Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to create my own firewall script inside of FreeBSD and I'm running in a bit problems, I was wondering if someone done something smilier and could show me an example?

su-3.2# grep ^firewall /etc/rc.conf 
firewall_enable="YES"   	# Set to YES to enable firewall functionality
firewall_quiet="YES"    	# Set to YES to suppress rule display
firewall_logging="YES"  	# Set to YES to enable events logging
firewall_logdeny="YES"  	# Set to YES to log default denied incoming
su-3.2# cat /etc/ipfw.rules 
${fwcmd} add 65000 pass all from any to any
su-3.2# /etc/rc.d/ipfw restart
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_enable is set to YES.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_enable is set to YES.
/etc/rc.d/ipfw: DEBUG: run_rc_command: doit: ipfw_stop 
net.inet.ip.fw.enable: 1 -> 0
/etc/rc.d/natd: DEBUG: checkyesno: natd_enable is set to NO.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_enable is set to YES.
/etc/rc.d/ipfw: DEBUG: run_rc_command: start_precmd: ipfw_prestart 
/etc/rc.d/ipfw: DEBUG: checkyesno: dummynet_enable is set to NO.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_nat_enable is set to NO.
/etc/rc.d/ipfw: DEBUG: load_kld: ipfw kernel module already loaded.
/etc/rc.d/ipfw: DEBUG: run_rc_command: doit: ipfw_start 
/etc/rc.d/natd: DEBUG: checkyesno: natd_enable is set to NO.
Line 1: bad command `${fwcmd}'
Firewall rules loaded.
/etc/rc.d/ipfw: DEBUG: checkyesno: firewall_logging is set to YES.
Firewall logging enabled.
net.inet.ip.fw.enable: 0Read from remote host XXXXX.XXX: Connection reset by peer
Connection to XXXXX.XXX closed.
mbp:~ alexus$ 
share|improve this question
Do you have an actual question? – Cian Sep 30 '09 at 22:58
If this is a new setup you may want to look at pf instead of ipfw. – chris Nov 15 '09 at 9:34
up vote 1 down vote accepted

Lose the ${fwcmd}. Your file is being provided to ipfw as an argument.

ipfw [-cfnNqS] [-p preproc [preproc-flags]] pathname

To ease configuration, rules can be put into a file which is processed using ipfw as shown in the last synopsis line. An absolute pathname must be used. The file will be read line by line and applied as arguments to the ipfw utility.

Try running ipfw /etc/ipfw.rules

share|improve this answer
do I need something like add 65000 pass all from any to any at the end of file to make it similar to "open" ? or is it going add it on it's own? – alexus Oct 1 '09 at 5:12
It will not add anything, and at the end the default rule will be (usually it is deny; check sysctl net.inet.ip.fw.default_to_accept). – Gleb Oct 1 '09 at 5:20

Tip: You should enter rules to IPFW from a rc.d script (ex: /usr/local/etc/rc.d/, don't use /etc/ipfw.rules , thats not flexible at all

share|improve this answer

basically, do what gleb said.

if you want to specify a script in rc.conf, you should rename your file, and use something like: firewall_script="/etc/ipfw.conf"

see /etc/defaults/rc.conf for more info.

also, ${fwcmd} needs to be defined; usually it's something like:


see here for more info:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.