summaryrefslogtreecommitdiffstats
path: root/sbin/ipfw/ipfw.8
Commit message (Collapse)AuthorAgeFilesLines
* New ipfw option "antispoof":andre2004-08-091-2/+38
| | | | | | | | | | | | | | | For incoming packets, the packet's source address is checked if it belongs to a directly connected network. If the network is directly connected, then the interface the packet came on in is compared to the interface the network is connected to. When incoming interface and directly connected interface are not the same, the packet does not match. Usage example: ipfw add deny ip from any to any not antispoof in Manpage education by: ru
* Extend versrcreach by checking against the rt_flags for RTF_REJECT andandre2004-07-211-2/+2
| | | | | | | | | | | | | | | | | | RTF_BLACKHOLE as well. To quote the submitter: The uRPF loose-check implementation by the industry vendors, at least on Cisco and possibly Juniper, will fail the check if the route of the source address is pointed to Null0 (on Juniper, discard or reject route). What this means is, even if uRPF Loose-check finds the route, if the route is pointed to blackhole, uRPF loose-check must fail. This allows people to utilize uRPF loose-check mode as a pseudo-packet-firewall without using any manual filtering configuration -- one can simply inject a IGP or BGP prefix with next-hop set to a static route that directs to null/discard facility. This results in uRPF Loose-check failing on all packets with source addresses that are within the range of the nullroute. Submitted by: James Jun <james@towardex.com>
* Mechanically kill hard sentence breaks.ru2004-07-021-38/+56
|
* Introduce a new feature to IPFW2: lookup tables. These are usefulru2004-06-091-2/+61
| | | | | | | for handling large sparse address sets. Initial implementation by Vsevolod Lobko <seva@ip.net.ua>, refined by me. MFC after: 1 week
* o Fix usage example.maxim2004-05-231-1/+1
| | | | | PR: docs/67065 Submitted by: David Syphers
* Add the option versrcreach to verify that a valid route to theandre2004-04-231-1/+17
| | | | | | | | | | | | | | | | | | | | source address of a packet exists in the routing table. The default route is ignored because it would match everything and render the check pointless. This option is very useful for routers with a complete view of the Internet (BGP) in the routing table to reject packets with spoofed or unrouteable source addresses. Example: ipfw add 1000 deny ip from any to any not versrcreach also known in Cisco-speak as: ip verify unicast source reachable-via any Reviewed by: luigi
* Backout revision 1.140; it seems that the previous version is clearceri2004-03-271-2/+1
| | | | | | enough. Requested by: ru
* o The lenght of the port list is limited to 30 entries in ipfw2 not to 15.maxim2004-03-261-1/+1
| | | | | | PR: docs/64534 Submitted by: Dmitry Cherkasov MFC after: 1 week
* Clarify the description of the "established" option.ceri2004-03-221-1/+2
| | | | | | PR: docs/50391 Submitted by: root@edcsm.jussieu.fr MFC after: 1 week
* grammarmtm2004-01-231-6/+6
|
* o -c (compact) flag is ipfw2 feature.maxim2004-01-151-0/+2
| | | | | PR: bin/56328 MFC after: 3 days
* o -f (force) in conjunction with -p (preprocessor) is ipfw2 feature.maxim2004-01-151-0/+3
| | | | MFC after: 3 days
* o Legitimate -f (force) flags for -p (preprocessor) case.maxim2003-12-241-1/+1
| | | | | | PR: bin/60433 Submitted: Bjoern A. Zeeb MFC after: 3 weeks
* Add a -b flag to /sbin/ipfw to print only action and comment for eachluigi2003-12-121-0/+4
| | | | | | | | rule, thus omitting the entire body. This makes the output a lot more readable for complex rulesets (provided, of course, you have annotated your ruleset appropriately!) MFC after: 3 days
* Include opt_ipsec.h so IPSEC/FAST_IPSEC is defined and the appropriatesam2003-12-021-1/+8
