| blob | 69cdacf689370f23898989b383c9a3c9e5bd507b |
1 '\" te
2 .\" To view license terms, attribution, and copyright for IP Filter, the default path is /usr/lib/ipf/IPFILTER.LICENCE. If the Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the installed
3 .\" location.
4 .\" Portions Copyright (c) 2009, Sun Microsystems Inc. All Rights Reserved.
5 .TH IPF 1M "Feb 25, 2009"
6 .SH NAME
7 ipf \- alter packet filtering lists for IP packet input and output
8 .SH SYNOPSIS
9 .LP
10 .nf
11 \fBipf\fR [\fB-6AdDEInoPRrsvVyzZ\fR] [\fB-l\fR block | pass | nomatch]
12 [\fB-T\fR \fIoptionlist\fR] [\fB-F\fR i | o | a | s | S] \fB-f\fR \fIfilename\fR
13 [\fB-f\fR \fIfilename\fR...]
14 .fi
16 .SH DESCRIPTION
17 .sp
18 .LP
19 The \fBipf\fR utility is part of a suite of commands associated with the
20 Solaris IP Filter feature. See \fBipfilter\fR(5).
21 .sp
22 .LP
23 The \fBipf\fR utility opens the filenames listed (treating a hyphen (\fB-\fR)
24 as stdin) and parses the file for a set of rules which are to be added or
25 removed from the packet filter rule set.
26 .sp
27 .LP
28 If there are no parsing problems, each rule processed by \fBipf\fR is added to
29 the kernel's internal lists. Rules are added to the end of the internal lists,
30 matching the order in which they appear when given to \fBipf\fR.
31 .sp
32 .LP
33 \fBipf\fR's use is restricted through access to \fB/dev/ipauth\fR,
34 \fB/dev/ipl\fR, and \fB/dev/ipstate\fR. The default permissions of these files
35 require \fBipf\fR to be run as root for all operations.
36 .SS "Enabling Solaris IP Filter Feature"
37 .sp
38 .LP
39 Solaris IP Filter is installed with the Solaris operating system. However,
40 packet filtering is not enabled by default. Use the following procedure to
41 activate the Solaris IP Filter feature.
42 .RS +4
43 .TP
44 1.
45 Assume a role that includes the IP Filter Management rights profile (see
46 \fBrbac\fR(5)) or become superuser.
47 .RE
48 .RS +4
49 .TP
50 2.
51 Configure system and services' firewall policies. See \fBsvc.ipfd\fR(1M) and
52 \fBipf\fR(4).
53 .RE
54 .RS +4
55 .TP
56 3.
57 (Optional) Create a network address translation (NAT) configuration file.
58 See \fBipnat.conf\fR(4).
59 .RE
60 .RS +4
61 .TP
62 4.
63 (Optional) Create an address pool configuration file. See \fBippool\fR(4).
64 .sp
65 Create an \fBipool.conf\fR file if you want to refer to a group of addresses as
66 a single address pool. If you want the address pool configuration file to be
67 loaded at boot time, create a file called \fB/etc/ipf/ippool.conf\fR in which
68 to put the address pool. If you do not want the address pool configuration file
69 to be loaded at boot time, put the \fBippool.conf\fR file in a location other
70 than \fB/etc/ipf\fR and manually activate the rules.
71 .RE
72 .RS +4
73 .TP
74 5.
75 Enable Solaris IP Filter, as follows:
76 .sp
77 .in +2
78 .nf
79 # \fBsvcadm enable network/ipfilter\fR
80 .fi
81 .in -2
82 .sp
84 .RE
85 .sp
86 .LP
87 To re-enable packet filtering after it has been temporarily disabled either
88 reboot the machine or enter the following command:
89 .sp
90 .in +2
91 .nf
92 # \fBsvcadm enable network/ipfilter\fR
93 .fi
94 .in -2
95 .sp
97 .sp
98 .LP
99 \&...which essentially executes the following \fBipf\fR commands:
100 .RS +4
101 .TP
102 1.
103 Enable Solaris IP Filter:
104 .sp
105 .in +2
106 .nf
107 # \fBipf -E\fR
108 .fi
109 .in -2
110 .sp
112 .RE
113 .RS +4
114 .TP
115 2.
116 Load \fBippools\fR:
117 .sp
118 .in +2
119 .nf
120 \fB# ippool -f\fR \fI<ippool configuration file>\fR
121 .fi
122 .in -2
123 .sp
125 See \fBippool\fR(1M).
126 .RE
127 .RS +4
128 .TP
129 3.
130 (Optional) Activate packet filtering:
131 .sp
132 .in +2
133 .nf
134 \fBipf -f\fR \fI<ipf configuration file>\fR
135 .fi
136 .in -2
137 .sp
139 .RE
140 .RS +4
141 .TP
142 4.
143 (Optional) Activate NAT:
144 .sp
145 .in +2
146 .nf
147 \fBipnat -f\fR \fI<IPNAT configuration file>\fR
148 .fi
149 .in -2
150 .sp
152 See \fBipnat\fR(1M).
153 .RE
154 .LP
155 Note -
156 .sp
157 .RS 2
158 If you reboot your system, the IPfilter configuration is automatically
159 activated.
