Re: Converting from IPFW to IPFILTER

From: Aaron Peterson (dopplecoder_at_gmail.com)
Date: 10/10/05

  • Next message: Gerard Seibert: "Re[2]: What's a good MySQL utitlity?" 
    Date: Mon, 10 Oct 2005 11:27:23 -0400
To: "Brian E. Conklin" <bconklin@masongeneral.com>

    On 10/10/05, Brian E. Conklin <bconklin@masongeneral.com> wrote:
    >
    > So I am assuming because IPFW is built into the kernel with a "default to
    > deny" option, I will need an IPFW rule allowing everything? Or, can I change
    > my rc.conf to have IPFIREWALL_ENABLE="NO"?
    >

    IPFW can be compiled static into the kernel, or it can be loaded as a
    module. My understanding is that when loading as a module, default
    deny is your only option. If you compile into the kernel with
    "options IPFFIREWALL_DEFAULT_TO_ACCEPT" then you get the obvious
    results. This is all in the handbook by the way:

    http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipfw.html

    Aaron
    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: Gerard Seibert: "Re[2]: What's a good MySQL utitlity?"

    Relevant Pages

    • Re: FreeBSD Gateway problems
      ... >speed connection for 3 years now, and I've just gotten it back. ... >Well all these other How-Tos I found on FreeBSDDiary.org told me all I needed ... To use ipfw adding these options to your kernel is a good place to start: ...
      (freebsd-questions)
    • ipfw
      ... If I do ipfw -f flush I still have rule 65535 deny ip from any to any ... to my kernel and recompiled ...
      (FreeBSD-Security)
    • Re: natd -redirect_port
      ... > into the kernel. ... > IPFW is delivered as an bootable module. ... > You need this in rc.conf to enable ipfw, ...
      (freebsd-questions)
    • Firewall and nmap
      ... I'm compiled a Kernel using the GENERIC config-file that ... So I flushed all rools for the firewall with ipfw flush (the still ... my kernel, ipfw -c list told me that this is true.) ... Anyway, nothing changes, all ports seem to be closed running nmap, ...
      (freebsd-questions)
    • Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility)
      ... For simple using, however, you don't need to bother all that details - just remember magic number and where to place it, and it is now simple for use with ipfw tags. ... Currently the only analyzing node in FreeBSD src tree is ng_bpf, but it merely splits incoming packets in two streams, matched and not. ... There are reasons to this, as netgraph needs to be modular, and each node does a small thing, but does it well. ... For long time ng_bpf was used for another purposes in the kernel, and now, as new ipfw features appeared, ng_tag came up for easy integration. ...
      (freebsd-current)