| | | | | | | | | | | | code is compiled in to support the O_IPSEC operator. Previously no support was included and ipsec rules were always matching. Note that we do not return an error when an ipsec rule is added and the kernel does not have IPsec support compiled in; this is done intentionally but we may want to revisit this (document this in the man page). PR: 58899 Submitted by: Bjoern A. Zeeb Approved by: re (rwatson)
* fix typo: s/sytem/system/rse2003-09-261-1/+1
|
* Document the alternate way of matching MAC addresses: by a bitmask.roam2003-09-101-2/+22
| | | | | | PR: 56021 Submitted by: Glen Gibb <grg@ridley.unimelb.edu.au> MFC after: 1 month
* Add a note that net.inet.ip.fw.autoinc_step is ipfw2-specificluigi2003-07-221-0/+4
|
* Userland side of:luigi2003-07-151-5/+13
| | | | | | | | | | | | | | Allow set 31 to be used for rules other than 65535. Set 31 is still special because rules belonging to it are not deleted by the "ipfw flush" command, but must be deleted explicitly with "ipfw delete set 31" or by individual rule numbers. This implement a flexible form of "persistent rules" which you might want to have available even after an "ipfw flush". Note that this change does not violate POLA, because you could not use set 31 in a ruleset before this change. Suggested by: Paul Richards
* Add a '-T' flag to print the timestamp as numeric value insteadluigi2003-07-121-3/+6
| | | | | | | of converting it with ctime(). This is a lot more convenient for postprocessing. Submitted by: "Jacob S. Barrett" <jbarrett@amduat.net>
* Document the existence of comments in ipfw rules,luigi2003-07-121-4/+11
| | | | | | | the new flags handled when reading from a file, and clarify that only numeric values are allowed for icmptypes. MFC after: 3 days
* Correct to match reality regarding interface names.dannyboy2003-07-081-3/+7
| | | | | | | PR: 51006 Submitted by: "Dmitry Pryanishnikov" <dmitry@atlantis.dp.ua> mdoc clue by: "Simon L. Nielsen" <simon@nitro.dk> MFC after: 10 days
* * introduce a section on SYNTAX to document the handlingluigi2003-07-081-44/+77
| | | | | | | | | | | | | | spaces and comma-separated lists of arguments; * reword the description of address specifications, to include previous and current changes for address sets and lists; * document the new '-n' flag. * update the section on differences between ipfw1 and ipfw2 (this is becoming boring!) MFC after: 3 days
* Implement the 'ipsec' option to match packets coming out of an ipsec tunnel.luigi2003-07-041-0/+12
| | | | | | | | | Should work with both regular and fast ipsec (mutually exclusive). See manpage for more details. Submitted by: Ari Suutari (ari.suutari@syncrontech.com) Revised by: sam MFC after: 1 week
* o Fix sets of rules usage example.maxim2003-06-231-4/+4
| | | | | | PR: docs/53625 Submitted by: Kostyuk Oleg <cub@cub.org.ua> MFC after: 1 week
* Add support for multiple values and ranges for the "iplen", "ipttl",luigi2003-06-221-18/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | "ipid" options. This feature has been requested by several users. On passing, fix some minor bugs in the parser. This change is fully backward compatible so if you have an old /sbin/ipfw and a new kernel you are not in trouble (but you need to update /sbin/ipfw if you want to use the new features). Document the changes in the manpage. Now you can write things like ipfw add skipto 1000 iplen 0-500 which some people were asking to give preferential treatment to short packets. The 'MFC after' is just set as a reminder, because I still need to merge the Alpha/Sparc64 fixes for ipfw2 (which unfortunately change the size of certain kernel structures; not that it matters a lot since ipfw2 is entirely optional and not the default...) PR: bin/48015 MFC after: 1 week
* Add a 'verrevpath' option that verifies the interface that a packetcjc2003-03-151-0/+28
| | | | | | | | | comes in on is the same interface that we would route out of to get to the packet's source address. Essentially automates an anti-spoofing check using the information in the routing table. Experimental. The usage and rule format for the feature may still be subject to change.
