summaryrefslogtreecommitdiffstats
path: root/sbin/ipfw/ipfw.8
Commit message (Collapse)AuthorAgeFilesLines
* fix typo: s/sytem/system/rse2003-09-261-1/+1
|
* Document the alternate way of matching MAC addresses: by a bitmask.roam2003-09-101-2/+22
| | | | | | PR: 56021 Submitted by: Glen Gibb <grg@ridley.unimelb.edu.au> MFC after: 1 month
* Add a note that net.inet.ip.fw.autoinc_step is ipfw2-specificluigi2003-07-221-0/+4
|
* Userland side of:luigi2003-07-151-5/+13
| | | | | | | | | | | | | | Allow set 31 to be used for rules other than 65535. Set 31 is still special because rules belonging to it are not deleted by the "ipfw flush" command, but must be deleted explicitly with "ipfw delete set 31" or by individual rule numbers. This implement a flexible form of "persistent rules" which you might want to have available even after an "ipfw flush". Note that this change does not violate POLA, because you could not use set 31 in a ruleset before this change. Suggested by: Paul Richards
* Add a '-T' flag to print the timestamp as numeric value insteadluigi2003-07-121-3/+6
| | | | | | | of converting it with ctime(). This is a lot more convenient for postprocessing. Submitted by: "Jacob S. Barrett" <jbarrett@amduat.net>
* Document the existence of comments in ipfw rules,luigi2003-07-121-4/+11
| | | | | | | the new flags handled when reading from a file, and clarify that only numeric values are allowed for icmptypes. MFC after: 3 days
* Correct to match reality regarding interface names.dannyboy2003-07-081-3/+7
| | | | | | | PR: 51006 Submitted by: "Dmitry Pryanishnikov" <dmitry@atlantis.dp.ua> mdoc clue by: "Simon L. Nielsen" <simon@nitro.dk> MFC after: 10 days
* * introduce a section on SYNTAX to document the handlingluigi2003-07-081-44/+77
| | | | | | | | | | | | | | spaces and comma-separated lists of arguments; * reword the description of address specifications, to include previous and current changes for address sets and lists; * document the new '-n' flag. * update the section on differences between ipfw1 and ipfw2 (this is becoming boring!) MFC after: 3 days
* Implement the 'ipsec' option to match packets coming out of an ipsec tunnel.luigi2003-07-041-0/+12
| | | | | | | | | Should work with both regular and fast ipsec (mutually exclusive). See manpage for more details. Submitted by: Ari Suutari (ari.suutari@syncrontech.com) Revised by: sam MFC after: 1 week
* o Fix sets of rules usage example.maxim2003-06-231-4/+4
| | | | | | PR: docs/53625 Submitted by: Kostyuk Oleg <cub@cub.org.ua> MFC after: 1 week
* Add support for multiple values and ranges for the "iplen", "ipttl",luigi2003-06-221-18/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | "ipid" options. This feature has been requested by several users. On passing, fix some minor bugs in the parser. This change is fully backward compatible so if you have an old /sbin/ipfw and a new kernel you are not in trouble (but you need to update /sbin/ipfw if you want to use the new features). Document the changes in the manpage. Now you can write things like ipfw add skipto 1000 iplen 0-500 which some people were asking to give preferential treatment to short packets. The 'MFC after' is just set as a reminder, because I still need to merge the Alpha/Sparc64 fixes for ipfw2 (which unfortunately change the size of certain kernel structures; not that it matters a lot since ipfw2 is entirely optional and not the default...) PR: bin/48015 MFC after: 1 week
* Add a 'verrevpath' option that verifies the interface that a packetcjc2003-03-151-0/+28
| | | | | | | | | comes in on is the same interface that we would route out of to get to the packet's source address. Essentially automates an anti-spoofing check using the information in the routing table. Experimental. The usage and rule format for the feature may still be subject to change.
