6 .Nd Introduction to IP packet filtering
8 IP Filter is a TCP/IP packet filter, suitable for use in a firewall
9 environment. To use, it can either be used as a loadable kernel module or
10 incorporated into your UNIX kernel; use as a loadable kernel module where
11 possible is highly recommended. Scripts are provided to install and patch
12 system files, as required.
14 The IP packet filter can:
15 .Bl -bullet -offset indent -compact
17 explicitly deny/permit any packet from passing through
19 distinguish between various interfaces
21 filter by IP networks or hosts
23 selectively filter any IP protocol
25 selectively filter fragmented IP packets
27 selectively filter packets with IP options
29 send back an ICMP error/TCP reset for blocked packets
31 keep packet state information for TCP, UDP and ICMP packet flows
33 keep fragment state information for any IP packet, applying the same rule
36 act as a Network Address Translator (NAT)
38 use redirection to setup true transparent proxy connections
40 provide packet header details to a user program for authentication
42 in addition, supports temporary storage of pre-authenticated rules for passing packets through
45 Special provision is made for the three most common Internet protocols, TCP,
46 UDP and ICMP. The IP Packet filter allows filtering of:
47 .Bl -bullet -offset indent -compact
49 Inverted host/net matchingTCP/UDP packets by port number or a port number
52 ICMP packets by type/code
54 "established" TCP packets
56 On any arbitrary combination of TCP flags
58 "short" (fragmented) IP packets with incomplete headers can be filtered
60 any of the 19 IP options or 8 registered IP security classes TOS (Type of
61 Service) field in packets
64 To keep track of the performance of the IP packet filter, a logging device
65 is used which supports logging of:
66 .Bl -bullet -offset indent -compact
68 the TCP/UDP/ICMP and IP packet headers
70 the first 128 bytes of the packet (including headers)
73 A packet can be logged when:
74 .Bl -bullet -offset indent -compact
76 it is successfully passed through
78 it is blocked from passing through
80 it matches a rule setup to look for suspicious packets
83 IP Filter keeps its own set of statistics on:
84 .Bl -bullet -offset indent -compact
88 packets (and bytes!) used for accounting
94 attempts to log which failed (buffer full)
96 and much more, for packets going both in and out.
99 The current implementation provides a small set of tools, which can easily
100 be used and integrated with regular unix shells and tools. A brief description
101 of the tools provided:
104 reads in a set of rules, from either stdin or a file, and adds them to
105 the kernels current list (appending them). It can also be used to flush the
106 current filter set or delete individual filter rules. The file format is
111 is a utility to temporarily lock the IP Filter kernel tables (state tables
112 and NAT mappings) and write them to disk. After that the system can be
113 rebooted, and ipfs can be used to read these tables from disk and restore
114 them into the kernel. This way the system can be rebooted without the
115 connections being terminated.
118 interrogates the kernel for statistics on packet filtering, so
119 far, and retrieves the list of filters in operation for inbound and outbound
123 reads in a filter rule file and then applies sample IP packets to
124 the rule file. This allows for testing of filter list and examination of how
125 a packet is passed along through it.
128 reads buffered data from the logging device (default is /dev/ipl)
129 for output to either:
130 .Bl -bullet -offset indent -compact
132 screen (standard output)
140 generates arbitary IP packets for ethernet connected machines.
143 reads in a data file of saved IP packets (ie
144 snoop/tcpdump/etherfind output) and sends it back across the network.
147 contains a set of test "programs" which send out a series of IP
148 packets, aimed at testing the strength of the TCP/IP stack at which it is
149 aimed at. WARNING: this may crash machine(s) targeted!
152 reads in a set of rules, from either stdin or a file and adds them
153 to the kernels current list of active NAT rules. NAT rules can also be
154 deleted using ipnat. The format of the configuration file to be used
155 with ipnat is described in
158 For use in your own programs (e.g. for writing of transparent application
159 proxies), the programming interface and the associated ioctl's are
163 Documentation on ioctl's and the format of data saved
164 to the logging character device is provided in
166 so that you may develop your own applications to work with or in place of any
169 Similar, the interface to the NAT code is documented in
172 .Sh PACKET PROCESSING FLOW
173 The following diagram illustrates the flow of TCP/IP packets through the
174 various stages introduced by IP Filter.
180 +-------------------------+--------------------------+
183 | Network Address Translation |
186 | +-------<---------+ |
192 | | Fragment Cache Check--+ |
195 | | Packet State Check-->+ |
199 | V groups IP Filtering V |
203 | +---------------->|<-----------+ |
213 +--|---<--- fast-route ---<--+ |
216 | +-------------------------+--------------------------+
221 V [KERNEL TCP/IP Processing]
223 | +-------------------------+--------------------------+
226 | | Fragment Cache Check--+ |
229 | | Packet State Check-->+ |
239 | | Network Address Translation |
242 | +-------------------------+--------------------------+
246 +--------------------------->|
252 More information (including pointers to the FAQ and the mailing list) can be
253 obtained from the sofware's official homepage: www.ipfilter.org
projects / FreeBSD / releng / 9.2.git / blob