* /modules is gone long ago, use the safe equivalents.ru2003-03-031-2/+2
|
* Correct examples for stateful inspectionbrueffer2003-02-041-2/+2
| | | | | | PR: 47817 Submitted by: Simon L.Nielsen <simon@nitro.dk> Reviewed by: ceri, luigi
* It turns out that we do not need to add a new ioctl to unbreak adillon2003-01-121-0/+16
| | | | | | | | | | | | | default-to-deny firewall. Simply turning off IPFW via a preexisting sysctl does the job. To make it more apparent (since nobody picked up on this in a week's worth of flames), the boolean sysctl's have been integrated into the /sbin/ipfw command set in an obvious and straightforward manner. For example, you can now do 'ipfw disable firewall' or 'ipfw enable firewall'. This is far easier to remember then the net.inet.ip.fw.enable sysctl. Reviewed by: imp MFC after: 3 days
* Fix a reference to the order of SYNOPSIS lines.keramida2003-01-051-1/+1
| | | | | | Submitted by: Olivier Cherrier <Olivier.Cherrier@cediti.be> on freebsd-net MFC after: 3 days
* Make preprocessor support more generic by passing all command-line optionskbyanc2002-12-231-8/+4
| | | | | | | | | | after -p except for the last (the ruleset file to process) to the preprocessor for interpretation. This allows command-line options besides -U and -D to be passed to cpp(1) and m4(1) as well as making it easier to use other preprocessors. Sponsored By: NTT Multimedia Communications Labs MFC after: 1 week
* Update documentation to match the behaviour of ipfw with respectluigi2002-11-261-4/+6
| | | | | | | | to net.inet.ip.fw.one_pass. Add to notes to explain the exact behaviour of "prob xxx" and "log" options. Virtually approved by: re (mentioned in rev.1.19 of ip_fw2.c)
* Misc fixes from Chris Pepper, plus additional explainations onluigi2002-10-281-186/+183
| | | | | | dummynet operation. MFC after: 3 days
* Increase the max dummynet hash size from 1024 to 65536. Default is stillseanc2002-10-121-1/+1
| | | | | | | | | 1024. Silence on: -net, -ipfw 4weeks+ Reviewed by: dd Approved by: knu (mentor) MFC after: 3 weeks
* o Fix a typo.maxim2002-09-221-3/+3
| | | | | | | | o Remove EOL spaces. Submitted by: Harold Gutch <logix@foobar.franken.de> (typo patch) Approved by: luigi MFC after: 3 days
* Typo: s/o packet/on packet/blackend2002-09-081-1/+1
| | | | | PR: docs/42543 Submitted by: Michael Lyngbøl <lyngbol@bifrost.lyngbol.dk>
* s/filesystem/file system/g as discussed on -developerstrhodes2002-08-211-1/+1
|
* Whoops, the manpage lied... ipfw2 has always accepted addr:maskluigi2002-08-211-11/+14
| | | | specifications.
* One more (hopefully the last one) step in cleaning up the syntax,luigi2002-08-191-55/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | following Julian's good suggestion: since you can specify any match pattern as an option, rules now have the following format: [<proto> from <src> to <dst>] [options] i.e. the first part is now entirely optional (and left there just for compatibility with ipfw1 rulesets). Add a "-c" flag to show/list rules in the compact form (i.e. without the "ip from any to any" part) when possible. The default is to include it so that scripts processing ipfw's canonical output will still work. Note that as part of this cleanup (and to remove ambiguity), MAC fields now can only be specified in the options part. Update the manpage to reflect the syntax. Clarify the behaviour when a match is attempted on fields which are not present in the packet, e.g. port numbers on non TCP/UDP packets, and the "not" operator is specified. E.g. ipfw add allow not src-port 80 will match also ICMP packets because they do not have port numbers, so "src-port 80" will fail and "not src-port 80" will succeed. For such cases it is advised to insert further options to prevent undesired results (e.g. in the case above, "ipfw add allow proto tcp not src-port 80"). We definitely need to rewrite the parser using lex and yacc!
