IPFW(4)

📦 version 15.1, in freebsd 14.5, freebsd 15.1, nixpkgs unstable

💅 ipfw(4) — bestie edition

okay so first things first: this is the manual page for ipfw(4) (that's section 4, the kernel interfaces girlies, iykyk 🧚). It's the kernel-side lore for the ipfw system facility — the whole filter/redirect machine — and the actual day-to-day how-to lives over in ipfw(8). We'll get there. Stay with me. 🫶

✨ NAME ✨

ipfw — IP packet filter and traffic accounting. That's it. That's the vibe. 💖

🌸 SYNOPSIS 🌸

So you wanna compile this driver into the kernel? Bestie, you gotta place this option in the kernel configuration file first:

options IPFIREWALL

And like… there are other related kernel options that may also be useful (highkey worth knowing about):

options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPDIVERT
options IPFIREWALL_NAT
options IPFIREWALL_NAT64
options IPFIREWALL_NPTV6
options IPFIREWALL_PMOD
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100
options LIBALIAS

Or, if you'd rather load the driver as a module at boot time (main character energy honestly), add this line into the loader.conf(5) file:

ipfw_load="YES"

Periodt. ✨

🦋 DESCRIPTION 🦋

The ipfw system facility lets you do filtering, redirecting, and other operations on IP packets travelling through network interfaces. It's giving traffic cop, but make it iconic. 👑

So here's the thing — the default behavior of ipfw is to block all incoming and outgoing traffic. Yes, all of it. 😭 That behavior can be modified to allow all traffic through the ipfw firewall by default, by enabling the IPFIREWALL_DEFAULT_TO_ACCEPT kernel option. This option may be useful when you're configuring ipfw for the very first time, because if the default ipfw behavior is to allow everything, it is easier to cope with firewall-tuning mistakes which may accidentally block all traffic. Not me accidentally locking myself out 🙈 — protect yourself.

When using natd(8) in conjunction with ipfw as the NAT facility, the kernel option IPDIVERT enables diverting packets to natd(8) for translation. Slay. 💫

When using the in-kernel NAT facility of ipfw, the kernel option IPFIREWALL_NAT enables basic libalias(3) functionality in the kernel. It's giving starter pack. 🎀

When using any of the IPv4 to IPv6 transition mechanisms in ipfw, the kernel option IPFIREWALL_NAT64 enables all of these NAT64 methods in the kernel. All of them. No cap. 🔥

When using the IPv6 network prefix translation facility of ipfw, the kernel option IPFIREWALL_NPTV6 enables this functionality in the kernel. 🦋

When using the packet modification facility of ipfw, the kernel option IPFIREWALL_PMOD enables this functionality in the kernel. Obsessed behavior honestly. 💜

To enable logging of packets passing through ipfw, enable the IPFIREWALL_VERBOSE kernel option. And the IPFIREWALL_VERBOSE_LIMIT option will prevent syslogd(8) from flooding system logs or causing local Denial of Service. This option may be set to the number of packets which will be logged on a per-entry basis before the entry is rate-limited. So like… it's the "bestie, chill" knob. 💀

When using the in-kernel NAT facility of ipfw, the kernel option LIBALIAS enables full libalias(3) functionality in the kernel. And "full functionality" refers to included support for ftp, bbt, skinny, irc, pptp and smedia packets, which are missing in the basic libalias(3) functionality accomplished with the IPFIREWALL_NAT kernel option. So IPFIREWALL_NAT is the basic era and LIBALIAS is the full deluxe era. ⭐

The user interface for ipfw is implemented by the ipfw(8) utility, so please refer to the ipfw(8) man page for a complete description of the ipfw capabilities and how to use it. Like, this page is the backstage lore — the actual hands-on tutorial is over there, bestie. 🧚

okay real talk: this page is just the kernel options. If you're looking for "how do I actually write rules," that's ipfw(8). Don't come for me. 💅

🌈 SEE ALSO 🌈

Like, go read these too, they're all connected:

and that's the whole page bestie, every last crumb of detail preserved 💖

okay so this little beauty is from Debian, dated August 19, 2020, and it goes out signing off as IPFW(4) — catch you on the flip side, mwah 🎀✨

📦 where this page comes from