table of contents
other sections
IPFW(4) | Device Drivers Manual | IPFW(4) |
NAME¶
ipfw
—
IP packet filter and traffic accounting
SYNOPSIS¶
To compile the driver into the kernel, place the following option in the kernel configuration file:options
IPFIREWALL
options
IPFIREWALL_DEFAULT_TO_ACCEPT
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100
ipfw_load="YES"
DESCRIPTION¶
Theipfw
system facility allows filtering,
redirecting, and other operations on IP packets travelling through network
interfaces.
The default behavior of ipfw
is to block all
incoming and outgoing traffic. This behavior can be modified, to allow all
traffic through the ipfw
firewall by
default, by enabling the
IPFIREWALL_DEFAULT_TO_ACCEPT
kernel option.
This option may be useful when configuring
ipfw
for the first time. If the default
ipfw
behavior is to allow everything, it is
easier to cope with firewall-tuning mistakes which may accidentally block all
traffic.
To enable logging of packets passing through
ipfw
, enable the
IPFIREWALL_VERBOSE
kernel option. The
IPFIREWALL_VERBOSE_LIMIT
option will
prevent syslogd(8) from flooding system logs or
causing local Denial of Service. This option may be set to the number of
packets which will be logged on a per-entry basis before the entry is
rate-limited.
The user interface for ipfw
is implemented by
the ipfw(8) utility, so please refer to the
ipfw(8) manpage for a complete description of the
ipfw
capabilities and how to use it.
SEE ALSO¶
setsockopt(2), divert(4), ip(4), ipfw(8), sysctl(8), syslogd(8), pfil(9)October 25, 2012 | Debian |