* /modules is gone long ago, use the safe equivalents.ru2003-03-031-2/+2
|
* Correct examples for stateful inspectionbrueffer2003-02-041-2/+2
| | | | | | PR: 47817 Submitted by: Simon L.Nielsen <simon@nitro.dk> Reviewed by: ceri, luigi
* It turns out that we do not need to add a new ioctl to unbreak adillon2003-01-121-0/+16
| | | | | | | | | | | | | default-to-deny firewall. Simply turning off IPFW via a preexisting sysctl does the job. To make it more apparent (since nobody picked up on this in a week's worth of flames), the boolean sysctl's have been integrated into the /sbin/ipfw command set in an obvious and straightforward manner. For example, you can now do 'ipfw disable firewall' or 'ipfw enable firewall'. This is far easier to remember then the net.inet.ip.fw.enable sysctl. Reviewed by: imp MFC after: 3 days
* Fix a reference to the order of SYNOPSIS lines.keramida2003-01-051-1/+1
| | | | | | Submitted by: Olivier Cherrier <Olivier.Cherrier@cediti.be> on freebsd-net MFC after: 3 days
* Make preprocessor support more generic by passing all command-line optionskbyanc2002-12-231-8/+4
| | | | | | | | | | after -p except for the last (the ruleset file to process) to the preprocessor for interpretation. This allows command-line options besides -U and -D to be passed to cpp(1) and m4(1) as well as making it easier to use other preprocessors. Sponsored By: NTT Multimedia Communications Labs MFC after: 1 week
* Update documentation to match the behaviour of ipfw with respectluigi2002-11-261-4/+6
| | | | | | | | to net.inet.ip.fw.one_pass. Add to notes to explain the exact behaviour of "prob xxx" and "log" options. Virtually approved by: re (mentioned in rev.1.19 of ip_fw2.c)
* Misc fixes from Chris Pepper, plus additional explainations onluigi2002-10-281-186/+183
| | | | | | dummynet operation. MFC after: 3 days
* Increase the max dummynet hash size from 1024 to 65536. Default is stillseanc2002-10-121-1/+1
| | | | | | | | | 1024. Silence on: -net, -ipfw 4weeks+ Reviewed by: dd Approved by: knu (mentor) MFC after: 3 weeks
* o Fix a typo.maxim2002-09-221-3/+3
| | | | | | | | o Remove EOL spaces. Submitted by: Harold Gutch <logix@foobar.franken.de> (typo patch) Approved by: luigi MFC after: 3 days
* Typo: s/o packet/on packet/blackend2002-09-081-1/+1
| | | | | PR: docs/42543 Submitted by: Michael Lyngbøl <lyngbol@bifrost.lyngbol.dk>
* s/filesystem/file system/g as discussed on -developerstrhodes2002-08-211-1/+1
|
* Whoops, the manpage lied... ipfw2 has always accepted addr:maskluigi2002-08-211-11/+14
| | | | specifications.
* One more (hopefully the last one) step in cleaning up the syntax,luigi2002-08-191-55/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | following Julian's good suggestion: since you can specify any match pattern as an option, rules now have the following format: [<proto> from <src> to <dst>] [options] i.e. the first part is now entirely optional (and left there just for compatibility with ipfw1 rulesets). Add a "-c" flag to show/list rules in the compact form (i.e. without the "ip from any to any" part) when possible. The default is to include it so that scripts processing ipfw's canonical output will still work. Note that as part of this cleanup (and to remove ambiguity), MAC fields now can only be specified in the options part. Update the manpage to reflect the syntax. Clarify the behaviour when a match is attempted on fields which are not present in the packet, e.g. port numbers on non TCP/UDP packets, and the "not" operator is specified. E.g. ipfw add allow not src-port 80 will match also ICMP packets because they do not have port numbers, so "src-port 80" will fail and "not src-port 80" will succeed. For such cases it is advised to insert further options to prevent undesired results (e.g. in the case above, "ipfw add allow proto tcp not src-port 80"). We definitely need to rewrite the parser using lex and yacc!
* Major cleanup of the parser and printing routines in an attempt toluigi2002-08-191-75/+90
| | | | | | | | | | | | | | | | | | | render the syntax less ambiguous. Now rules can be in one of these two forms <action> <protocol> from <src> to <dst> [options] <action> MAC dst-mac src-mac mac-type [options] however you can now specify MAC and IP header fields as options e.g. ipfw add allow all from any to any mac-type arp ipfw add allow all from any to any { dst-ip me or src-ip me } which makes complex expressions a lot easier to write and parse. The "all from any to any" part is there just for backward compatibility. Manpage updated accordingly.
* Complete list of differences between ipfw1 and ipfw2.luigi2002-08-161-10/+93
|
* sys/netinet/ip_fw2.c:luigi2002-08-161-67/+370
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement the M_SKIP_FIREWALL bit in m_flags to avoid loops for firewall-generated packets (the constant has to go in sys/mbuf.h). Better comments on keepalive generation, and enforce dyn_rst_lifetime and dyn_fin_lifetime to be less than dyn_keepalive_period. Enforce limits (up to 64k) on the number of dynamic buckets, and retry allocation with smaller sizes. Raise default number of dynamic rules to 4096. Improved handling of set of rules -- now you can atomically enable/disable multiple sets, move rules from one set to another, and swap sets. sbin/ipfw/ipfw2.c: userland support for "noerror" pipe attribute. userland support for sets of rules. minor improvements on rule parsing and printing. sbin/ipfw/ipfw.8: more documentation on ipfw2 extensions, differences from ipfw1 (so we can use the same manpage for both), stateful rules, and some additional examples. Feedback and more examples needed here.
* Major revision of the ipfw manpage, trying to make it up-to-dateluigi2002-08-101-518/+682
| | | | | | | | | | | | | | | | | | | | with ipfw2 extensions and give examples of use of the new features. This is just a preliminary commit, where i simply added the basic syntax for the extensions, and clean up the page (e.g. by listing things in alphabetical rather than random order). I would appreciate feedback and possible corrections/extensions by interested parties. Still missing are a more detailed description of stateful rules (with keepalives), interaction with of stateful rules and natd (don't do that!), examples of use with the recently introduced rule sets. There is an issue related to the MFC: RELENG_4 still has ipfw as a default, and ipfw2 is optional. We have two options here: MFC this page as ipfw(8) adding a large number of "SORRY NOT IN IPFW" notes, or create a new ipfw2(8) manpage just for -stable users. I am all for the first approach, but of course am listening to your comments.
