Understanding iPFW Correspondence with pf Commands
This article focuses on the IPFW (Internet Packet Filter) firewall in FreeBSD, providing a detailed explanation of how iPFW commands correspond to pf firewall commands. The aim is to help system administrators understand the relationship between the two and facilitate a smooth transition from iPFW to pf.
IPFW Basics
IPFW is a stateful firewall that operates at the IP level. It is configured using the ipfw command, with rules specified in a table format. Each rule has a unique number, and rules are processed in ascending order. IPFW supports various match criteria, including source and destination IP addresses, ports, and protocols.
PF Basics
PF (Packet Filter) is a stateful firewall included in OpenBSD and available as an add-on for other BSD systems. It is configured using the pf.conf file, with rules written in a simple, intuitive syntax. PF supports various features, such as state tracking, normalization, and traffic shaping.
IPFW vs. PF: Correspondence and Equivalence
While IPFW and PF have different syntaxes, they share many similarities in functionality. The following table outlines the correspondence between IPFW commands and their pf equivalents:
| IPFW Command | PF Equivalent |
|---|---|
ipfw add allow from any to any |
pass all |
ipfw add deny from any to any |
block all |
ipfw add deny log from any to any |
block log all |
ipfw add fwd dst_ip,dst_port tcp from any to any |
rdr pass on interface to dst_ip port dst_port |
ipfw add check-state |
state-policy if-match |
IPFW: deny, matches block, pass, accept, permit
In IPFW, the deny command is equivalent to the pf block command. Both commands prevent traffic from passing through the firewall. The difference is that IPFW has a matches keyword that can be used with the deny command to specify additional match criteria. In pf, these criteria can be added using the match keyword.
The pass and accept commands in IPFW are equivalent to the pass command in pf. Both commands allow traffic to pass through the firewall.
The permit command in IPFW is not directly equivalent to any pf command. Instead, it is used to override a previous deny or reject rule, effectively allowing traffic to pass through the firewall. In pf, this can be achieved using the pass command with the quick keyword, which stops processing further rules if the current rule matches.
IPFW: fwd, redirect-to, rdr-to, rdr
IPFW uses the fwd command to forward traffic to a different destination IP address and port. In pf, this can be achieved using the rdr command with the pass keyword, which redirects traffic to a new destination IP address and port.
IPFW: check-state
IPFW uses the check-state command to enable stateful inspection. In pf, stateful inspection is enabled by default, and the state-policy keyword can be used to specify the state-matching policy.
This article has provided a detailed explanation of the correspondence between iPFW and pf commands. By understanding the similarities and differences between the two, system administrators can more easily transition from iPFW to pf and take advantage of the advanced features offered by pf.
References
--endarticle--
Regarding your question, the iPFW route-to command corresponds to the pf rdr-to or redirect-to commands. These commands are used to redirect incoming traffic to a different destination IP address and port. The dup-to option in iPFW is similar to the dup-to keyword in pf, which duplicates incoming packets and sends them to a different destination. The reply-to option in iPFW is equivalent to the reply-to keyword in pf, which sends replies to a different IP address and port.