- Changed <application>IPFW</application> to just IPFW since we're
talking about the kernel functionality and not the command itself. Instances of "IPFW" in the handbook will be references to the kernel functionality, and <application/command>ipfw</> will be in reference to the command itself. - Added note to inform readers that "^D" mean to use control-d, as well as "^C" mean control-c (wrapped in keycaps of course). Reviewed by: chern
This commit is contained in:
parent
ae158de562
commit
8e0a1ea3e8
Notes:
svn2git
2020-12-08 03:00:23 +00:00
svn path=/head/; revision=10693
1 changed files with 21 additions and 11 deletions
|
@ -1,7 +1,7 @@
|
||||||
<!--
|
<!--
|
||||||
The FreeBSD Documentation Project
|
The FreeBSD Documentation Project
|
||||||
|
|
||||||
$FreeBSD: doc/en_US.ISO8859-1/books/handbook/security/chapter.sgml,v 1.79 2001/09/12 21:51:14 logo Exp $
|
$FreeBSD: doc/en_US.ISO8859-1/books/handbook/security/chapter.sgml,v 1.80 2001/09/13 20:06:28 logo Exp $
|
||||||
-->
|
-->
|
||||||
|
|
||||||
<chapter id="security">
|
<chapter id="security">
|
||||||
|
@ -1798,7 +1798,7 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995</screen>
|
||||||
mechanisms.</para>
|
mechanisms.</para>
|
||||||
|
|
||||||
<para>FreeBSD comes with a kernel packet filter (known as
|
<para>FreeBSD comes with a kernel packet filter (known as
|
||||||
<application>ipfw</application>), which is what the rest of this
|
IPFW), which is what the rest of this
|
||||||
section will concentrate on. Proxy servers can be built on FreeBSD
|
section will concentrate on. Proxy servers can be built on FreeBSD
|
||||||
from third party software, but there is such a variety of proxy
|
from third party software, but there is such a variety of proxy
|
||||||
servers available that it would be impossible to cover them in this
|
servers available that it would be impossible to cover them in this
|
||||||
|
@ -1869,13 +1869,13 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995</screen>
|
||||||
<title>What Does IPFW Allow Me to Do?</title>
|
<title>What Does IPFW Allow Me to Do?</title>
|
||||||
<indexterm><primary><command>ipfw</command></primary></indexterm>
|
<indexterm><primary><command>ipfw</command></primary></indexterm>
|
||||||
|
|
||||||
<para><command>IPFW</command>, the software supplied with
|
<para>IPFW, the software supplied with
|
||||||
FreeBSD, is a packet filtering and accounting system which resides in
|
FreeBSD, is a packet filtering and accounting system which resides in
|
||||||
the kernel, and has a user-land control utility,
|
the kernel, and has a user-land control utility,
|
||||||
&man.ipfw.8;. Together, they allow you to define and query the
|
&man.ipfw.8;. Together, they allow you to define and query the
|
||||||
rules currently used by the kernel in its routing decisions.</para>
|
rules currently used by the kernel in its routing decisions.</para>
|
||||||
|
|
||||||
<para>There are two related parts to <application>IPFW</application>.
|
<para>There are two related parts to IPFW.
