LOOKUP TABLES
ipfw [set N] table name create create-options
ipfw [set N] table {name | all} destroy
ipfw [set N] table name modify modify-options
ipfw [set N] table name swap name
ipfw [set N] table name add table-key [value]
ipfw [set N] table name add [table-key value ...]
ipfw [set N] table name atomic add [table-key value ...]
ipfw [set N] table name delete [table-key ...]
ipfw [set N] table name lookup addr
ipfw [set N] table name lock
ipfw [set N] table name unlock
ipfw [set N] table {name | all} list
ipfw [set N] table {name | all} info
ipfw [set N] table {name | all} detail
ipfw [set N] table {name | all} flush
create-option: type table-type | valtype value-mask
| algo algo-desc | limit number | locked
type Table key type.
valtype Table value mask.
algo Table algorithm to use (see below).
limit Maximum number of items that may be inserted into table.
locked Restrict any table modifications.
Some of these options may be modified later via modify keyword. The
following options can be changed:
modify-options:
modify-option: limit number
limit Alter maximum number of items that may be inserted into table.
Additionally, table can be locked or unlocked using lock or unlock
commands.
Tables of the same type can be swapped with each other using swap name
command. Swap may fail if tables limits are set and data exchange would
result in limits hit. Operation is performed atomically.
One or more entries can be added to a table at once using add command.
Addition of all items are performed atomically. By default, error in
addition of one entry does not influence addition of other entries.
However, non-zero error code is returned in that case. Special atomic
keyword may be specified before add to indicate all-or-none add request.
One or more entries can be removed from a table at once using delete
command. By default, error in removal of one entry does not influence
removing of other entries. However, non-zero error code is returned in
that case.
It may be possible to check what entry will be found on particular
table-key using lookup table-key command. This functionality is optional
and may be unsupported in some algorithms.
The following operations can be performed on one or all tables:
list List all entries.
flush Removes all entries.
info Shows generic table information.
detail Shows generic table information and algo-specific data.
The following lookup algorithms are supported:
algo-desc: algo-name | algo-name algo-data
algo-name: addr:radix | addr:hash | iface:array
| number:array | flow:hash
addr:radix
Separate Radix trees for IPv4 and IPv6, the same way as the
routing table (see route(4)). Default choice for addr type.
addr:hash
Separate auto-growing hashes for IPv4 and IPv6. Accepts entries
with the same mask length specified initially via addr:hash
masks=/v4,/v6 algorithm creation options. Assume /32 and /128
masks by default. Search removes host bits (according to mask)
from supplied address and checks resulting key in appropriate
hash. Mostly optimized for /64 and byte-ranged IPv6 masks.
iface:array
Array storing sorted indexes for entries which are presented in
the system. Optimized for very fast lookup.
number:array
Array storing sorted u32 numbers.
flow:hash
Auto-growing hash storing flow entries. Search calculates hash
on required packet fields and searches for matching entries in
selected bucket.
The tablearg feature provides the ability to use a value, looked up in
the table, as the argument for a rule action, action parameter or rule
option. This can significantly reduce number of rules in some
configurations. If two tables are used in a rule, the result of the
second (destination) is used.
Each record may hold one or more values according to value-mask. This
mask is set on table creation via valtype option. The following value
types are supported:
value-mask: value-type[,value-mask]
value-type: skipto | pipe | fib | nat | dscp | tag |
divert | netgraph | limit | ipv4 | ipv6
skipto rule number to jump to.
pipe Pipe number to use.
fib fib number to match/set.
nat nat number to jump to.
dscp dscp value to match/set.
tag tag number to match/set.
divert port number to divert traffic to.
netgraph hook number to move packet to.
limit maximum number of connections.
ipv4 IPv4 nexthop to fwd packets to.
ipv6 IPv6 nexthop to fwd packets to.
The tablearg argument can be used with the following actions: nat, pipe,
queue, divert, tee, netgraph, ngtee, fwd, skipto, setfib, action
parameters: tag, untag, rule options: limit, tagged.
When used with the skipto action, the user should be aware that the code
will walk the ruleset up to a rule equal to, or past, the given number.
See the EXAMPLES Section for example usage of tables and the tablearg
keyword.
