1.Dd July 20, 1996 2.Dt IPFW 8 SMM 3.Os FreeBSD 4.Sh NAME 5.Nm ipfw 6.Nd controlling utility for IP firewall 7.Sh SYNOPSIS 8.Nm 9.Ar file 10.Nm ipfw 11.Oo 12.Fl f 13| 14.Fl q 15.Oc 16flush 17.Nm ipfw 18.Oo 19.Fl q 20.Oc 21zero 22.Op Ar number 23.Nm ipfw 24delete 25.Ar number 26.Nm ipfw 27.Op Fl aftN 28list 29.Nm ipfw 30.Oo 31.Fl ftN 32.Oc 33show 34.Nm ipfw 35.Oo 36.Fl q 37.Oc 38add 39.Op Ar number 40.Ar action 41.Op log 42.Ar proto 43from 44.Ar src 45to 46.Ar dst 47.Op via Ar name | ipno 48.Op Ar options 49.Sh DESCRIPTION 50If used as shown in the first synopsis line, the 51.Ar file 52will be read line by line and applied as arguments to the 53.Nm 54command. 55.Pp 56The 57.Nm 58code works by going through the rule-list for each packet, 59until a match is found. 60All rules have two associated counters, a packet count and 61a byte count. 62These counters are updated when a packet matches the rule. 63.Pp 64The rules are ordered by a ``line-number'' from 1 to 65534 that is used 65to order and delete rules. Rules are tried in increasing order, and the 66first rule that matches a packet applies. 67Multiple rules may share the same number and apply in 68the order in which they were added. 69.Pp 70If a rule is added without a number, it numbered 100 higher 71than the previous rule. If the highest defined rule number is 72greater than 65434, new rules are appended to the last rule. 73.Pp 74The delete operation deletes the first rule with number 75.Ar number , 76if any. 77.Pp 78The list command prints out the current rule set. 79.Pp 80The show command is equivalent to `ipfw -a list'. 81.Pp 82The zero operation zeroes the counters associated with rule number 83.Ar number . 84.Pp 85The flush operation removes all rules. 86.Pp 87One rule is always present: 88.Bd -literal -offset center 8965535 deny all from any to any 90.Ed 91.Pp 92This rule is the default policy, i.e., don't allow anything at all. 93Your job in setting up rules is to modify this policy to match your 94needs. 95.Pp 96The following options are available: 97.Bl -tag -width flag 98.It Fl a 99While listing, show counter values. This option is the only way to see 100accounting records. 101.It Fl f 102Don't ask for confirmation for commands that can cause problems if misused 103(ie; flush). 104.Ar Note , 105if there is no tty associated with the process, this is implied. 106.It Fl q 107While adding or flushing, be quiet about actions (implies '-f'). This is 108useful for adjusting rules by executing multiple ipfw commands in a script 109(e.g. sh /etc/rc.firewall), or by processing a file of many ipfw rules, 110across a remote login session. If a flush is performed in normal 111(verbose) mode, it prints a message. Because all rules are flushed, the 112message cannot be delivered to the login session, the login session is 113closed and the remainder of the ruleset is not processed. Access to the 114console is required to recover. 115.It Fl t 116While listing, show last match timestamp. 117.It Fl N 118Try to resolve addresses and service names in output. 119.El 120.Pp 121.Ar action : 122.Bl -hang -offset flag -width 1234567890123456 123.It Ar allow 124Allow packets that match rule. 125The search terminates. 126.It Ar pass 127Same as allow. 128.It Ar accept 129Same as allow. 130.It Ar count 131Update counters for all packets that match rule. 132The search continues with the next rule. 133.It Ar deny 134Discard packets that match this rule. 135The search terminates. 136.It Ar reject 137Discard packets that match this rule, and try to send an ICMP notice. 138The search terminates. 139.It Ar divert port 140Divert packets that match this rule to the divert socket bound to port 141.Ar port . 142The search terminates. 143.El 144.Pp 145When a packet matches a rule with the ``log'' 146keyword, a message will be printed on the console. 147If the kernel was compiled with the 148.Dv IP_FIREWALL_VERBOSE_LIMIT 149option, then logging will cease after the number of packets 150specified by the option are received for that particular 151chain entry. Logging may then be re-enabled by clearing 152the packet counter for that entry. 153.Pp 154.Ar proto : 155.Bl -hang -offset flag -width 1234567890123456 156.It Ar ip 157All packets match. 158.It Ar all 159All packets match. 160.It Ar tcp 161Only TCP packets match. 162.It Ar udp 163Only UDP packets match. 164.It Ar icmp 165Only ICMP packets match. 166.It Ar <number|name> 167Only packets for the specified protocol matches (see 168.Pa /etc/protocols 169for a complete list). 170.El 171.Pp 172.Ar src 173and 174.Ar dst : 175.Pp 176.Bl -hang -offset flag 177.It Ar <address/mask> 178.Op Ar ports 179.El 180.Pp 181The 182.Em <address/mask> 183may be specified as: 184.Bl -hang -offset flag -width 1234567890123456 185.It Ar ipno 186An ipnumber of the form 1.2.3.4. 187Only this exact ip number match the rule. 188.It Ar ipno/bits 189An ipnumber with a mask width of the form 1.2.3.4/24. 190In this case all ip numbers from 1.2.3.0 to 1.2.3.255 will match. 191.It Ar ipno:mask 192An ipnumber with a mask width of the form 1.2.3.4:255.255.240.0. 193In this case all ip numbers from 1.2.0.0 to 1.2.15.255 will match. 