160 .RE
161 .SH OPTIONS
162 .sp
163 .LP
164 The following options are supported:
165 .sp
166 .ne 2
167 .na
168 \fB\fB-6\fR\fR
169 .ad
170 .sp .6
171 .RS 4n
172 This option is required to parse IPv6 rules and to have them loaded. Loading of
173 IPv6 rules is subject to change in the future.
174 .RE
176 .sp
177 .ne 2
178 .na
179 \fB\fB-A\fR\fR
180 .ad
181 .sp .6
182 .RS 4n
183 Set the list to make changes to the active list (default).
184 .RE
186 .sp
187 .ne 2
188 .na
189 \fB\fB-d\fR\fR
190 .ad
191 .sp .6
192 .RS 4n
193 Turn debug mode on. Causes a hex dump of filter rules to be generated as it
194 processes each one.
195 .RE
197 .sp
198 .ne 2
199 .na
200 \fB\fB-D\fR\fR
201 .ad
202 .sp .6
203 .RS 4n
204 Disable the filter (if enabled). Not effective for loadable kernel versions.
205 .RE
207 .sp
208 .ne 2
209 .na
210 \fB\fB-E\fR\fR
211 .ad
212 .sp .6
213 .RS 4n
214 Enable the filter (if disabled). Not effective for loadable kernel versions.
215 .RE
217 .sp
218 .ne 2
219 .na
220 \fB\fB-F\fR \fBi\fR | \fBo\fR | \fBa\fR\fR
221 .ad
222 .sp .6
223 .RS 4n
224 Specifies which filter list to flush. The parameter should either be \fBi\fR
225 (input), \fBo\fR (output) or \fBa\fR (remove all filter rules). Either a single
226 letter or an entire word starting with the appropriate letter can be used. This
227 option can be before or after any other, with the order on the command line
228 determining that used to execute options.
229 .RE
231 .sp
232 .ne 2
233 .na
234 \fB\fB-F\fR \fBs\fR | \fBS\fR\fR
235 .ad
236 .sp .6
237 .RS 4n
238 To flush entries from the state table, use the \fB-F\fR option in conjuction
239 with either \fBs\fR (removes state information about any non-fully established
240 connections) or \fBS\fR (deletes the entire state table). You can specify only
241 one of these two options. A fully established connection will show up in
242 \fBipfstat\fR \fB-s\fR output as \fB4/4\fR, with deviations either way
243 indicating the connection is not fully established.
244 .RE
246 .sp
247 .ne 2
248 .na
249 \fB\fB-f\fR \fIfilename\fR\fR
250 .ad
251 .sp .6
252 .RS 4n
253 Specifies which files \fBipf\fR should use to get input from for modifying the
254 packet filter rule lists.
255 .RE
257 .sp
258 .ne 2
259 .na
260 \fB\fB-I\fR\fR
261 .ad
262 .sp .6
263 .RS 4n
264 Set the list to make changes to the inactive list.
265 .RE
267 .sp
268 .ne 2
269 .na
270 \fB\fB-l\fR \fBpass\fR | \fBblock\fR | \fBnomatch\fR\fR
271 .ad
272 .sp .6
273 .RS 4n
274 Toggles default logging of packets. Valid arguments to this option are
275 \fBpass\fR, \fBblock\fR and \fBnomatch\fR. When an option is set, any packet
276 which exits filtering and matches the set category is logged. This is most
277 useful for causing all packets that do not match any of the loaded rules to be
278 logged.
279 .RE
281 .sp
282 .ne 2
283 .na
284 \fB\fB-n\fR\fR
285 .ad
286 .sp .6
287 .RS 4n
288 Prevents \fBipf\fR from making any ioctl calls or doing anything which would
289 alter the currently running kernel.
290 .RE
292 .sp
293 .ne 2
294 .na
295 \fB\fB-o\fR\fR
296 .ad
297 .sp .6
298 .RS 4n
299 Force rules by default to be added/deleted to/from the output list, rather than
300 the (default) input list.
301 .RE
303 .sp
304 .ne 2
305 .na
306 \fB\fB-P\fR\fR
307 .ad
308 .sp .6
309 .RS 4n
310 Add rules as temporary entries in the authentication rule table.
311 .RE
313 .sp
314 .ne 2
315 .na
316 \fB\fB-R\fR\fR
317 .ad
318 .sp .6
319 .RS 4n
320 Disable both IP address-to-hostname resolution and port number-to-service name
321 resolution.
