IP Filter FAQ

Welcome to the IP Filter Frequently Asked Questions. This FAQ contains a lot of useful information and if you use, or plan to use IPF, you should read it. Here is some information about the FAQ:
  1. The latest version can be found at http://www.phildev.net/ipf/
  2. You may copy it, mirror it, distribute it at will as long as you do so IN ITS ENTIRETY
  3. The FAQ was written, and currently maintained by Phil Dibowitz so please direct any updates, or questions there.
  4. The FAQ doesn't address bugs in versions prior to 3.4.20 (other than how to upgrade to that level). If you find a bug not on here, and you don't have a recent version, you should try upgrading.
Additionally I would like to thank Darren Reed, Jim Sandoz, Ron Florence, Erik Fichtner, Glen Foster, and everyone else who has contributed for all of their help.

NOTE: Do NOT email me with your IPF questions and problems. Email the mailing list. ONLY email me about THIS FAQ (corrections, additions, etc.).

NEW!: The whole FAQ in one page.
NEW!: There is now a Changelog.

Last updated: 11/09/09


I. General
  1. Who wrote IP Filter?
  2. What is the website for IP Filter?
  3. Is there a tutorial?
  4. What OS's does it run on?
  5. I want to distribute IPF with my product XYZ. Is that allowed, and what do I need to do?
  6. I want to use IPF code in a product I'm working on that I intend to sell. Is that allowed, and what do I need to do?
  7. I want to use IPF code in a product I'm planning on giving away for free. Is that allowed, and what do I need to do?
  8. How does the release process for IPF work?
II. Mailing List
  1. What mailing list(s) is/are available for IP Filter?
  2. What do I need to know before sending stuff to the list?
  3. What should I ALWAYS do when sending stuff to the list?
  4. What should I NEVER do when sending stuff to the list?
  5. Are there archives for the mailing list?
III. Common Questions about IP Filter
  1. What does keep state actually do? Is it useful?
  2. What is with this last match stuff?
  3. What is "in" and what is "out"?
  4. Does IP Filter actually work on BSD/OS? What do I need to make it work?
  5. I'm using PPPoE (or some other virtual interface/tunnel), how should I write my rulesets?
  6. So, if 'map a.b.c.d/M -> w.x.y.z/32' does NAT for all protocols, why do I need a 'map a.b.c.d/M -> w.x.y.z/32 portmap'
  7. Well, after reading the answer to III-6, do I have to have the first rule if I have the second rule?
  8. How do I upgrade IPF?
  9. I have a dynamic IP address, how can I do NAT?
  10. What's the difference between RDR, MAP and BIMAP?
  11. When does NAT happen in relation to filtering?
  12. Are there any GUI's or other aids?
  13. Are there any log analyzers?
  14. How do you clear accounting stats?
  15. What do I handle DNS if I have a NAT'ed LAN?
  16. I don't run DNS, but see a lot of tcp/53 packets with the SA flags set in my logs. Is this an attack on my machine?
  17. Can you filter the loopback interface (lo0)?
  18. I'm seeing port scans in my logs, what should I do?
  19. How do I use archie from machines behind IP Filter?
  20. How does quick affect head rules?
  21. How do I get the FTP Proxy to work for my firewall if I have a dynamic IP address?
  22. I've written a patch for XYZ feature/bug. Where do I send it?
  23. How do I use MRTG to display ip-filter statistics? Is there a MIB for ip-filter?
  24. What do the states ("ST") in statetop mean?
  25. How do I enlarge the state table? What else should be tweaked for high-stress installs?
  26. Is there a way to remove a specific live NAT mapping or IPF state?
  27. How many rules can IPF handle without noticeable performance loss?
  28. How can I configure IPF so that laptops can connect to services on the firewall from the internal LAN and from the outside world using the external addresses, so they don't have to be reconfigured all the time?
  29. How do you use the IPSec Proxy?
  30. How do you use the H.323 Proxy?
  31. How do you use the RAudio Proxy?
  32. Is it possible to have multipe head statements for a group?
  33. Can you use ipnat/proxies on a bridge?
  34. How do I make ping and traceroute work?
  35. In IPF 4.x, it's supposedly possible to "simple matching of content for TCP session startup" - how does that work?
  36. Can I have variables in my ipf.conf/ipnat.conf?
IV. Common Problems with IP Filter (non-OS Specific)
  1. I have file transfer (FTP or HTTP) and if download speed is more then 100 KB/sec, connection breaks.
  2. I have to keep clearing the state table or IPF dies, why?
  3. The default ipfboot script flushes the state table. Is this necessary every time you change some rule or just when that rule has a 'keep state' in it and there are existing state table entries that would be affected?
  4. Sending mail is horribly slow!
  5. I can't connect to IRC.
  6. When I try to load the LKM (if_ipl.o), I get "fr_checkp" (or other) unresolved symbols. (FreBSD, OpenBSD, SunOS)
  7. When I do a make, it complains about -I(TOP).
  8. I'm using rdr for a webserver behind IPF and the world can see it just fine, but the internal machines can't surf to it via the external IP address.
  9. Long ftp transfers and some other long single-connection sessions fail.
  10. I've set up to use the ftp-proxy in my ipnat.conf file, and it works fine from NAT'ed machines, but I can't ftp from the firewall machine unless I put a rule in ipf.conf to pass port 20/tcp in from remote machines. How do I get the ftp proxy to work from the firewall machine too?
