IPFW(4)

💖 IPFW(4) — the ipfw girlies' handbook 💖

okay so bestie, welcome to IPFW(4), from the Kernel Interfaces Manual ✨ this is the kernel-side lore for ipfw, the IP packet filter and traffic accounting facility. yes it's section 4, yes it's a kernel interface, yes we're doing this. sit down, hydrate, let's go 🫶

🌸 NAME 🌸

ipfw — IP packet filter and traffic accounting 🎀

like... it filters your IP packets and it counts your traffic. that's the whole vibe. iconic behavior honestly.

✨ SYNOPSIS ✨

okay so first things first, if you want this driver compiled into the kernel, you gotta drop this option into your kernel configuration file:

options IPFIREWALL

and there are other related kernel options that may also be useful (they're giving ✨optional but cute✨):

options IPFIREWALL_DEFAULT_TO_ACCEPT
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100

now if you'd rather load the driver as a module at boot time instead, no stress, just add this line into the loader.conf(5) file:

ipfw_load="YES"

periodt. that's the setup 💅

🦋 DESCRIPTION 🦋

the ipfw system facility lets you do filtering, redirecting, and other operations on IP packets travelling through network interfaces. it's the bouncer at the club door of your network, fr fr 🌈

okay now the important part, and I need you to listen: the default behavior of ipfw is to block all incoming and outgoing traffic. like. everything. all of it. 💀

this behavior can be modified — to allow all traffic through the ipfw firewall by default — by enabling the IPFIREWALL_DEFAULT_TO_ACCEPT kernel option. and honestly? this option may be useful when you're configuring ipfw for the first time, because if the default ipfw behavior is to allow everything, it's way easier to cope with firewall-tuning mistakes which may accidentally block all traffic. like, imagine accidentally locking yourself out on your first day. not the vibe. 🙈

if you want to enable logging of packets passing through ipfw, turn on the IPFIREWALL_VERBOSE kernel option. and then the IPFIREWALL_VERBOSE_LIMIT option comes in to prevent syslogd(8) from flooding system logs or causing local Denial of Service — she's the responsible one keeping things in check 🧚 this option may be set to the number of packets which will be logged on a per-entry basis before the entry is rate-limited. so like, a little cap so nobody spirals.

and the user interface for ipfw is implemented by the ipfw(8) utility, so please please please refer to the ipfw(8) manpage for a complete description of the ipfw capabilities and how to use it. that's where the actual tea is, bestie 👑

lowkey important: this page is the kernel-side of the story. the ipfw(8) manpage is the one with the full capabilities description and how-to. don't skip it. 💖

👑 SEE ALSO 👑

• setsockopt(2)
• divert(4)
• ip(4)
• ipfw(8)
• sysctl(8)
• syslogd(8)
• pfil(9)

the whole friend group right there 🫶 go read them, they ate.

and that's the page, bestie!! 🌸 this one came from Debian, dated October 25, 2012, and it lives under the name IPFW(4) in the manual. mwah, go configure responsibly, ily 💅✨