fwb_ipf(1)

💖 fwb_ipf — the ipfilter policy compiler, bestie edition 💖

okay so real quick, the manual name is fwb_ipf and it lives in section 1 of the Firewall Builder manual, and yes she's iconic, she's from Firewall Builder, and she is here to make ipfilter configs for you. let's go 🦋

---

✨ NAME ✨

fwb_ipf — policy compiler for ipfilter, no cap 💅

---

🌸 SYNOPSIS 🌸

fwb_ipf [-vVx] [-d wdir] [-o output.fw] [-i] -f data_file.xml
object_name

like, that's the whole vibe. flags first, then the data file, then the firewall object's name at the end. slay.

---

💜 DESCRIPTION 💜

so fwb_ipf is a firewall policy compiler component of Firewall Builder (peep fwbuilder(1) if you wanna meet the whole family 🫶). This compiler generates code for ipfilter. She reads the objects definitions and the firewall description out of the data file you hand her with the -f option, and then she generates ipfilter configuration files and a firewall activation script. main character energy, honestly.

All the generated files have names that start with the name of the firewall object. The firewall activation script has the extension .fw and it's a simple shell script that flushes the current policy, loads the new filter and nat rules, and then activates ipfilter. The IPFilter configuration file name starts with the name of the firewall object, plus -ipf.conf. The NAT configuration file name also starts with the name of the firewall object, plus -nat.conf. For example, if the firewall object has the name myfirewall, then the compiler will create three files: myfirewall.fw, myfirewall-pf.conf, myfirewall-nat.conf. three whole files, one little name, we love efficiency ✨

The data file and the name of the firewall objects must be specified on the command line. Every other command line parameter is optional. yes bestie, those two are mandatory, the rest is just seasoning 🎀

---

💅 OPTIONS 💅

• -f FILE — Specify the name of the data file to be processed. this one's the required queen 👑
• -o output.fw — Specify output file name.
• -d wdir — Specify working directory. The compiler creates the firewall activation script and ipfilter configuration files in this directory. If this parameter is missing, then all files will be placed in the current working directory.
• -v — Be verbose: the compiler prints diagnostic messages when it works. she's a yapper, let her yap 🗣️
• -V — Print version number and quit.
• -i — When this option is present, the last argument on the command line is supposed to be the firewall object ID rather than its name. okay so IDs instead of names, noted 📝
• -x — Generate debugging information while working. This option is intended for debugging only and may produce lots of cryptic messages.

⚠️ heads up about -x: it's debugging only, and it may spit out lots of cryptic messages. don't be alarmed, she's just being thorough 💀

---

🧚 NOTES 🧚

Support for ipf returned in version 1.0.1 of Firewall Builder. she came BACK and she came back better 😭💖

Supported features: (aka the resume, and it's stacked)

• both ipf.conf and nat.conf files are generated
• negation in policy rules
• stateful inspection in an individual rule can be turned off in the rule options dialog. By default the compiler adds keep state or modulate state to each rule with action 'pass'
• the rule options dialog provides a choice of icmp or tcp rst replies for rules with action "Reject"
• the compiler adds the flag allow-opts if match on ip options is needed
• the compiler can generate rules matching on TCP flags
• the compiler can generate a script adding ip aliases for NAT rules using addresses that do not belong to any interface of the firewall
• the compiler always adds the rule block quick all at the very bottom of the script to ensure "block all by default" policy even if the policy is empty
• Address ranges in both policy and NAT

Features that are not supported (yet) — emphasis on yet, bestie, we're manifesting 🌈

• negation in NAT
• custom services

Features that won't be supported (at least not anytime soon) — rip bozo, not happening 🙈

• policy routing

---

🌐 URL 🌐

Firewall Builder home page is located at the following URL:

http://www.fwbuilder.org/

---

💀 BUGS 💀

Please report bugs using the bug tracking system on SourceForge:

http://sourceforge.net/tracker/?group_id=5314&atid=105314

(please actually report them, she can't fix what she doesn't know about 🥺)

---

🫶 SEE ALSO 🫶

fwbuilder(1), fwb_ipt(1), fwb_pf(1)

the whole friend group, go say hi 💜

---

okay that's the whole page!! this one came from FWB (that's the source, periodt) and it's page fwb_ipf(1), and the version vibes are straight outta Firewall Builder. hope this helped bestie, go compile something gorgeous ✨💖🎀🦋