SETS OF RULES
Each rule or table belongs to one of 32 different sets , numbered 0 to
31. Set 31 is reserved for the default rule.
By default, rules or tables are put in set 0, unless you use the set N
attribute when adding a new rule or table. Sets can be individually and
atomically enabled or disabled, so this mechanism permits an easy way to
store multiple configurations of the firewall and quickly (and
atomically) switch between them.
By default, tables from set 0 are referenced when adding rule with table
opcodes regardless of rule set. This behavior can be changed by setting
net.inet.ip.fw.tables_sets variable to 1. Rule’s set will then be used
for table references.
The command to enable/disable sets is
ipfw set [disable number …] [enable number …]
where multiple enable or disable sections can be specified. Command
execution is atomic on all the sets specified in the command. By
default, all sets are enabled.
When you disable a set, its rules behave as if they do not exist in the
firewall configuration, with only one exception:
dynamic rules created from a rule before it had been disabled will
still be active until they expire. In order to delete dynamic
rules you have to explicitly delete the parent rule which generated
them.
The set number of rules can be changed with the command
ipfw set move {rule rule-number | old-set} to new-set
Also, you can atomically swap two rulesets with the command
ipfw set swap first-set second-set
EXAMPLES Section on some possible uses of sets of rules.
LOOKUP TABLES
In the following example, we need to create several traffic bandwidth
classes and we need different hosts/networks to fall into different
classes. We create one pipe for each class and configure them
accordingly. Then we create a single table and fill it with IP subnets
and addresses. For each subnet/host we set the argument equal to the
number of the pipe that it should use. Then we classify traffic using a
single rule:
ipfw pipe 1 config bw 1000Kbyte/s
ipfw pipe 4 config bw 4000Kbyte/s
…
ipfw table T1 create type addr
ipfw table T1 add 192.168.2.0/24 1
ipfw table T1 add 192.168.0.0/27 4
ipfw table T1 add 192.168.0.2 1
…
ipfw add pipe tablearg ip from ‘table(T1)’ to any
Using the fwd action, the table entries may include hostnames and IP
addresses.
ipfw table T2 create type addr ftype ip
ipfw table T2 add 192.168.2.0/24 10.23.2.1
ipfw table T21 add 192.168.0.0/27 router1.dmz
…
ipfw add 100 fwd tablearg ip from any to table(1)
In the following example per-interface firewall is created:
ipfw table IN create type iface valtype skipto,fib
ipfw table IN add vlan20 12000,12
ipfw table IN add vlan30 13000,13
ipfw table OUT create type iface valtype skipto
ipfw table OUT add vlan20 22000
ipfw table OUT add vlan30 23000
..
ipfw add 100 setfib tablearg ip from any to any recv ‘table(IN)’ in
ipfw add 200 skipto tablearg ip from any to any recv ‘table(IN)’ in
ipfw add 300 skipto tablearg ip from any to any xmit ‘table(OUT)’
out
The following example illustrate usage of flow tables:
ipfw table fl create type flow:src-ip,proto,dst-ip,dst-port
ipfw table fl add 2a02:6b8:77::88,tcp,2a02:6b8:77::99,80 11
ipfw table fl add 10.0.0.1,udp,10.0.0.2,53 12
..
ipfw add 100 allow ip from any to any flow ‘table(fl,11)’ recv ix0
SETS OF RULES
To add a set of rules atomically, e.g. set 18:
ipfw set disable 18
ipfw add NN set 18 … # repeat as needed
ipfw set enable 18
To delete a set of rules atomically the command is simply:
ipfw delete set 18
To test a ruleset and disable it and regain control if something goes
wrong:
ipfw set disable 18
ipfw add NN set 18 … # repeat as needed
ipfw set enable 18; echo done; sleep 30 && ipfw set disable 18
Here if everything goes well, you press control-C before the “sleep”
terminates, and your ruleset will be left active. Otherwise, e.g. if you
cannot access your box, the ruleset will be disabled after the sleep
terminates thus restoring the previous situation.
To show rules of the specific set:
ipfw set 18 show
To show rules of the disabled set:
ipfw -S set 18 show
To clear a specific rule counters of the specific set:
ipfw set 18 zero NN
To delete a specific rule of the specific set:
ipfw set 18 delete NN
Als beide Instrumente in meinen Händen lagen konnte ich nicht glauben welche Qualität und Klang ich für so wenig Geld bekommen hatte.
