3 ipfilter \- Introduction to IP packet filtering
5 IP Filter is a TCP/IP packet filter, suitable for use in a firewall
6 environment. To use, it can either be used as a loadable kernel module or
7 incorporated into your UNIX kernel; use as a loadable kernel module where
8 possible is highly recommended. Scripts are provided to install and patch
9 system files, as required.
11 The IP packet filter can:
13 explicitly deny/permit any packet from passing through
15 distinguish between various interfaces
17 filter by IP networks or hosts
19 selectively filter any IP protocol
21 selectively filter fragmented IP packets
23 selectively filter packets with IP options
25 send back an ICMP error/TCP reset for blocked packets
27 keep packet state information for TCP, UDP and ICMP packet flows
29 keep fragment state information for any IP packet, applying the same rule
32 act as a Network Address Translator (NAT)
34 use redirection to setup true transparent proxy connections
36 provide packet header details to a user program for authentication
38 in addition, supports temporary storage of pre-authenticated rules for passing packets through
40 Special provision is made for the three most common Internet protocols, TCP,
41 UDP and ICMP. The IP Packet filter allows filtering of:
43 Inverted host/net matchingTCP/UDP packets by port number or a port number
46 ICMP packets by type/code
48 "established" TCP packets
50 On any arbitrary combination of TCP flags
52 "short" (fragmented) IP packets with incomplete headers can be filtered
54 any of the 19 IP options or 8 registered IP security classes TOS (Type of
55 Service) field in packets
57 To keep track of the performance of the IP packet filter, a logging device
58 is used which supports logging of:
60 the TCP/UDP/ICMP and IP packet headers
62 the first 128 bytes of the packet (including headers)
64 A packet can be logged when:
66 it is successfully passed through
68 it is blocked from passing through
70 it matches a rule setup to look for suspicious packets
72 IP Filter keeps its own set of statistics on:
76 packets (and bytes!) used for accounting
82 attempts to log which failed (buffer full)
84 and much more, for packets going both in and out.
87 The current implementation provides a small set of tools, which can easily
88 be used and integrated with regular unix shells and tools. A brief description
89 of the tools provided:
92 reads in a set of rules, from either stdin or a file, and adds them to
93 the kernels current list (appending them). It can also be used to flush the
94 current filter set or delete individual filter rules. The file format is
98 is a utility to temporarily lock the IP Filter kernel tables (state tables
99 and NAT mappings) and write them to disk. After that the system can be
100 rebooted, and ipfs can be used to read these tables from disk and restore
101 them into the kernel. This way the system can be rebooted without the
102 connections being terminated.
105 interrogates the kernel for statistics on packet filtering, so
106 far, and retrieves the list of filters in operation for inbound and outbound
110 reads in a filter rule file and then applies sample IP packets to
111 the rule file. This allows for testing of filter list and examination of how
112 a packet is passed along through it.
115 reads buffered data from the logging device (default is /dev/ipl)
116 for output to either:
118 screen (standard output)
125 generates arbitary IP packets for ethernet connected machines.
128 reads in a data file of saved IP packets (ie
129 snoop/tcpdump/etherfind output) and sends it back across the network.
132 contains a set of test "programs" which send out a series of IP
133 packets, aimed at testing the strength of the TCP/IP stack at which it is
134 aimed at. WARNING: this may crash machine(s) targeted!
137 reads in a set of rules, from either stdin or a file and adds them
138 to the kernels current list of active NAT rules. NAT rules can also be
139 deleted using ipnat. The format of the configuration file to be used
140 with ipnat is described in ipnat(5).
142 For use in your own programs (e.g. for writing of transparent application
143 proxies), the programming interface and the associated ioctl's are
144 documented in ipf(4).
146 Documentation on ioctl's and the format of data saved
147 to the logging character device is provided in ipl(4)
148 so that you may develop your own applications to work with or in place of any
151 Similar, the interface to the NAT code is documented in ipnat(4).
153 .SH PACKET PROCESSING FLOW
154 The following diagram illustrates the flow of TCP/IP packets through the
155 various stages introduced by IP Filter.
161 +-------------------------+--------------------------+
164 | Network Address Translation |
167 | +-------<---------+ |
173 | | Fragment Cache Check--+ |
176 | | Packet State Check-->+ |
180 | V groups IP Filtering V |
184 | +---------------->|<-----------+ |
194 +--|---<--- fast-route ---<--+ |
197 | +-------------------------+--------------------------+
202 V [KERNEL TCP/IP Processing]
204 | +-------------------------+--------------------------+
207 | | Fragment Cache Check--+ |
210 | | Packet State Check-->+ |
220 | | Network Address Translation |
223 | +-------------------------+--------------------------+
227 +--------------------------->|
233 More information (including pointers to the FAQ and the mailing list) can be
234 obtained from the sofware's official homepage: www.ipfilter.org
237 ipf(4), ipf(5), ipf(8), ipfilter(5), ipfs(8), ipfstat(8), ipftest(1),
238 ipl(4), ipmon(8), ipnat(8), ipnat(4),