|
||||||
The firewall section allows you to perform packet filtering. There is
|
The firewall section allows you to perform packet filtering. There is
|
||||||
also an IP accounting section which allows you to track usage of your
|
also an IP accounting section which allows you to track usage of your
|
||||||
router, based on similar rules to the firewall section. This allows
|
router, based on similar rules to the firewall section. This allows
|
||||||
|
@ -1883,11 +1883,11 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995</screen>
|
||||||
a certain machine, or how much WWW (World Wide Web) traffic it is
|
a certain machine, or how much WWW (World Wide Web) traffic it is
|
||||||
forwarding.</para>
|
forwarding.</para>
|
||||||
|
|
||||||
<para>As a result of the way that <application>IPFW</application> is
|
<para>As a result of the way that IPFW is
|
||||||
designed, you can use <application>IPFW</application> on non-router
|
designed, you can use IPFW on non-router
|
||||||
machines to perform packet filtering on incoming and outgoing
|
machines to perform packet filtering on incoming and outgoing
|
||||||
connections. This is a special case of the more general use of
|
connections. This is a special case of the more general use of
|
||||||
<application>IPFW</application>, and the same commands and techniques
|
IPFW, and the same commands and techniques
|
||||||
should be used in this situation.</para>
|
should be used in this situation.</para>
|
||||||
</sect2>
|
</sect2>
|
||||||
|
|
||||||
|
@ -1898,7 +1898,7 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995</screen>
|
||||||
<secondary>enabling</secondary>
|
<secondary>enabling</secondary>
|
||||||
</indexterm>
|
</indexterm>
|
||||||
|
|
||||||
<para>As the main part of the <application>IPFW</application> system
|
<para>As the main part of the IPFW system
|
||||||
lives in the kernel, you will need to add one or more options to your
|
lives in the kernel, you will need to add one or more options to your
|
||||||
kernel configuration file, depending on what facilities you want, and
|
kernel configuration file, depending on what facilities you want, and
|
||||||
recompile your kernel. See <link linkend="kernelconfig">reconfiguring
|
recompile your kernel. See <link linkend="kernelconfig">reconfiguring
|
||||||
|
@ -1965,7 +1965,7 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995</screen>
|
||||||
<secondary>configuring</secondary>
|
<secondary>configuring</secondary>
|
||||||
</indexterm>
|
</indexterm>
|
||||||
|
|
||||||
<para>The configuration of the <application>IPFW</application> software
|
<para>The configuration of the IPFW software
|
||||||
is done through the &man.ipfw.8; utility. The syntax for this
|
is done through the &man.ipfw.8; utility. The syntax for this
|
||||||
command looks quite complicated, but it is relatively simple once you
|
command looks quite complicated, but it is relatively simple once you
|
||||||
understand its structure.</para>
|
understand its structure.</para>
|
||||||
|
@ -2031,7 +2031,7 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995</screen>
|
||||||
</varlistentry>
|
</varlistentry>
|
||||||
</variablelist>
|
</variablelist>
|
||||||
|
|
||||||
<para>Previous versions of <application>IPFW</application> used
|
<para>Previous versions of IPFW used
|
||||||
separate firewall and accounting entries. The present version
|
separate firewall and accounting entries. The present version
|
||||||
provides packet accounting with each firewall entry.</para>
|
provides packet accounting with each firewall entry.</para>
|
||||||
|
|
||||||
|
@ -2366,7 +2366,7 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995</screen>
|
||||||
</sect2>
|
</sect2>
|
||||||
|
|
||||||
<sect2>
|
<sect2>
|
||||||
<title>Example Commands for ipfw</title>
|
<title>Example Commands for <application>ipfw</application></title>
|
||||||
|
|
||||||
<para>This command will deny all packets from the host <hostid
|
<para>This command will deny all packets from the host <hostid
|
||||||
role="fqdn">evil.crackers.org</hostid> to the telnet port of the
|
role="fqdn">evil.crackers.org</hostid> to the telnet port of the
|
||||||
|
@ -2565,6 +2565,16 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995</screen>
|
||||||
<secondary>IPsec</secondary>
|
<secondary>IPsec</secondary>
|
||||||
</indexterm>
|
</indexterm>
|
||||||
|
|
||||||
|
<note>
|
||||||
|
<title>Terminating Characters</title>
|
||||||
|
<para>Throughout examples in this section, and other sections,
|
||||||
|
you will notice that there is a <quote>^D</quote> at the end
|
||||||
|
of some examples. This means to hold down the <keycap>Control</keycap>
|
||||||
|
key and hit the <keycap>D</keycap> key. Another commonly used
|
||||||
|
character is <quote>^C</quote>, which respectively means to hold
|
||||||
|
down <keycap>Control</keycap> and press <keycap>C</keycap>.</para>
|
||||||
|
</note>
|
||||||
|
|
||||||
<para>The IPsec mechanism provides secure communication for IP
|
<para>The IPsec mechanism provides secure communication for IP
|
||||||
layer and socket layer communication. This section should
|
layer and socket layer communication. This section should
|
||||||
explain how to use them. For implementation details, please
|
explain how to use them. For implementation details, please
|
||||||
|
|
Loading…
Reference in a new issue