summaryrefslogtreecommitdiffstats
path: root/contrib/ipfilter/man/ipf.5
diff options
context:
space:
mode:
authordarrenr <darrenr@FreeBSD.org>2004-06-21 22:47:51 +0000
committerdarrenr <darrenr@FreeBSD.org>2004-06-21 22:47:51 +0000
commit590450fec65a8e72a8965117398bc8f14938b4a8 (patch)
tree699025ff2d567ed726a446a7ca5c3d916f5ca0a4 /contrib/ipfilter/man/ipf.5
parent244f07541460d6bd022a1eea60585315231e9e1c (diff)
downloadFreeBSD-src-590450fec65a8e72a8965117398bc8f14938b4a8.zip
FreeBSD-src-590450fec65a8e72a8965117398bc8f14938b4a8.tar.gz
Import ipfilter 3.4.35 onto vendor branch
Diffstat (limited to 'contrib/ipfilter/man/ipf.5')
-rw-r--r--contrib/ipfilter/man/ipf.514
1 files changed, 7 insertions, 7 deletions
diff --git a/contrib/ipfilter/man/ipf.5 b/contrib/ipfilter/man/ipf.5
index 8c7dac0..835d775 100644
--- a/contrib/ipfilter/man/ipf.5
+++ b/contrib/ipfilter/man/ipf.5
@@ -1,10 +1,10 @@
.TH IPF 5
.SH NAME
-ipf, ipf.conf \- IP packet filter rule syntax
+ipf, ipf.conf, ipf6.conf \- IP packet filter rule syntax
.SH DESCRIPTION
.PP
A rule file for \fBipf\fP may have any name or even be stdin. As
-\fBipfstat\fP produces parseable rules as output when displaying the internal
+\fBipfstat\fP produces parsable rules as output when displaying the internal
kernel filter lists, it is quite plausible to use its output to feed back
into \fBipf\fP. Thus, to remove all filters on input packets, the following
could be done:
@@ -37,7 +37,7 @@ log = "log" [ "body" ] [ "first" ] [ "or-block" ] [ "level" loglevel ] .
call = "call" [ "now" ] function-name .
skip = "skip" decnumber .
dup = "dup-to" interface-name[":"ipaddr] .
-froute = "fastroute" | "to" interface-name .
+froute = "fastroute" | "to" interface-name[":"ipaddr] .
protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber .
srcdst = "all" | fromto .
fromto = "from" [ "!" ] object "to" [ "!" ] object .
@@ -116,7 +116,7 @@ below).
Filters are installed by default at the end of the kernel's filter
lists, prepending the rule with \fB@n\fP will cause it to be inserted
as the n'th entry in the current list. This is especially useful when
-modifying and testing active filter rulesets. See ipf(1) for more
+modifying and testing active filter rulesets. See ipf(8) for more
information.
.SH ACTIONS
.PP
@@ -136,7 +136,7 @@ with a rule which is being applied to TCP packets. When using
\fBreturn-icmp\fP or \fBreturn-icmp-as-dest\fP, it is possible to specify
the actual unreachable `type'. That is, whether it is a network
unreachable, port unreachable or even administratively
-prohibitied. This is done by enclosing the ICMP code associated with
+prohibited. This is done by enclosing the ICMP code associated with
it in parenthesis directly following \fBreturn-icmp\fP or
\fBreturn-icmp-as-dest\fP as follows:
.nf
@@ -386,7 +386,7 @@ against, e.g.:
.TP
.B icmp-type
is only effective when used with \fBproto icmp\fP and must NOT be used
-in conjuction with \fBflags\fP. There are a number of types, which can be
+in conjunction with \fBflags\fP. There are a number of types, which can be
referred to by an abbreviation recognised by this language, or the numbers
with which they are associated can be used. The most important from
a security point of view is the ICMP redirect.
@@ -427,7 +427,7 @@ indicates that the rule should be put in group (number n) rather than group 0.
.PP
When a packet is logged, with either the \fBlog\fP action or option,
the headers of the packet are written to the \fBipl\fP packet logging
-psuedo-device. Immediately following the \fBlog\fP keyword, the
+pseudo-device. Immediately following the \fBlog\fP keyword, the
following qualifiers may be used (in order):
.TP
.B body
OpenPOWER on IntegriCloud