322 .RE
324 .sp
325 .ne 2
326 .na
327 \fB\fB-r\fR\fR
328 .ad
329 .sp .6
330 .RS 4n
331 Remove matching filter rules rather than add them to the internal lists.
332 .RE
334 .sp
335 .ne 2
336 .na
337 \fB\fB-s\fR\fR
338 .ad
339 .sp .6
340 .RS 4n
341 Swap the currently active filter list to be an alternative list.
342 .RE
344 .sp
345 .ne 2
346 .na
347 \fB\fB-T\fR \fIoptionlist\fR\fR
348 .ad
349 .sp .6
350 .RS 4n
351 Allows run-time changing of IPFilter kernel variables. To allow for changing,
352 some variables require IPFilter to be in a disabled state (\fB-D\fR), others do
353 not. The \fIoptionlist\fR parameter is a comma-separated list of tuning
354 commands. A tuning command is one of the following:
355 .sp
356 .ne 2
357 .na
358 \fB\fBlist\fR\fR
359 .ad
360 .sp .6
361 .RS 4n
362 Retrieve a list of all variables in the kernel, their maximum, minimum, and
363 current value.
364 .RE
366 .sp
367 .ne 2
368 .na
369 \fBsingle variable name\fR
370 .ad
371 .sp .6
372 .RS 4n
373 Retrieve its current value.
374 .RE
376 .sp
377 .ne 2
378 .na
379 \fBvariable name with a following assignment\fR
380 .ad
381 .sp .6
382 .RS 4n
383 To set a new value.
384 .RE
386 Examples follow:
387 .sp
388 .in +2
389 .nf
390 # Print out all IPFilter kernel tunable parameters
391 ipf -T list
393 # Display the current TCP idle timeout and then set it to 3600
394 ipf -D -T fr_tcpidletimeout,fr_tcpidletimeout=3600 -E
396 # Display current values for fr_pass and fr_chksrc, then set
397 # fr_chksrc to 1.
398 ipf -T fr_pass,fr_chksrc,fr_chksrc=1
399 .fi
400 .in -2
401 .sp
403 .RE
405 .sp
406 .ne 2
407 .na
408 \fB\fB-v\fR\fR
409 .ad
410 .sp .6
411 .RS 4n
412 Turn verbose mode on. Displays information relating to rule processing.
413 .RE
415 .sp
416 .ne 2
417 .na
418 \fB\fB-V\fR\fR
419 .ad
420 .sp .6
421 .RS 4n
422 Show version information. This will display the version information compiled
423 into the \fBipf\fR binary and retrieve it from the kernel code (if running or
424 present). If it is present in the kernel, information about its current state
425 will be displayed; for example, whether logging is active, default filtering,
426 and so forth).
427 .RE
429 .sp
430 .ne 2
431 .na
432 \fB\fB-y\fR\fR
433 .ad
434 .sp .6
435 .RS 4n
436 Manually resync the in-kernel interface list maintained by IP Filter with the
437 current interface status list.
438 .RE
440 .sp
441 .ne 2
442 .na
443 \fB\fB-z\fR\fR
444 .ad
445 .sp .6
446 .RS 4n
447 For each rule in the input file, reset the statistics for it to zero and
448 display the statistics prior to them being zeroed.
449 .RE
451 .sp
452 .ne 2
453 .na
454 \fB\fB-Z\fR\fR
455 .ad
456 .sp .6
457 .RS 4n
458 Zero global statistics held in the kernel for filtering only. This does not
459 affect fragment or state statistics.
460 .RE
462 .SH FILES
463 .sp
464 .ne 2
465 .na
466 \fB\fB/dev/ipauth\fR\fR
467 .ad
468 .br
469 .na
470 \fB\fB/dev/ipl\fR\fR
471 .ad
472 .br
473 .na
474 \fB\fB/dev/ipstate\fR\fR
475 .ad
476 .sp .6
477 .RS 4n
478 Links to IP Filter pseudo devices.
479 .RE
481 .sp
482 .ne 2
483 .na
484 \fB\fB/etc/ipf/ipf.conf\fR\fR
485 .ad
486 .sp .6
487 .RS 4n
488 Location of \fBipf\fR startup configuration file. See \fBipf\fR(4).
489 .RE
491 .sp
492 .ne 2
493 .na
494 \fB\fB/usr/share/ipfilter/examples/\fR\fR
495 .ad
496 .sp .6
497 .RS 4n
498 Contains numerous IP Filter examples.
499 .RE
501 .SH ATTRIBUTES
502 .sp
503 .LP
504 See \fBattributes\fR(5) for descriptions of the following attributes:
505 .sp
507 .sp
508 .TS
509 box;
510 c | c
511 l | l .
512 ATTRIBUTE TYPE ATTRIBUTE VALUE
513 _
514 Interface Stability Committed
515 .TE
517 .SH SEE ALSO
518 .sp
519 .LP
520 \fBipfstat\fR(1M), \fBipmon\fR(1M), \fBipnat\fR(1M), \fBippool\fR(1M),
521 \fBsvcadm\fR(1M), \fBsvc.ipfd\fR(1M), \fBipf\fR(4), \fBipnat.conf\fR(4),
522 \fBippool\fR(4), \fBattributes\fR(5), \fBipfilter\fR(5)
523 .sp
524 .LP
525 \fI\fR
526 .SH DIAGNOSTICS
527 .sp
528 .LP
529 Needs to be run as root for the packet filtering lists to actually be affected
530 inside the kernel.