Any ideas why this rule won't parse?

ipfw add 10 deny ip from \{ not and not \} to any 53 out xmit wan0

ipfw doesn't like and and says: ipfw: missing ")"

I've tried other variants, for example, putting the not in front of the brace expression, putting the two IPs in a table and then saying not table(xyzzy) and nothing will work.

Is there a way to express this with ipfw?

  • Placing and inside braces is not valid syntax. Placing not in front of braces is not valid syntax. However, placing not in front of a table declaration should be valid. Jan 29, 2021 at 10:30
  • Additionally, sets of alternative match patterns (or-blocks) can be constructed by putting the patterns in lists enclosed between parentheses ( ) or braces { }, and using the or operator as follows: ipfw add 100 allow ip from { x or not y or z } to any (Citing from ipfw(5) )
    – pnadeau
    Feb 1, 2021 at 21:02
  • Exactly, you have used and, but the manual only mentions using or. Feb 1, 2021 at 21:07

1 Answer 1


As already mentioned in comments, inside an {...} or-block the individual options can only be grouped with or conditions. An and condition is implicitely assumed for all the present options, and a not condition can be prefixed to any single option. In the old syntax the rule would be written like this:

ipfw add 10 deny ip from not, to any 53 out xmit wan0

Alternatively, with the new syntax, which does not require from ... to, and instead consists only of a list of arbitrary options:

ipfw add 10 deny proto ip not src-ip not src-ip dst-port 53 out xmit wan0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .