc->keramida Parts of this look interesting. I'll take care of that. Release to wild. ^Triage: reset inaccurate In Progress state. From feedback of the differntial ipfw doesn't have an iface option. Is that correct? |
divert port Divert packets that match this rule to the divert(4) socket bound - to port port. The search terminates. + to port port. The search terminates. however, + on exit from the pipe and if the sysctl(8) variable + net.inet.ip.fw.one_pass is not set, the packet is passed again to + the firewall code starting from the next rule. fwd | forward ipaddr | tablearg[,port] Change the next-hop on matching packets to ipaddr, which can be an IP address or a host name. The next hop can also be supplied by the last table looked up for the packet by using the tablearg keyword instead of an explicit address. The search terminates if - this rule matches. + this rule matches. however, + on exit from the pipe and if the sysctl(8) variable + net.inet.ip.fw.one_pass is not set, the packet is passed again to + the firewall code starting from the next rule. ----------------- - addr: [not] {any | me | me6 | table(number[,value]) | addr-list | - addr-set} + addr: [not] {any | me | me6 | iface | table(number[,value]) | addr-list | + addr-set} any matches any IP address. - me matches any IP address configured on an interface in the system. + me matches any IP address configured on any interface in the system. me6 matches any IPv6 address configured on an interface in the sys- tem. The address list is evaluated at the time the packet is an- alysed. + iface where iface is interface on system. In this case + addresses configures only on this interface will match ------------------