diff options
author | luigi <luigi@FreeBSD.org> | 2003-07-15 23:08:44 +0000 |
---|---|---|
committer | luigi <luigi@FreeBSD.org> | 2003-07-15 23:08:44 +0000 |
commit | d9b36adf9db6e55ce3c1c5daac171320822b286b (patch) | |
tree | b992f79766f5caaa15e7aea78a3133c66a4e057f /sbin/ipfw/ipfw.8 | |
parent | b907f7d38c39083f86123e6fca202f45f663a114 (diff) | |
download | FreeBSD-src-d9b36adf9db6e55ce3c1c5daac171320822b286b.zip FreeBSD-src-d9b36adf9db6e55ce3c1c5daac171320822b286b.tar.gz |
Userland side of:
Allow set 31 to be used for rules other than 65535.
Set 31 is still special because rules belonging to it are not deleted
by the "ipfw flush" command, but must be deleted explicitly with
"ipfw delete set 31" or by individual rule numbers.
This implement a flexible form of "persistent rules" which you might
want to have available even after an "ipfw flush".
Note that this change does not violate POLA, because you could not
use set 31 in a ruleset before this change.
Suggested by: Paul Richards
Diffstat (limited to 'sbin/ipfw/ipfw.8')
-rw-r--r-- | sbin/ipfw/ipfw.8 | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8 index 39dc69e..22dc548 100644 --- a/sbin/ipfw/ipfw.8 +++ b/sbin/ipfw/ipfw.8 @@ -124,7 +124,7 @@ An .Nm ruleset always includes a .Em default -rule (numbered 65535) which cannot be modified, +rule (numbered 65535) which cannot be modified or deleted, and matches all packets. The action associated with the .Em default @@ -171,7 +171,7 @@ Rules can be added with the .Cm add command; deleted individually or in groups with the .Cm delete -command, and globally with the +command, and globally (except those in set 31) with the .Cm flush command; displayed, optionally with the content of the counters, using the @@ -482,14 +482,22 @@ non-default value is used instead. .It Cm set Ar set_number Each rule is associated with a .Ar set_number -in the range 0..31, with the latter reserved for the -.Em default -rule. +in the range 0..31. Sets can be individually disabled and enabled, so this parameter is of fundamental importance for atomic ruleset manipulation. It can be also used to simplify deletion of groups of rules. If a rule is entered without specifying a set number, set 0 will be used. +.br +Set 31 is special in that it cannot be disabled, +and rules in set 31 are not deleted by the +.Nm ipfw flush +command (but you can delete them with the +.Nm ipfw delete set 31 +command). +Set 31 is also used for the +.Em default +rule. .It Cm prob Ar match_probability A match is only declared with the specified probability (floating point number between 0 and 1). |