Questions tagged [ipfw]
IPFW is is a native firewall built into FreeBSD.
59
questions
1
vote
1
answer
285
views
ipfw testing without blocking the FreeBSD server in the case of ipfw error
I'm a newbie with ipfw, trying to learn it and testing its commands on the server with FreeBSD. Every time when I run ipfw command via SSH with a syntax error/typo and then restart ipfw service, the ...
0
votes
1
answer
243
views
FreebSD ipfw: using not with multiple addresses
Any ideas why this rule won't parse?
ipfw add 10 deny ip from \{ not 127.0.0.1 and not 10.12.34.0/24 \} to any 53 out xmit wan0
ipfw doesn't like and and says: ipfw: missing ")"
I've tried ...
1
vote
0
answers
158
views
Equivalent ipfw config for firewalld
On a system managed by firewalld it is possible to redirect incoming traffic on 443 to 8443 so the process listening doesn't have to run as root to bind to 443 which requires root.
firewall-cmd --add-...
0
votes
1
answer
2k
views
Allowing access to UDP range port in ipfw/FreeBSD
I have prepared the following configuration:
# cat /etc/firewall.conf
add 1000 count udp from any to me 10000
add 1001 count udp from any to me 10001
add 1002 count udp from any to me 10002
add ...
0
votes
0
answers
84
views
After enable rules of ipfw my server collapsed
I enable ipfw rules on my mail server. After some time server collapsed. In /var/log/messages is nothing information of my damage. But when I connected monitor, I saw some troubles with swap
...
0
votes
0
answers
122
views
ipfw not send mail to another domain
I configure ipfw for a local mail server. Everything works fine, but after a while (from one and a half days to a couple of hours) incorrect work is observed: mail from other domains comes, but mail ...
1
vote
0
answers
656
views
iptables NAT not being applied to packets coming from dummynet
I have a setup where I have multiple interface aliases (with private IPs) for the primary network interface (eth0).
eth0 Link encap:Ethernet HWaddr 0a:ed:01:17:53:b4
inet addr:10.0....
0
votes
0
answers
399
views
ipfw blocks IPs not in table
FreeBSD this_server 10.3-RELEASE-p11 FreeBSD 10.3-RELEASE-p11 #0: Mon Oct 24 18:49:24 UTC 2016
IPFW seems to be full of ghosts for me. Here is an example.
First the evidence of blocking with my IP ...
1
vote
1
answer
237
views
IPFW denies ssl connections
I'm having an issues loading https websites (google, facebook, amazon) through my PHP scripts using functions like fsockopen, file_get_contents. Operation is being timed out. So I started looking ...
-1
votes
1
answer
113
views
IPFW interface with special character
I'm new using FreeBSD and IPFW, but in my work we need to change from GNU/Linux, using IPtables, to FreeBSD and IPFW to packege filter. We have some rules in IPtables script that we need to put on ...
1
vote
0
answers
30
views
Simple anti DDoS protection in FreeBSD [duplicate]
I have a lot of request from data centers to my web server on FreeBSD and sometimes it've have a lot of performance problem with my web projects. Adding to IPFW list all IP's data centers is ...
0
votes
1
answer
1k
views
redirect IP on osx
On my Mac OS X (10.6.8) I'd like to make all requests for 111.111.111.111 go to 222.222.222.222 for all ports. To test this, I have a webserver at 222.222.222.222:80 which will respond with a page for ...
0
votes
1
answer
3k
views
using pf for packet filtering and ipfw's dummynet for bandwidth limiting at the same time
I would like to ask if it's fine to use pf for all packet filtering (including using altq for traffic shaping) and ipfw's dummynet for bandwidth limiting certain IPs or subnets at the same time.
I am ...
1
vote
1
answer
3k
views
Limit Connections Per IP Windows 2008 R2 x64
Hello I have been searching for a solution to this, what I want to accomplish is the ability for me to define firewall rules that will limit the amount of connections to certain ports from the same ...
0
votes
1
answer
4k
views
FreeBSD 10 IPFW IPv6
I'm struggling to allow IPv6 connections on my FreeBSD 10 server.
I have a working IPv6 connection. But IPFW blocks all the IPv6 traffic.
#!/bin/sh
#
# flush existing rules
ipfw -q flush
# allow ...
1
vote
1
answer
126
views
Mac OS X Firewall isn't firewalling
Rather confused by the results I'm getting on a Mac OS X Server running 10.8. I have an app that is running a web server on port 8000, which I want to be visible only to localhost. This seems ...