194.El 195.Pp 196The sense of the match can be inverted by preceding an address with the 197``not'' modifier, causing all other addresses to be matched instead. This 198does not affect the selection of port numbers. 199.Pp 200With the TCP and UDP 201.Em protocols , 202optional 203.Em ports 204may be specified as: 205.Pp 206.Bl -hang -offset flag 207.It Ns {port|port-port} Ns Op ,port Ns Op ,... 208.El 209.Pp 210Service names (from 211.Pa /etc/services ) 212may not be used instead of a numeric port value. 213Also, note that a range may only be specified as the first value, 214and the port list is limited to 215.Dv IP_FW_MAX_PORTS 216(as defined in 217.Pa /usr/src/sys/netinet/ip_fw.h ) 218ports. 219.Pp 220If ``via'' 221.Ar name 222is specified, only packets received via or on their way out of an interface 223matching 224.Ar name 225will match this rule. 226.Pp 227If ``via'' 228.Ar ipno 229is specified, only packets received via or on their way out of an interface 230having the address 231.Ar ipno 232will match this rule. 233.Pp 234.Ar options : 235.Bl -hang -offset flag -width 1234567890123456 236.It frag 237Matches if the packet is a fragment and this is not the first fragment 238of the datagram. 239.It in 240Matches if this packet was on the way in. 241.It out 242Matches if this packet was on the way out. 243.It ipoptions Ar spec 244Matches if the IP header contains the comma separated list of 245options specified in 246.Ar spec . 247The supported IP options are: 248.Ar ssrr 249(strict source route), 250.Ar lsrr 251(loose source route), 252.Ar rr 253(record packet route), and 254.Ar ts 255(timestamp). 256The absence of a particular option may be denoted 257with a ``!''. 258.It established 259Matches packets that have the RST or ACK bits set. 260TCP packets only. 261.It setup 262Matches packets that have the SYN bit set but no ACK bit. 263TCP packets only. 264.It tcpflags Ar spec 265Matches if the TCP header contains the comma separated list of 266flags specified in 267.Ar spec . 268The supported TCP flags are: 269.Ar fin , 270.Ar syn , 271.Ar rst , 272.Ar psh , 273.Ar ack , 274and 275.Ar urg . 276The absence of a particular flag may be denoted 277with a ``!''. 278.It icmptypes Ar types 279Matches if the ICMP type is in the list 280.Ar types . 281The list may be specified as any combination of ranges 282or individual types separated by commas. 283.El 284.Sh CHECKLIST 285Here are some important points to consider when designing your 286rules: 287.Bl -bullet -hang -offset flag 288.It 289Remember that you filter both packets going in and out. 290Most connections need packets going in both directions. 291.It 292Remember to test very carefully. 293It is a good idea to be near the console when doing this. 294.It 295Don't forget the loopback interface. 296.El 297.Sh FINE POINTS 298There is one kind of packet that the firewall will always discard, 299that is an IP fragment with a fragment offset of one. 300This is a valid packet, but it only has one use, to try to circumvent 301firewalls. 302.Pp 303If you are logged in over a network, loading the LKM version of 304.Nm 305is probably not as straightforward as you would think. 306I recommend this command line: 307.Bd -literal -offset center 308modload /lkm/ipfw_mod.o && \e 309ipfw add 32000 allow all from any to any 310.Ed 311.Pp 312Along the same lines, doing an 313.Bd -literal -offset center 314ipfw flush 315.Ed 316.Pp 317in similar surroundings is also a bad idea. 318.Sh PACKET DIVERSION 319A divert socket bound to the specified port will receive all packets diverted 320to that port; see 321.Xr divert 4 . 322If no socket is bound to the destination port, or if the kernel 323wasn't compiled with divert socket support, diverted packets are dropped. 324.Sh EXAMPLES 325This command adds an entry which denies all tcp packets from 326.Em hacker.evil.org 327to the telnet port of 328.Em wolf.tambov.su 329from being forwarded by the host: 330.Pp 331.Dl ipfw add deny tcp from hacker.evil.org to wolf.tambov.su 23 332.Pp 333This one disallows any connection from the entire hackers network to 334my host: 335.Pp 336.Dl ipfw addf deny all from 123.45.67.0/24 to my.host.org 337.Pp 338Here is good usage of list command to see accounting records: 339.Pp 340.Dl ipfw -at l 341.Pp 342or in short form 343.Pp 344.Dl ipfw -a l 345.Pp 346This rule diverts all incoming packets from 192.168.2.0/24 to divert port 5000: 347.Pp 348.Dl ipfw divert 5000 all from 192.168.2.0/24 to any in 349.Sh SEE ALSO 350.Xr divert 4 , 351.Xr ip 4 , 352.Xr ipfirewall 4 , 353.Xr protocols 5 , 354.Xr services 5 , 355.Xr reboot 8 , 356.Xr syslogd 8 357.Sh BUGS 358.Pp 359.Em WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!WARNING!!WARNING!! 360.Pp 361This program can put your computer in rather unusable state. When 362using it for the first time, work on the console of the computer, and 363do 364.Em NOT 365do anything you don't understand. 366.Pp 367When manipulating/adding chain entries, service and protocol names are 368not accepted. 369.Sh AUTHORS 370Ugen J. S. Antsilevich, 371Poul-Henning Kamp, 372Alex Nash, 373Archie Cobbs. 374API based upon code written by Daniel Boulet for BSDI. 375.Sh HISTORY 376.Nm 377first appeared in 378.Fx 2.0 . 379