OpenBSD- NetBSD-current (post 1.2)
Whats new ? Click here!
To see an overview of how IP Filter fits into the overall picture of TCP/IP with your kernel and the order in which the various filtering phases are done, click here.
The small and slowly growing FAQ List is also now available.
It comes as a part of the following operating systems:
OpenBSD NetBSD-current (post 1.2)
Solaris/Solaris-x86 2.3 - 2.6 SunOS 4.1.1 - 4.1.4 NetBSD 1.0 - 1.2 FreeBSD 2.0.0 - 2.1.5 BSD/OS-1.1, 2.0
explicitly
deny/permit
any packet from passing through
distinguish between various
interfaces
filter by
IP networks or hosts
selectively filter
any IP protocol
selectively filter
fragmented IP packets
selectively filter packets with IP
options.
send back an
ICMP error/TCP reset for blocked packets
keep
packet state infromation for TCP, UDP
and ICMP packet flows.
keep fragment state information for any IP
packet, applying the same rule to all fragments.
act as a
Network Address Translator (NAT)
use
redirection to setup true transparent proxy
connections.
TCP/UDP packets by
port number or a
port number range
ICMP packets by
type/code
"established" TCP packets
on any arbitary combination of
TCP flags
"short" (fragmented) IP packets with
incomplete headers can be filtered
any of the 19
IP options or 8 registered
IP security classes
TOS (Type of Service) field in packets
To ease the process of writing filter rules, you
can now use a "Filter Language Compiler" (flc). For more information
on this, including support firewalling packet filters, see
http://coombs.anu.edu.au/~avalon/flc.html.
the TCP/UDP/ICMP and IP packet headers
the first 128 bytes of the packet
(including headers)
a packet is successfully passed through
a packet is blocked from passing through
it matches a rule setup to look for suspicious
packets
packets blocked
packets (and bytes!) used for accounting
packets passed
packets logged
attempts to log which failed (buffer full)
The current implementation provides a small set of tools, which can easily be used and integrated with regular unix shells and tools. Amongst these tools is a new addition, ipftest, which is provided so that you can test a rule set before committing it to use in your kernel. A brief description of the tools provided:
ipf - reads in a set of rules, from
either stdin or a file, and adds them to the kernels current list
(appending them). It can also be used to flush the current filter set
or delete individual filter rules.
ipfstat - interrogates the kernel for
statistics on packet filtering, so far, and retrieves the list of filters
in operation for inbound and outbound packets.
ipftest - reads in a filter rule file
and then applies sample IP packets to the rule file. This allows for testing
of filter list and examination of how a packet is passed along through
it.
ipmon - reads buffered data from the
logging device (default is /dev/ipl) for output to either:
ipsend - generates arbitary IP packets
for ethernet connected machines.
ipresend - reads in a data file of saved
IP packets (ie snoop/tcpdump/etherfind output) and sends it back across the
network.
iptest - contains a set of test "programs"
which send out a series of IP packets, aimed at testing the strength of the
TCP/IP stack at which it is aimed at. WARNING: may crash machine(s)
targeted!
ipnat - reads in a set of rules, from
either stdin or a file and adds them to the kernels current list of active
NAT rules. NAT rules can also be deleted using ipnat.
To retrieve this package via anonymous ftp, use: ftp://coombs.anu.edu.au/pub/net/kernel/ip-fil3.1.11.tar.gz
ftp://ftp.cyber.com.au/pub/archive/ipfilter.*
An index of the mailling list has been HTML'ised and is available at:
http://lists.zyzzyva.com/ipfilter/
Mirrors!
This product includes software developed by the University of California, Berkeley and its contributors.
Darren Reed