1.\" Copyright (c) 2005 Gleb Smirnoff 2.\" All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 13.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 14.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 15.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 16.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 17.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 19.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 20.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 21.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 22.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23.\" SUCH DAMAGE. 24.\" 25.\" $FreeBSD$ 26.\" 27.Dd March 2, 2010 28.Dt NG_IPFW 4 29.Os 30.Sh NAME 31.Nm ng_ipfw 32.Nd interface between netgraph and IP firewall 33.Sh SYNOPSIS 34.In netinet/ip_var.h 35.In netgraph/ng_ipfw.h 36.Sh DESCRIPTION 37The 38.Nm ipfw 39node implements interface between 40.Xr ipfw 4 41and 42.Xr netgraph 4 43subsystems. 44.Sh HOOKS 45The 46.Nm ipfw 47node supports an arbitrary number of hooks, 48which must be named using only numeric characters. 49.Sh OPERATION 50Once the 51.Nm 52module is loaded into the kernel, a single node named 53.Va ipfw 54is automatically created. 55No more 56.Nm ipfw 57nodes can be created. 58Once destroyed, the only way to recreate the node is to reload the 59.Nm 60module. 61.Pp 62Packets can be injected into 63.Xr netgraph 4 64using either the 65.Cm netgraph 66or 67.Cm ngtee 68commands of the 69.Xr ipfw 8 70utility. 71These commands require a numeric cookie to be supplied as an argument. 72Packets are sent out of the hook whose name equals the cookie value. 73If no hook matches, packets are discarded. 74Packets injected via the 75.Cm netgraph 76command are tagged with 77.Vt "struct ipfw_rule_ref" . 78This tag contains information that helps the packet to re-enter 79.Xr ipfw 4 80processing, should the packet come back from 81.Xr netgraph 4 82to 83.Xr ipfw 4 . 84.Pp 85Packets received by a node from 86.Xr netgraph 4 87subsystem must be tagged with 88.Vt "struct ipfw_rule_ref" 89tag. 90Packets re-enter IP firewall processing at the next rule. 91If no tag is supplied, packets are discarded. 92.Sh CONTROL MESSAGES 93This node type supports only the generic control messages. 94.Sh SHUTDOWN 95This node shuts down upon receipt of a 96.Dv NGM_SHUTDOWN 97control message. 98Do not do this, since the new 99.Nm ipfw 100node can only be created by reloading the 101.Nm 102module. 103.Sh SEE ALSO 104.Xr ipfw 4 , 105.Xr netgraph 4 , 106.Xr ipfw 8 , 107.Xr mbuf_tags 9 108.Sh HISTORY 109The 110.Nm ipfw 111node type was implemented in 112.Fx 6.0 . 113.Sh AUTHORS 114The 115.Nm ipfw 116node was written by 117.An Gleb Smirnoff Aq Mt glebius@FreeBSD.org . 118