ipfw(1)

NAME
ipfw - manipulate firewall rules.

SYNOPSIS
ipfw [ -nv ] [ -f config-file ] command ...

DESCRIPTION
ipfw Manipulates the kernel firewalling rules. With ipfw, you can manipulate the same sorts of rules that gatekeeper uses for its firewalling.

ipfw knows the following commands:

list [filter]
    Lists the current firewall rules for the filters. If you only want to see the input or output filters, specify it on the command line.

clear,flush [filter]
    flushes all the firewall rules.

insert [rule]
    Reads firewall rules from stdin and inserts them at the start of the appropriate filters.

append,add [rule]
    Reads firewall rules from stdin and appends them to the end of the appropriate filters.

delete [rule]
    Deletes firewall rules.

allow,deny rest-of-rule
    Adds an allow or deny rule to the firewall.

There are very few options for ipfw;

-n  Don't attempt to resolve ip addresses.

-v  Increase debugging output

-ffilename
    Read firewall rules, if needed, from filename instead of from standard input.

FILTERING COMMANDS
ipfw does not know about all the packet filtering that a Linux kernel can do; it only understands the subset that gatekeeper knows. The rules are more fully described in gatekeeper.cf(5), but a quick description is:

    HARD ACTION OPT-PORT DIRECTION SYSTEM

HARD
    gatekeeper does kernel packet filtering on hard firewall rules; soft filtering otherwise. Since ipfw uses the exact same command parser as gatekeeper, you need to specify this keyword to get to the kernel packet filters UNLESS You're giving the rule on the command line, when it will be implied.

ACTION
    Either allow or deny to allow or deny matching packets.

OPT-PORT
    Is the port you wish to block or allow, if any. The port can be a port number, range of ports or named protocol, optionally prefixed with a tcp/, udp/, or icmp/ to manipulate packets for that protocol (default is tcp). DIRECTION Is in to manipulate the input filter, and out to manipulate the output filter.

SYSTEM
    can be a system name, IP address, network address with an explicit netmask (AA.BB.CC.DD/MM.MM.MM.MM), or an network address with a CIDR network width (AA.BB.CC.DD/WW).

For example,

    ipfw deny all from 10.0.0.0/8

blocks all incoming tcp traffic from hosts in the 10. network, while

    ipfw allow all from pell.portland.or.us

allows all tcp traffic from the machine pell.portland.or.us.

BUGS
The description of the rule language may be out of date. Look at gatekeeper.cf(5) for a more up-to-date description.

The rule language doesn't support masquerading, accounting, or explicit local hosts. You need to use ipfwadm(8) for that.

This manpage isn't the greatest bit of writing ever done.

AUTHOR
David Parsons <orc@pell.chi.il.us>

SEE ALSO
ipfwadm(8), gatekeeper.cf(5), fwlint(1).