Recognize BSD firewalls and rulesets

Reviewer: Cezary Morga cm@therek.net FreeBSD

Reviewer: name contact BSD flavour

Concept

Each BSD comes with at least one built-in firewall. Recognize which firewalls are available on each BSD and which commands are used to view each firewall's ruleset.

Introduction

Each BSD comes with at least one built-in firewall. NetBSD provides IP Filter (IPF) and PF (from OpenBSD). FreeBSD has its own IPFW, IP Filter, and PF. OpenBSD includes is own PF. And DragonFly has IPFW, IP Filter, and PF.

IP Filter (IPF)

(((ipf)))(((ipfilter)))(((IP Filter))) IP Filter is a featureful, stateful, advanced packet filter, address translation(((network address translation))) (NAT)(((NAT)))), and proxy(((proxy))) software developed by Darren Reed. It is available for Solaris(((Solaris))), DragonFly, FreeBSD, NetBSD, HP-UX(((HP-UX))), and some other operating systems.

TODO: show one or two examples how to detect if it is available and if it is enabled TODO: point to default startup script for enabling (and mention issues with that) TODO: point to location of default configurations TODO: point to included documentation and examples TODO: show how to view loaded ruleset TODO: show a very brief example (three rules/lines) and use same functionality for all three firewalls here

IPFW

(((ipfw))) (((IPFW))) IPFW is an IP firewall and traffic shaper developed by FreeBSD. It is also available for DragonFly. (A derivative of IPFW is available on Mac OS X(((Mac OS X))).) Network address translation is handled in the userland by the natd daemon. The ipfw tool can be used to control and configure the firewall and also to configure the dummynet(((dummynet))) system which is used for bandwidth limits, queueing, and simulating losses and delays.

PF

(((pf))) pf - packet filter first appeared in OpenBSD 3.0, since then it has been imported into FreeBSD, NetBSD and DragonFlyBSD. The packet filtering takes place in the kernel. A pseudo device /dev/pf allows userland processes to control the packet filter. Communication with the pf is usally achieved using pfctl(((pfctl))). The default configuaration is stored in pf.conf(((pf.conf))).

pfctl -sr show rules

TODO: show a very brief example (three rules/lines) and use same functionality for all three firewalls here

Practice Exercises

More information

ipfw(8), ipf(8), ipfstat(8), pf(4), pfctl(8) and firewall(7)