download

Chapter 12You can then verify the change by using the ipfw show command:# ipfw show00100 0 0 allow ip from 192.168.1.0/24 to any65535 8465 888556 deny ip from any to anyThe ipfw show command shows the current "static" ruleset, and does not show anydynamically created rules, by default. The static ruleset is the ruleset that you havecreated. On the other hand, IPFW also adds "dynamic" rules to your ruleset, whichwe will discuss later in this chapter.As you may have noticed, the last line of the ipfw show command output is thedefault firewall action. In any case, if the packet going through the firewall rulesdoes not match any of the rules, this rule is applied to the packet. In this case, thedefault behavior of the firewall is to "deny" any packet that did not match any rulein the ruleset. This rule is always the last rule (number 65535), and cannot bemanually modified.Another note about the ipfw show command is that it shows the number of packetsmatched with each rule, (second column) and the traffic volume in bytes (thirdcolumn), which is very useful while troubleshooting your firewall configuration.To change the default firewall behavior, you should reconfigure your kernel byadding the IPFIREWALL_DEFAULT_TO_ACCEPT option, or by simply adding anotherrule right before the last statement:# ipfw add 65000 allow ip from any to anyThough it is not recommended to have a default permit rule in yourfirewall configuration, this is needed in some configurations.Ruleset TemplatesNow that you know the basic configuration syntax for ipfw, you can create asimple firewall ruleset for your host. Your FreeBSD 7 system also includes severalconfiguration templates defined in the /etc/rc.firewall configuration file that arequite useful in some scenarios.[ 187 ]