NG_IPFW(4)

💖 NG_IPFW(4) 💖

okay so bestie, this is the NG_IPFW(4) page from the Kernel Interfaces Manual, and it's literally the whole vibe of how netgraph and the IP firewall talk to each other. no cap, it's giving “tiny bridge, huge responsibility” energy 🫶

✨ NAME ✨

ng_ipfw — interface between netgraph and IP firewall

🎀 SYNOPSIS 🎀

#include <netinet/ip_var.h>
#include <netgraph/ng_ipfw.h>

🌸 DESCRIPTION 🌸

The ipfw node implements the interface between the ipfw(4) and netgraph(4) subsystems. that's the whole assignment, and it ate 💅

🦋 HOOKS 🦋

The ipfw node supports an arbitrary number of hooks, and those hook names must be made using only numeric characters. like, digits only, bestie — no letters, no cute little underscores, just numbers 🔢

⭐ OPERATION ⭐

Once the ng_ipfw module is loaded into the kernel, a single node named ipfw is automatically created. no more ipfw nodes can be created. periodt. and once it's destroyed, the only way to recreate the node is to reload the ng_ipfw module. so yeah, icon behavior, but also slightly main-character fragile 😭

Packets can be injected into netgraph(4) using either the netgraph or ngtee commands of the ipfw(8) utility. these commands require a numeric cookie to be supplied as an argument. packets are sent out of the hook whose name equals the cookie value. if no hook matches, packets are discarded. gone. not seen. 💀

Packets injected via the netgraph command are tagged with struct ipfw_rule_ref. this tag contains information that helps the packet re-enter ipfw(4) processing, should the packet come back from netgraph(4) to ipfw(4). it's like a little “hey remember me?” note attached to the packet 🥺

Packets received by a node from the netgraph(4) subsystem must be tagged with the struct ipfw_rule_ref tag. packets re-enter IP firewall processing at the next rule. if no tag is supplied, packets are discarded. no tag, no entry, bestie — that's the rule 🚫

💅 CONTROL MESSAGES 💅

This node type supports only the generic control messages. that's it. no extra special messages, no secret menu 🎀

🔥 SHUTDOWN 🔥

This node shuts down upon receipt of a NGM_SHUTDOWN control message.

bestie, do not do this. the new ipfw node can only be created by reloading the ng_ipfw module, so shutting it down is a whole commitment. dramatic, but true 😭

🌈 SEE ALSO 🌈

• ipfw(4)
• netgraph(4)
• ipfw(8)
• mbuf_tags(9)

👑 HISTORY 👑

The ipfw node type was implemented in FreeBSD 6.0. vintage, but make it slay ✨

🍓 AUTHORS 🍓

The ipfw node was written by Gleb Smirnoff <glebius@FreeBSD.org>. we love a credited icon 🫶

---

and that's the whole page, bestie — sourced from Debian, dated March 2, 2010. mwah 💋