ipfw(1)

NAME
gatekeeper.cf - gatekeeper filter configuration rules.

SYNOPSIS
/etc/gatekeeper.cf

DESCRIPTION
The gatekeeper.cf file contains firewall rules that permit or deny traffic into an out of the network that a gatekeeper firewall is protecting. It is read when gatekeeper starts up, and whenever a HUP signal is sent to the running gatekeeper.

The firewall rules are in the form:

[how] action [local-host] [port] direction remote-host [flag flag]

and are examined from top to bottom (so you can set a default rule as the last rule in the file and have packets caught by it.)

how (hard|soft)
    Is whether to do the firewalling in the kernel packet filter (hard) or in the gatekeeper daemon itself (soft). The default is to do soft firewalling.

action (accept|deny)
    Whether to accept or deny packets that match this rule.

local-subnet
    The local subnet that the rule applies to (defaults to all local machines.)

port
    The destination port that the rule applies to.

direction (in|out)
    This rule applies to traffic coming into the protected network or out from the protected network.

remote-host
    The host on the public net.

flag flag
    Additional flags (from struct ip_fw) used in this rule.

Hostnames are of the form

host name
    A hostname (1 or more addresses)

host address
    A host by ip address

net network
    A network, in one of three forms: network/netmask, network/cidr-width, or a classed-network-fragment. The first two are (hopefully) self-explanatory, the latter is the number of octets it takes to describe the class A,B, or C network in question, like 10. for 10.0.0.0.

Ports are of the form

proto/port
    A port or list of ports with the given protocol.

number
    A single port

number-number.
    A range of ports (you may only give one range of ports per rule.)

You may give up to 10 total ports per firewall rule, separated by commas. A range of ports, however, only counts as two ports for this. There are a pair of special ports that you can use by themself; ping blocks icmp packets on port 8, and traceroute blocks udp packets on port 12.

EXAMPLES

If you want to block some of the kookier mainstream liberal and conservative websites, except to the CEO's machine (located, conveniently, at 10.0.0.5)
    hard block tcp/www to www.freerepublic.com
    hard block tcp/www to www.bartcop.com
    hard allow host 10.0.0.5 tcp/www to www.mediawhoresonline.com
    hard block tcp/www to www.mediawhoresonline.com
    hard block tcp/www to www.drudgereport.com

If you also don't want to be pinged or tracerouted except to your webserver, add this to the gatekeeper.cf
    hard allow host website.address ping from all
    hard block ping from all
    hard allow host website.address traceroute from all
    hard block traceroute from all

Finally, if you want to block all incoming traffic to a machine that the hackers have been beating on, but you want to drive them nuts in the process, do:
    hard allow host machine tcp from all
    soft block host machine tcp from all
This tells the kernel packet filter to pass all tcp packets into this machine, so they can be caught and rejected by gatekeeper. This means that the hacker will see the connection establish, only to vanish before they can actually do anything about it. It's intensely gratifying, particularly when the local secret police have already asked for your assistance in beating up on the hackers.

BUGS
The rule language doesn't support masquerading, accounting, or explicit local hosts. You need to use ipfwadm(8) for that.

AUTHOR
David Parsons <orc@pell.chi.il.us>

SEE ALSO
gatekeeper(8), ipfwadm(8), ipfw(1), fwlint(1).