NAME¶
ipfw
—
IP packet filter and traffic accounting
SYNOPSIS¶
To compile the driver into the kernel, place the following option in the kernel
configuration file:
options
IPFIREWALL
Other related kernel options which may also be useful are:
options
IPFIREWALL_DEFAULT_TO_ACCEPT
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100
To load the driver as a module at boot time, add the following line into the
loader.conf(5) file:
DESCRIPTION¶
The
ipfw
system facility allows filtering,
redirecting, and other operations on IP packets travelling through network
interfaces.
The default behavior of
ipfw
is to block all
incoming and outgoing traffic. This behavior can be modified, to allow all
traffic through the
ipfw
firewall by
default, by enabling the
IPFIREWALL_DEFAULT_TO_ACCEPT
kernel option.
This option may be useful when configuring
ipfw
for the first time. If the default
ipfw
behavior is to allow everything, it is
easier to cope with firewall-tuning mistakes which may accidentally block all
traffic.
To enable logging of packets passing through
ipfw
, enable the
IPFIREWALL_VERBOSE
kernel option. The
IPFIREWALL_VERBOSE_LIMIT
option will
prevent
syslogd(8) from flooding system logs or
causing local Denial of Service. This option may be set to the number of
packets which will be logged on a per-entry basis before the entry is
rate-limited.
The user interface for
ipfw
is implemented by
the
ipfw(8) utility, so please refer to the
ipfw(8) manpage for a complete description of the
ipfw
capabilities and how to use it.
SEE ALSO¶
setsockopt(2),
divert(4),
ip(4),
ipfw(8),
sysctl(8),
syslogd(8),
pfil(9)