src/sbin/ipfw/Makefile, branch mainFreeBSD source treehttps://cgit-dev.freebsd.org/src/atom?h=main2025-08-25T11:13:27Zipfw: Add tests for the NPTv6 rule parser2025-08-25T11:13:27ZDag-Erling Smørgravdes@FreeBSD.org2025-08-21T17:47:41Zurn:sha1:d879f1c8961d99bdbe6727004bfc6c23924526f8Remove residual blank line at start of Makefile2024-07-15T22:43:39ZWarner Loshimp@FreeBSD.org2024-07-15T04:46:32Zurn:sha1:e9ac41698b2f322d55ccf9da50a3596edb2c1800
This is a residual of the $FreeBSD$ removal.
MFC After: 3 days (though I'll just run the command on the branches)
Sponsored by: Netflix
Remove $FreeBSD$: one-line sh pattern2023-08-16T17:55:03ZWarner Loshimp@FreeBSD.org2023-08-16T17:55:03Zurn:sha1:d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf
Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
ipfw: Introduce dnctl2021-09-08T15:17:50ZKristof Provostkp@FreeBSD.org2021-05-25T14:54:32Zurn:sha1:0b95680e077b7ef5bc6930c7c0f1a41106251d5d
Introduce a link to the ipfw command, dnctl, for dummynet configuration.
dnctl only handles dummynet configuration, and is part of the effort to
support dummynet in pf.
/sbin/ipfw continues to accept pipe, queue and sched commands, but these can
now also be issued via the new dnctl command.
Reviewed by: donner
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D30465
ipfw(8): Fix most warnings with the default WARNS level.2020-07-13T17:51:04ZMark Johnstonmarkj@FreeBSD.org2020-07-13T17:51:04Zurn:sha1:56707bee4b34c53ade245709397addac02c53726
- Add missing const and static qualifiers.
- Avoid shadowing the global "co" by renaming it to "g_co".
- Avoid mixing signedness in loop bound checks.
- Leave -Wcast-align warnings disabled for now.
Reviewed by: ae, melifaro
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D25456
Add NAT64 CLAT implementation as defined in RFC6877.2019-03-18T11:44:53ZAndrey V. Elsukovae@FreeBSD.org2019-03-18T11:44:53Zurn:sha1:5c04f73e07b97ba421d072b7679e8ef477b8babc
CLAT is customer-side translator that algorithmically translates 1:1
private IPv4 addresses to global IPv6 addresses, and vice versa.
It is implemented as part of ipfw_nat64 kernel module. When module
is loaded or compiled into the kernel, it registers "nat64clat" external
action. External action named instance can be created using `create`
command and then used in ipfw rules. The create command accepts two
IPv6 prefixes `plat_prefix` and `clat_prefix`. If plat_prefix is ommitted,
IPv6 NAT64 Well-Known prefix 64:ff9b::/96 will be used.
# ipfw nat64clat CLAT create clat_prefix SRC_PFX plat_prefix DST_PFX
# ipfw add nat64clat CLAT ip4 from IPv4_PFX to any out
# ipfw add nat64clat CLAT ip6 from DST_PFX to SRC_PFX in
Obtained from: Yandex LLC
Submitted by: Boris N. Lytochkin
MFC after: 1 month
Relnotes: yes
Sponsored by: Yandex LLC
Allow jail names (not just IDs) to be specified for: cpuset(1), ipfw(8),2018-07-03T23:47:20ZJamie Grittonjamie@FreeBSD.org2018-07-03T23:47:20Zurn:sha1:de68a3200a6cdba2011026d36bea45193363ace0
sockstat(1), ugidfw(8)
These are the last of the jail-aware userland utilities that didn't work
with names.
PR: 229266
MFC after: 3 days
Differential Revision: D16047
Add ipfw_nat64 module that implements stateless and stateful NAT64.2016-08-13T16:09:49ZAndrey V. Elsukovae@FreeBSD.org2016-08-13T16:09:49Zurn:sha1:d8caf56e9e9c471ba2adb01c26a4100ef0f8a606
The module works together with ipfw(4) and implemented as its external
action module.
Stateless NAT64 registers external action with name nat64stl. This
keyword should be used to create NAT64 instance and to address this
instance in rules. Stateless NAT64 uses two lookup tables with mapped
IPv4->IPv6 and IPv6->IPv4 addresses to perform translation.
A configuration of instance should looks like this:
1. Create lookup tables:
# ipfw table T46 create type addr valtype ipv6
# ipfw table T64 create type addr valtype ipv4
2. Fill T46 and T64 tables.
3. Add rule to allow neighbor solicitation and advertisement:
# ipfw add allow icmp6 from any to any icmp6types 135,136
4. Create NAT64 instance:
# ipfw nat64stl NAT create table4 T46 table6 T64
5. Add rules that matches the traffic:
# ipfw add nat64stl NAT ip from any to table(T46)
# ipfw add nat64stl NAT ip from table(T64) to 64:ff9b::/96
6. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96
via NAT64 host.
Stateful NAT64 registers external action with name nat64lsn. The only
one option required to create nat64lsn instance - prefix4. It defines
the pool of IPv4 addresses used for translation.
A configuration of instance should looks like this:
1. Add rule to allow neighbor solicitation and advertisement:
# ipfw add allow icmp6 from any to any icmp6types 135,136
2. Create NAT64 instance:
# ipfw nat64lsn NAT create prefix4 A.B.C.D/28
3. Add rules that matches the traffic:
# ipfw add nat64lsn NAT ip from any to A.B.C.D/28
# ipfw add nat64lsn NAT ip6 from any to 64:ff9b::/96
4. Configure DNS64 for IPv6 clients and add route to 64:ff9b::/96
via NAT64 host.
Obtained from: Yandex LLC
Relnotes: yes
Sponsored by: Yandex LLC
Differential Revision: https://reviews.freebsd.org/D6434
Add ipfw_nptv6 module that implements Network Prefix Translation for IPv62016-07-18T19:46:31ZAndrey V. Elsukovae@FreeBSD.org2016-07-18T19:46:31Zurn:sha1:b867e84e95a6c33895d69e3b9de791e0459cb4b7
as defined in RFC 6296. The module works together with ipfw(4) and
implemented as its external action module. When it is loaded, it registers
as eaction and can be used in rules. The usage pattern is similar to
ipfw_nat(4). All matched by rule traffic goes to the NPT module.
Reviewed by: hrs
Obtained from: Yandex LLC
MFC after: 1 month
Relnotes: yes
Sponsored by: Yandex LLC
Differential Revision: https://reviews.freebsd.org/D6420
Create packages for atm, ccdconfig, devd, ipf, ipfw,2016-02-09T19:30:31ZGlen Barbergjb@FreeBSD.org2016-02-09T19:30:31Zurn:sha1:7de1daeb932770462bc659424c411301e7efc4c2
iscsi, natd, nandfs, pf, quotacheck, and routed.
Add ping6 and rtsol to the runtime package.
Sponsored by: The FreeBSD Foundation