  11. I'm using NAT and I can't ping the same machine on the internet from two different machines on my LAN at the same time.
  12. Keep state stops working - it won't make new states.
  13. I'm using log body in my rules but the body of the packet isn't getting logged.
  14. I have an FTP server behind an IPF firewall, and I'm having problems serving passive FTP.
  15. I can't seem to use round-robin load balancing with more than two hosts!
  16. I'm having problems with ipnat (e.g. can't get proxies to work with bimap, or some other problem).
  17. I'm using interface/32, 0/0 or 0/32, and it doesn't work!
  18. I stop/unload IPF, but it magically reloads itself!
  19. I'm having problems connecting to Cisco VPNs through IPF NAT.
  20. I'm trying to remove entries from a pool and getting errors.
V. IPFilter and VPN
  1. I can only initiate x number of VPN connections to/from my NAT'd boxes! Why?
  2. I'm having more VPN problems... ESP packets and UDP packets are not being mapped to the same IP ddress.
  1. I have IPMon logging to syslog, but syslog doesn't log anything, why not?
  2. I have IPMon logging to syslog, and I can't use ipmon -oI, why not?
  3. When I start ipmon, it fails to start with an error.
  4. I'm getting wierd ipmon log entries, why?
  5. Can I make IPF log straight to a file instead of to syslog?
VII. IPFilter and Solaris
  1. Why don't my return-rst's work?
  2. It won't compile, something about /usr/ucb/cc.
  3. I'm using a 64-bit kernel, and when it tries to load ipf, it gets an error.
  4. How can I tell if I'm using a 32-bit or 64-bit kernel?
  5. Can I use gcc to make 64-bit Sparc kernel modules?
  6. What do I need to make a 64 bit Sparc kernel module?
  7. Wait, my Sparc host is running in 64 bit mode, but I don't want to buy Sun's Forte compiler, nor do I want to install the try-and-buy. What can I do to get IPF up?
  8. When I try to pkgadd the precompiled IPF package I downloaded, there are two sub-packages. What do I do?
  9. Can I use IPF on Solaris as a Layer 2 bridge?
  10. How can I tweak some of IPF's internal values at boot time?
  11. How can I build a transparent proxy using Squid on Solaris 8?
  12. Why can't I filter on the loopback interface, or virtual interfaces?
  13. How do I make StateTop work on Solaris?
  14. I'm using sppp, IPSec, or some other IP Tunnel and I'm seeing random system crashes or CPU "thrash," what do I do?
  15. I'm using a Sun system with an eri or bge interface, and after setting up NAT, ICMP passes through fine, but TCP doesn't. Why?
  16. Aren't there any 64-bit IP Filter binaries for Solaris out there already?
  17. Since upgrading to Solaris 9, I've been having wierd crashes. Is this IPF related? What can be done?
  18. Where are the instructions for installing on Solaris 7/8/9/etc.?
  19. I'm getting /usr/include/ia32/sys/reg.h:300: error: parse error before "upad128_t" when I compile IPF, why?
  20. In IPF 4.x, you can supposedly compile the rules into an LKM. How do you do this in Solaris?
  21. In IPF 4.x, what is the performance gain in compiling your rulset into an LKM?
  22. In IPF 4.x, I'm trying to build with gcc3 but it's not working!
  23. How do I compile IPF 4.x with gcc?
  24. How do I remove the IPF that comes with Solaris 10 and replace it with Darren's public-domain release?
  25. I installed IP Filter with Solaris 10, but there's no init scripts!
  1. none
  1. Does IPF Support HP-UX?
X. FreeBSD
  1. How can I set up bridging on FreeBSD?
  2. How can I get IP Filter to block by default?
  3. What version of IPF is included in FreeBSD?
  4. Where do I find the sources?
  5. How do I (re)compile IPF on FreeBSD?
  6. How do I start ipfilter on a running system?
  7. Don't I need to compile IPF into my kernel?
  8. How do I configure FreeBSD to enable ipfilter at startup?
  9. Forget the loadable kernel module stuff, how do I do compile IPF into my kernel?
  10. How do I start ipnat on a running system?
  11. How do I configure FreeBSD to enable ipnat at startup?
  12. How do I use the FreeBSD traffic shaper dummynet(4) with IPF?
  13. Which is better/faster/cool/etc., IPF of IPFW?
  14. IPF and IPFW both have features I want to use, must I choose between them?
  15. Won't this slow down processing packets? By how much?
  16. How can I tweak some of IPF's internal values?
  17. Occasionally a server resends a TCP packet I've already sent an ACK to, and it causes the connection to die, why?
  18. I just upgraded IPF and I'm getting errors on boot - but everything works fine.
  19. How do I get IPF working with IPv6 in FreeBSD?
  1. How do I upgrade IP Filter on NetBSD?
  2. How do I get IPF working with IPv6 in NetBSD?
  3. I'm getting messages about "no more space for rules" -- and I have a large ruleset. What do I do?
  1. How can I get IP Filter to block by default?
  2. How can I upgrade IP Filter on OpenBSD < 3.0?
  3. So I've upgraded IP Filter, why isn't it working?
  4. I just installed OpenBSD 3.x, where's IP Filter?
  5. I've heard that there's problems with filtering on OpenBSD bridges. What's the deal?
XIII. Linux
  1. Is there a linux port?
  2. So how do I get it running on my favorite distro?
XIV. FAQ Administrative Questions
  1. Would you like me to register a domain for you?
  2. Would you like free hosting?
  3. How often is the FAQ updated?
  4. I have a usefull addition to the FAQ, what do I do?
  5. I've submitted something for the FAQ, but it's not here, why not?

Copyright © 2002 - 2007 Phil Dibowitz