## Recognize BSD firewalls and rulesets ##

[Author](authors.html): _name_ _[[contact]]_ _[[BSD_flavour]]_

[Reviewer](technical_reviewers.html): Cezary Morga cm@therek.net FreeBSD

[Reviewer](technical_reviewers.html): _name_ _[[contact]]_ _[[BSD_flavour]]_

----

### Concept ###

Each BSD comes with at least one built-in firewall.
Recognize which firewalls are available on each BSD and which
commands are used to view each firewall's ruleset.

### Introduction ###

Each BSD comes with at least one built-in firewall.
NetBSD provides IP Filter (IPF) and PF (from OpenBSD). 
FreeBSD has its own IPFW, IP Filter, and PF. OpenBSD includes is own PF.
And DragonFly has IPFW, IP Filter, and PF.

<!-- NOTE: do not go into too much detail. Keep it brief. We aren't teaching packet filtering
 but just helping a beginning admin know where to get started and where to find help.
 And the BSDA does not cover custom kernels. -->

### IP Filter (IPF) ###
(((ipf)))(((ipfilter)))(((IP Filter)))
IP Filter is a featureful, stateful, advanced packet filter, address
translation(((network address translation)))
(NAT)(((NAT)))), and proxy(((proxy))) software developed by Darren Reed.
It is available for Solaris(((Solaris))), DragonFly, FreeBSD, NetBSD, HP-UX(((HP-UX))), and some other operating systems.

TODO: show one or two examples how to detect if it is available and if it is enabled
TODO: point to default startup script for enabling (and mention issues with that)
TODO: point to location of default configurations
TODO: point to included documentation and examples
TODO: show how to view loaded ruleset
TODO: show a very brief example (three rules/lines) and use same functionality for all three firewalls here

### IPFW ###
(((ipfw))) (((IPFW)))
IPFW is an IP firewall and traffic shaper developed by FreeBSD.
It is also available for DragonFly.
(A derivative of IPFW is available on Mac OS X(((Mac OS X))).)
Network address translation is handled in the userland by the `natd` daemon.
The `ipfw` tool can be used to control and configure the firewall and also to 
configure the dummynet(((dummynet))) system which is used for bandwidth limits, queueing, and
simulating losses and delays.

TODO: show one or two examples how to detect if it is available and if it is enabled
TODO: point to default startup script for enabling (and mention issues with that)
TODO: point to location of default configurations
TODO: point to included documentation and examples
TODO: show how to view loaded ruleset
TODO: show a very brief example (three rules/lines) and use same functionality for all three firewalls here

### PF ###
(((pf)))
pf - packet filter first appeared in OpenBSD 3.0, since then it has been imported into FreeBSD, NetBSD and DragonFlyBSD.  The packet filtering takes place in the kernel.  A pseudo device /dev/pf allows userland processes to control the packet filter.
Communication with the pf is usally achieved using pfctl(((pfctl))).  The default configuaration is stored in pf.conf(((pf.conf))).


TODO: show one or two examples how to detect if it is available and if it is enabled
TODO: point to default startup script for enabling (and mention issues with that)
TODO: point to location of default configurations
TODO: point to included documentation and examples
TODO: show how to view loaded ruleset

**pfctl -sr**  show rules

TODO: show a very brief example (three rules/lines) and use same functionality for all three firewalls here

<!--
### Examples ###
-->

### Practice Exercises ###


### More information ###

ipfw(8), ipf(8), ipfstat(8), pf(4), pfctl(8) and firewall(7)