1
vote
1
answer
2k
views
FreeBSD jail with IPFW with loopback - unable to connect loopback interface
I am trying to configure a one IP jail with loopback interface, but I am unsure how to configure the IPFW rules to allow traffic to pass between the jail and the network card on the server.
I have ...
1
vote
0
answers
108
views
Check-state counter is always zero
My firewall rules are:
00010 660 73050 allow ip from any to any via lo0
00011 0 0 deny ip from any to 127.0.0.0/8
00012 0 0 deny ip from 127.0.0.0/8 to any
...
24
votes
1
answer
35k
views
Hostname to Localhost with Port - OSX [closed]
I am trying to run multiple Node.js web servers locally on my machine.
Because the code I'm writing needs to reference a domain name I'd like to keep a convention of dev.myHost.com and point that to ...
0
votes
1
answer
1k
views
IPFW Forward outgoing traffic
So i have a single BSD firewall using NATD and IPFW. This firewall has 5 static IP's assigned to it.
Using NATD i can easily forward and entire external ip to an internal ip. But when the internal ...
2
votes
2
answers
682
views
ipfw based firewall slows down Apache web server
I have an Apache web server running on a FreeBSD 8.3 machine.
That machine has an ipfw firewall with these rules:
root@aigamedev:~# ipfw -a list
00005 0 0 deny ip from 67.212.xxx.xxx to any
...
1
vote
1
answer
915
views
Simulating latency to a URL using ipfw
How can I simulate latency to a single URL?
I tried following to simulate latency to a single URL by adding a ipfw rule.
sudo ipfw add pipe 1 ip from myurl.com to any
#(response of running above ...
0
votes
1
answer
200
views
HTTPD dies on FreeBSD if multiple connenctions are open from same client
I've asked this question on StackOverflow, but nobody answered, until yesterday... and the answer was a suggestion... to ask this here :). So... can someone help me with this :
I'm new in networking ...
1
vote
0
answers
101
views
Restrict "open" ethernet traffic to OpenVPN Traffic only when on a certain network
I would like to set up a pf or ipfw firewall rule on my Mac OS X 10.8 notebooks so that all Traffic on wireless and cabled networks is restricted to calling "home" through OpenVPN when I'm not in the ...
1
vote
0
answers
2k
views
Local transparent proxy with ipfw and squid
I want to use a local transparent proxy to have a single place to enter the password to an office proxy. Basically, all the TCP packets sent to port 80 except the ones sent to specific subnet should ...
6
votes
1
answer
4k
views
FreeBSD Jail with Loopback IP, IPFW, and natd - Outbound connections fail from jail
I've got a FreeBSD 9.0 server. It has several jails, but they all have this same issue. They can not initiate connections to the outside world. They communicate with each other and the host fine.
...
1
vote
2
answers
2k
views
Port forwarding in Mountain Lion
This HAS to be something that can be done. I've searched and found many answers that claim to do what I want, but I can't seem to put it together. So...
I am running a Linux virtual machine under ...
0
votes
1
answer
671
views
Why do these ipfw delayed pipes have no effect?
I'm on OSX 10.7.5 and am attempting to add some latency to the connection to my personal domain with ipfw, using this article as a guide. Normal latency:
> ping -c5 troutwine.us ...
2
votes
1
answer
886
views
ipfw strange rules after reboot
I set this lines in my rc.conf:
firewall_enable="YES"
firewall_type="/etc/ipfw.rules"
cat /etc/ipfw.rules
add 02020 deny ip from table(10) to any
add 02030 deny ip from table(11)...
5
votes
1
answer
5k
views
OS X 10.8: redirecting locally initiated ssh connections to localhost:22
I need to hack the OS X pf to redirect all ssh connections from an user to this machine. I want, when doing
$ ssh google.com
to get the same results as with
$ ssh localhost
ie a connection to my ...
0
votes
1
answer
443
views
Server freeze on flushing ipfw
I got strange problem with ipfw on FreeBSD 8.2, the problem is when I'm trying to flush the ipfw , by the following command:
/sbin/ipfw -q -f flush
or
/sbin/ipfw flush and then y
My dedicated ...
0
votes
2
answers
7k
views
Redirecting port 80 requests to local web server with IPFW
I'm setting up a freebsd router and want certain IPs on my network to be forwarded to our local webserver if they make port 80 requests.
An example would be - banned user tries to surf the web, but ...
1
vote
3
answers
2k
views
Will dropping only SYN packets improve or decrease firewall performance?
I'm setting ipfw, and the following was suggested to me: If I make the rule only to drop SYN packets for TCP, no connection could be established and the firewall won't even have to look at other ...
