Learn FreeBSD - IPFW & Alternative Packet Filtering

#Introduction

In the previous episode 12, you mastered pf and NAT. Now we explore alternative packet filtering: IPFW, plus a comparison with pf and ipfilter. Not every requirement is the same, and choosing the right tool is part of an administrator's craft.

IPFW has a long history in FreeBSD and is known for its highly precise, rule-number based syntax. This episode also introduces packet analysis tools — tcpdump, ngrep, and netstat — which become your eyes on the network layer.

#IPFW: The Rule-Number Packet Filter

#Basic Concepts

IPFW manages traffic with numbered rules. The number determines evaluation order — small numbers are evaluated first. These rules live in the kernel and are managed with the ipfw command.

#Loading the Kernel Module

IPFW is a kernel module that needs to be loaded:

kldload ipfw
kldstat | grep ipfw

To load it automatically at boot, add it to /etc/rc.conf:

sysrc firewall_enable="YES"
sysrc firewall_type="open"

#Basic Syntax

ipfw add 100 allow ip from any to any via lo0
ipfw add 200 allow tcp from any to me dst-port 22
ipfw add 300 allow ip from me to any
ipfw add 400 deny ip from any to any

Each rule has a unique number. The rule allow tcp from any to me dst-port 22 opens SSH, and deny ip from any to any at the end becomes the default that denies.

#Managing Rules

View active rules, add them, and remove them:

ipfw list
ipfw add 500 count ip from any to any
ipfw delete 500
ipfw flush

ipfw flush removes all rules — use it very carefully because it can cut the network.

#Tables in IPFW

IPFW also supports tables for dynamic address lists:

ipfw table 1 create type addr
ipfw table 1 add 203.0.113.7
ipfw add 1000 deny ip from table\(1\) to any

IPFW tables are updated at runtime without reloading rules — a useful pattern for dynamic blacklists, like pf tables.

#Comparing pf vs IPFW vs ipfilter

#Packet Analysis

#tcpdump: Your Eyes on the Network

tcpdump is the standard packet analysis tool. Examples of its use:

tcpdump -i em0 -n
tcpdump -i em0 -n port 80
tcpdump -i em0 -n host 192.168.1.100

-i selects the interface, -n disables name resolution, and filters like port or host narrow down the capture.

#ngrep: Grep for the Network

ngrep searches for patterns in packet payloads — like grep for network traffic:

ngrep -d em0 "GET /"
ngrep -d em0 -W byline "password"

ngrep is useful for verifying protocol contents, for example confirming the HTTP request you sent is correct.

#netstat: Statistics and Connections

netstat displays connection tables, interface statistics, and routing:

netstat -an
netstat -Lan
netstat -rn

netstat -Lan lists listening sockets — a quick way to check which services are open. netstat -rn displays the routing table.

#A Complete Troubleshooting Flow

When there's a connection problem, follow this order of tools:

1. ifconfig em0 — make sure the interface and IP are correct.
2. netstat -rn — make sure the routing makes sense.
3. ping and traceroute — test the path.
4. tcpdump -i em0 — see the packets actually traveling.
5. Check the firewall (pf or ipfw) and its logs.

ifconfig em0
netstat -rn
ping -c 3 8.8.8.8
tcpdump -n -i em0 icmp

#Closing

In this episode 13, you learned IPFW with its rule-number syntax and tables, compared pf vs IPFW vs ipfilter, and covered the packet analysis tools tcpdump, ngrep, and netstat. You now have two built-in firewalls in your arsenal, plus the ability to analyze what's happening on the network.

Key takeaways:

• IPFW uses rule numbers for evaluation order; ipfw list for inspection.
• Load the ipfw module via kldload or firewall_enable in rc.conf.
• pf is easier for new projects; IPFW for explicit ordering control.
• tcpdump and ngrep are your eyes; netstat -Lan maps open ports.
• Troubleshooting follows the order: interface, routing, ping, tcpdump, firewall.

In the next episode, episode 14, we'll cover OpenSSL, TLS & certificates — creating certificates with openssl, managing the trust store with ca_root_nss, hardening SSH with ed25519, and tunneling for secure access. Transport-layer security starts here.