Using IPFW Timed Rules: Tech Support Guide
In this article, we will discuss how to use IPFW timed rules, a powerful feature of the IPFW firewall in BSD systems. We will cover key concepts, provide examples, and help you understand how to properly configure and activate timed rules.
What are IPFW Timed Rules?
IPFW timed rules allow you to schedule firewall rules to be activated or deactivated at specific times. This is particularly useful for implementing temporary security policies, such as blocking access to certain services during off-hours to improve system security.
Key Concepts
Before diving into the specifics of IPFW timed rules, it is important to understand some key concepts:
- Rule number: Each firewall rule is assigned a unique number, which is used to identify and manage the rule.
- divert number: A divert number is used to redirect traffic to a specific command or script for further processing.
- Timed rules table: The timed rules table is a separate table that stores all the timed rules. This table is independent of the main IPFW rules table.
Activating Timed Rules
To activate timed rules, you need to add them to the timed rules table using the ipfw add command with the timed option. The general syntax for adding a timed rule is as follows:
ipfw add timed N ruleWhere N is the rule number and rule is the firewall rule you want to add.
For example, to add a timed rule that blocks all incoming traffic on port 80 from 10 PM to 6 AM, you would use the following command:
ipfw add timed 123 deny tcp from any to any 80 from 22:00 to 06:00In this example, rule number 123 is added to the timed rules table and will block all incoming traffic on port 80 from 10 PM to 6 AM. Note that the time is specified in 24-hour format (HH:MM).
Verifying Timed Rules
To verify that timed rules have been added to the timed rules table, you can use the ipfw list timed command. This command will display all the timed rules in the table, along with their corresponding rule numbers and activation times.
# ipfw list timed
65001 deny tcp from any to any 80 from 22:00 to 06:00
65002 deny udp from any to any 123 from 01:00 to 05:00
Deactivating Timed Rules
To deactivate a timed rule, you can use the ipfw delete command with the timed option and the rule number. For example, to deactivate the timed rule with rule number 123, you would use the following command:
ipfw delete timed 123IPFW timed rules provide a powerful way to schedule firewall rules to be activated or deactivated at specific times. By understanding key concepts and using the ipfw add and ipfw delete commands with the timed option, you can easily manage timed rules and improve your system's security.