* Major cleanup of the parser and printing routines in an attempt toluigi2002-08-191-75/+90
| | | | | | | | | | | | | | | | | | | render the syntax less ambiguous. Now rules can be in one of these two forms <action> <protocol> from <src> to <dst> [options] <action> MAC dst-mac src-mac mac-type [options] however you can now specify MAC and IP header fields as options e.g. ipfw add allow all from any to any mac-type arp ipfw add allow all from any to any { dst-ip me or src-ip me } which makes complex expressions a lot easier to write and parse. The "all from any to any" part is there just for backward compatibility. Manpage updated accordingly.
* Complete list of differences between ipfw1 and ipfw2.luigi2002-08-161-10/+93
|
* sys/netinet/ip_fw2.c:luigi2002-08-161-67/+370
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Implement the M_SKIP_FIREWALL bit in m_flags to avoid loops for firewall-generated packets (the constant has to go in sys/mbuf.h). Better comments on keepalive generation, and enforce dyn_rst_lifetime and dyn_fin_lifetime to be less than dyn_keepalive_period. Enforce limits (up to 64k) on the number of dynamic buckets, and retry allocation with smaller sizes. Raise default number of dynamic rules to 4096. Improved handling of set of rules -- now you can atomically enable/disable multiple sets, move rules from one set to another, and swap sets. sbin/ipfw/ipfw2.c: userland support for "noerror" pipe attribute. userland support for sets of rules. minor improvements on rule parsing and printing. sbin/ipfw/ipfw.8: more documentation on ipfw2 extensions, differences from ipfw1 (so we can use the same manpage for both), stateful rules, and some additional examples. Feedback and more examples needed here.
* Major revision of the ipfw manpage, trying to make it up-to-dateluigi2002-08-101-518/+682
| | | | | | | | | | | | | | | | | | | | with ipfw2 extensions and give examples of use of the new features. This is just a preliminary commit, where i simply added the basic syntax for the extensions, and clean up the page (e.g. by listing things in alphabetical rather than random order). I would appreciate feedback and possible corrections/extensions by interested parties. Still missing are a more detailed description of stateful rules (with keepalives), interaction with of stateful rules and natd (don't do that!), examples of use with the recently introduced rule sets. There is an issue related to the MFC: RELENG_4 still has ipfw as a default, and ipfw2 is optional. We have two options here: MFC this page as ipfw(8) adding a large number of "SORRY NOT IN IPFW" notes, or create a new ipfw2(8) manpage just for -stable users. I am all for the first approach, but of course am listening to your comments.
* Add SEE ALSO references to papers handling RED.sheldonh2002-07-251-0/+26
|
* The .Nm utilitycharnier2002-07-061-1/+2
|
* Enlighten those who read the FINE POINTS of the documentation a bitcjc2002-05-011-3/+14
| | | | | | | | | more on how ipfw(8) deals with tiny fragments. While we're at it, add a quick log message to even let people know we dropped a packet. (Note that the second FINE POINT is somewhat redundant given the first, but since the code is there, leave the docs for it.) MFC after: 1 day
* mdoc(7) police: tidy up the markup in revision 1.96.ru2002-01-101-5/+12
|
* o Note that packets diverted using a 'divert' socket, and thenrwatson2002-01-031-0/+9
| | | | | | | | reinserted by a userland process, will lose a number of packet attributes, including their source interface. This may affect the behavior of later rules, and while not strictly a BUG, may cause unexpected behavior if not clearly documented. A similar note for natd(8) might be desirable.
* Move the discussion of how many times a packet will pass throughyar2002-01-021-20/+18
| | | | | | | | ipfirewall(4) to the IMPLEMENTATION NOTES section because it considers kernel internals and may confuse newbies if placed at the very beginning of the manpage (where it used to be previously.) Not objected by: luigi
OpenPOWER on IntegriCloud