NG_IPFW(4)

📦 version 12.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 NG_IPFW 💖

okay so bestie, welcome to ng_ipfw — the Kernel Interfaces Manual page, no less. this is the whole vibe: it's the interface between netgraph and the IP firewall. that's it. that's the girl. let's get into it 🦋

✨ SYNOPSIS ✨

#include <netinet/ip_var.h>
#include <netgraph/ng_ipfw.h>

like, include both or don't bother, fr fr 💅

🌸 DESCRIPTION 🌸

the ipfw node is literally the middleman, the group-chat moderator, the interface between the ipfw(4) subsystem and the netgraph(4) subsystem. she bridges the two. she's the blueprint. iconic behavior honestly 👑

🎀 HOOKS 🎀

okay so the ipfw node can have an arbitrary number of hooks — she's flexible like that 💁‍♀️ — but here's the thing: those hook names must be made up of only numeric characters. numbers only. no letters, no vibes, no exceptions. periodt.

🔥 OPERATION 🔥

so the moment the ng_ipfw module gets loaded into the kernel, one single node named ipfw is automatically created for you. that's your one and only. no more ipfw nodes can be created. none. she's the main character and there is no ensemble cast.

and like… once she's destroyed? the only way to recreate that node is to reload the ng_ipfw module. so maybe don't. 🙈

packets can be injected into netgraph(4) using either the netgraph or ngtee commands of the ipfw(8) utility. these commands require a numeric cookie to be supplied as an argument. packets are sent out of the hook whose name equals the cookie value. if no hook matches, the packets are just… discarded. gone. not me losing packets 😭

packets injected via the netgraph command are tagged with struct ipfw_rule_ref. this tag carries the info that helps the packet re-enter ipfw(4) processing, in case the packet comes back from netgraph(4) to ipfw(4). it's giving return ticket, honestly 🎫

packets received by a node from the netgraph(4) subsystem must be tagged with the struct ipfw_rule_ref tag. packets re-enter IP firewall processing at the next rule. and if no tag is supplied? packets are discarded. bye bestie 💀

💅 CONTROL MESSAGES 💅

this node type supports only the generic control messages. that's it. lowkey minimal, highkey valid ✨

🌈 SHUTDOWN 🌈

this node shuts down upon receipt of a NGM_SHUTDOWN control message.

do not do this. because the new ipfw node can only be created by reloading the ng_ipfw module. i'm serious. put it down. 🫶

⭐ SEE ALSO ⭐

go read those too, iykyk 📚

🧚 HISTORY 🧚

the ipfw node type was implemented in FreeBSD 6.0. vintage. retro. she's been serving since day one 💜

👑 AUTHORS 👑

the ipfw node was written by Gleb Smirnoff <glebius@FreeBSD.org>. legend behavior, we love to see it 🍓

that's the whole page bestie!! 💖 this one's from the Debian squad, dated March 2, 2010, and it's NG_IPFW(4) — go forth and bridge those subsystems, no cap 🌸✨

📦 where this page comes from