1
vote
2
answers
562
views
ipfw not delaying requests on localhost (OS X)
I'm trying to add some latency to a connection to a webapp running on localhost:8080 (Tomcat). I've tried adding the following:
sudo ipfw pipe 1 config delay 500ms
sudo ipfw add 1 pipe 1 dst-port ...
2
votes
1
answer
2k
views
Traffic shaping with tc doesn't work for high delay and bandwidth
I'm using tc with kernel 2.6.38.8 for traffic shaping. Limit bandwidth works, adding delay works, but when shaping both bandwidth with delay, the achieved bandwidth is always much lower than the limit ...
3
votes
1
answer
2k
views
Why isn't ipfw correctly limiting the bandwidth?
I've played around with the ipfw command on a Mac and tried to limit the bandwidth to 1MBit/s.
sudo ipfw add pipe 1 ip from any to me
sudo ipfw pipe 1 config bw 1MBit/s
These are the statements I'm ...
2
votes
1
answer
549
views
IPFW settings to allow trusted client to connect to Mac (e.g., over ssh)
I have the following ipfw settings on my Mac OS X 10.4 Tiger:
00100 allow ip from any to 123.123.123.123
00110 allow tcp from any to 123.123.123.123
00120 allow udp from any to 123.123.123.123
00130 ...
1
vote
1
answer
2k
views
ipfw rule to forward all traffic through a local proxy
I want to set up a local http proxy for testing and stubbing apps that make external api calls over http.
I'm not sure the best way to do this with ipfw, I want to run my proxy as a particular user, ...
0
votes
1
answer
3k
views
Setup a local bridged connection using VirtualBox
I'm trying to forward/masquarade some trafic from my guest CentOS6 (virtualbox with bridged connection). Host is OSX Lion. Here is my network layout:
en1 - host iface
address: 78.251.xx.yy
...
2
votes
1
answer
3k
views
Converting iptables command to ipfw
I am trying to convert code I made on ubuntu work with osx.
I do not know how to convert the iptables commands to ipfw commands.
Any help would be appreciated.
Ubuntu Code:
echo 1 > /proc/sys/net/...
1
vote
0
answers
1k
views
Freebsd, ipfw sched - config type = QFQ get frozen
I have some freebsd soft-router
$uname -r
8.2-STABLE
code for ipfw:
pipe 50 config bw 70Mbit/s
sched 50 config type QFQ
queue 502 config sched 50 weight 1 mask dst-ip 0xffffffff
queue 501 ...
2
votes
1
answer
470
views
What is the difference between using ipfw and hosts.deny in terms of security?
I'm in the middle of securing an OSX server that is the target of hundreds of automated requests per second from Chinese, Russian and US servers (see: Recovering a server from being an open relay).
I'...
1
vote
1
answer
267
views
Recovering a server from being an open relay
One of our Mac Pro machines running Apache was inadvertently acting as a forward proxy with a public IP, after some organisation proxy rules changed.
Consequently it was discovered by spammers and ...
2
votes
1
answer
1k
views
ipfw - purpose of outgoing keep-state?
I'm looking over the ipfw rules for our webserver and it struck me that we use check/keep-state on all outgoing traffic. We only have a handful ports open in both directions. We dont have much ...
2
votes
2
answers
18k
views
Block IP addresses with ipfw
I'm a total noob to ipfw so my apologies in advance if my questions are basic, but I've not found any resources for it that help with the gap between using the GUI and knowing the commandline ipfw ...
0
votes
2
answers
513
views
FreeBSD 4.7 missing IPFW - How do I install it?
I have two FreeBSD servers that are on 4.7. These are two older servers that were already configure and setup when I got here. Now that the original admins are gone, I've started looking a bit more at ...
0
votes
1
answer
528
views
port forwarding to server outside dmz from one inside dmz
we are running mysql replication between a server outside dmz and one inside dmz, for this we need port forwarding. We have had it set up, but it recently stopped working. Just before we added a rule (...
0
votes
1
answer
4k
views
How to install ipfw / DummyNet on Ubuntu 10.10?
There seems to be a man page an ipfw but I can't find what package I have to install to use ipfw / DummyNet. Any hints?
1
vote
2
answers
257
views
Snow Leopard Server on Macbook Pro
I currently use my MBP7,1 as my primary computer, running 10.6 and Win7. I would like to switch to OSX Server so I can have a bit more control over the network services and ipfw. is it possible to run ...
0
votes
1
answer
5k
views
Using NTPD on OpenBSD to get time from Linux using portforwarding
This is a rehash of another question, now that I understand things a bit better.
I have the following network set up:
NTP
10.21.3.169
| \______________
| \
10....