* Add SEE ALSO references to papers handling RED.sheldonh2002-07-251-0/+26
|
* The .Nm utilitycharnier2002-07-061-1/+2
|
* Enlighten those who read the FINE POINTS of the documentation a bitcjc2002-05-011-3/+14
| | | | | | | | | more on how ipfw(8) deals with tiny fragments. While we're at it, add a quick log message to even let people know we dropped a packet. (Note that the second FINE POINT is somewhat redundant given the first, but since the code is there, leave the docs for it.) MFC after: 1 day
* mdoc(7) police: tidy up the markup in revision 1.96.ru2002-01-101-5/+12
|
* o Note that packets diverted using a 'divert' socket, and thenrwatson2002-01-031-0/+9
| | | | | | | | reinserted by a userland process, will lose a number of packet attributes, including their source interface. This may affect the behavior of later rules, and while not strictly a BUG, may cause unexpected behavior if not clearly documented. A similar note for natd(8) might be desirable.
* Move the discussion of how many times a packet will pass throughyar2002-01-021-20/+18
| | | | | | | | ipfirewall(4) to the IMPLEMENTATION NOTES section because it considers kernel internals and may confuse newbies if placed at the very beginning of the manpage (where it used to be previously.) Not objected by: luigi
* Clarify the "show" ipfw(8) command.yar2002-01-021-2/+6
| | | | | PR: docs/31263 Permitted by: luigi
* Fix a typo: wierd -> weirdyar2002-01-021-1/+1
|
* Fix documentation to match realityjulian2001-12-281-7/+15
|
* Implement matching IP precedence in ipfw(4).yar2001-12-211-0/+3
| | | | Submitted by: Igor Timkin <ivt@gamma.ru>
* At least once mention the long names of WF2Q+ (Worst-case Fair Weightedrse2001-12-141-2/+2
| | | | | | Fair Queueing) and RED (Random Early Detection) to both give the reader a hint what they are and to make it easier to find out more information about them.
* Repair typo.dd2001-10-141-1/+1
| | | | | PR: 31262 Submitted by: <swear@blarg.net>
* mdoc(7) police: fix markup.ru2001-10-011-56/+27
|
* now that jlemon has added a hash table to lookup locally configured ipbillf2001-09-291-3/+2
| | | | | | | | addresses (and the macros that ipfw(4) use to lookup data for the 'me' keyword have been converted) remove a comment about using 'me' being a "computationally expensive" operation. while I'm here, change two instances of "IP number" to "IP address"
* Two main changes here:luigi2001-09-271-17/+41
| | | | | | | | | | | | | | | + implement "limit" rules, which permit to limit the number of sessions between certain host pairs (according to masks). These are a special type of stateful rules, which might be of interest in some cases. See the ipfw manpage for details. + merge the list pointers and ipfw rule descriptors in the kernel, so the code is smaller, faster and more readable. This patch basically consists in replacing "foo->rule->bar" with "rule->bar" all over the place. I have been willing to do this for ages! MFC after: 1 week
* mdoc(7) police:ru2001-08-071-22/+12
| | | | | | | Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text. Not only this slows down the mdoc(7) processing significantly, but it also has an undesired (in this case) effect of disabling hyphenation within the entire enclosed block.
* mdoc(7) police: removed HISTORY info from the .Os call.ru2001-07-101-1/+1
|
* mdoc(7) police: remove extraneous .Pp before and/or after .Sh.dd2001-07-091-1/+0
|
* Mention Alexandre Peixoto's share/examples/ipfw/change_rules.sh in thechris2001-06-061-0/+3
| | | | | | checklist. MFC after: 1 week
* Invert the meaning of the -d option (i.e. default to *not* list dynamic rules,des2001-06-041-4/+8
| | | | | | | | | | | | | | | but list them if -d was specified). Avoid listing expired dynamic rules unless the (new) -e option was specified. If specific rule numbers were listed on the command line, and the -d flag was specified, only list dynamic rules that match the specified rule numbers. Try to partly clean up the bleeding mess this file has become. If there is any justice in this world, the responsible parties (you know who you are!) should expect to wake up one morning with a horse's head in their bed. The code still looks like spaghetti, but at least now it's *properly intented* spaghetti (hmm? did somebody say "tagliatelle"?).
* Add a flag to "ipfw show" which supresses the display of dynamicdwmalone2001-05-201-1/+3
| | | | | | | | | | rules. Also, don't show dynamic rules if you only asked to see a certain rule number. PR: 18550 Submitted by: Lyndon Nerenberg <lyndon@orthanc.ab.ca> Approved by: luigi MFC after: 2 weeks
OpenPOWER on IntegriCloud