.\"
.\"	$Id: ipfwadm.8,v 1.9 1996/07/30 11:50:51 jos Exp $
.\"
.\"
.\"	Copyright (c) 1995,1996 by X/OS Experts in Open Systems BV.
.\"	All rights reserved.
.\"
.\"	Author: Jos Vos <jos@xos.nl>
.\"
.\"		X/OS Experts in Open Systems BV
.\"		Kruislaan 419
.\"		1098 VA  Amsterdam
.\"		The Netherlands
.\"
.\"		E-mail: info@xos.nl
.\"		WWW:    http://www.xos.nl/
.\"
.\"
.\"	This program is free software; you can redistribute it and/or modify
.\"	it under the terms of the GNU General Public License as published by
.\"	the Free Software Foundation; either version 2 of the License, or
.\"	(at your option) any later version.
.\"
.\"	This program is distributed in the hope that it will be useful,
.\"	but WITHOUT ANY WARRANTY; without even the implied warranty of
.\"	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
.\"	GNU General Public License for more details.
.\"
.\"	You should have received a copy of the GNU General Public License
.\"	along with this program; if not, write to the Free Software
.\"	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
.\"
.\"
.TH IPFWADM 8 "July 30, 1996" "" ""
.SH ̾
ipfwadm \- IP ե䡼ȥδ
.SH 
.BR "ipfwadm -A " "ޥ ѥ᡼ [ץ]"
.br
.BR "ipfwadm -I " "ޥ ѥ᡼ [ץ]"
.br
.BR "ipfwadm -O " "ޥ ѥ᡼ [ץ]"
.br
.BR "ipfwadm -F " "ޥ ѥ᡼ [ץ]"
.br
.BR "ipfwadm -M " "[ -l | -s ] [ץ]"
.SH 
.B Ipfwadm
ϡLinuxͥǤIPե䡼ȥε§
ꡦĴ뤿ΤΤǤ롣
浬§4ĤμʬǤ롣Ϥʤ
IPѥåȤΥ(accounting of IP packets)
IPϥե䡼(the IP input firewall)
IPϥե䡼(the IP output firewall)
IPžե䡼(the IP forwarding firewall)
Ǥ롣
餽줾μϡ줾̤ξꥹȤ椵롣

ܺ٤
.IR ipfw (4)
򻲾Ȥλ
.SH ץ
.B ipfwadm
ǻǽʥץϤĤΥ롼פʬǤ롣
.SS "CATEGORIES"
ʲ˼ե饰ϥޥɤͿμꤹΤѤ롣:
.TP
.BR -A " [\fIdirection\fP]"
IPȵ§
ץȤơ
.I direction()
ꤹǤ
.RI ( in (),
.IR out (),
or
.IR both ()),
ꤵ줿ޤϽΥѥåȤΤߤȤ롣
ǥեȤǤ
.IR both ()
Ǥ롣
.TP
.B -I
IP ϥե䡼
.TP
.B -O
IP ϥե䡼
.TP
.B -F
IP žե䡼롣
.TP
.B -M
IP ޥ졼ꡣ


.B -l
(list:ꥹ) ޤ
.B -s
(set timeout values:ॢ) 
ޥɤȤȤ߹碌ǤΤ߻ѲǽǤ롣
.PP
̩ˤϡΥץΤĤɬꤹ
.SS COMMANDS
˼ץϼºݤưꤹΤǤ롣
ΤĤ񼰤Ǽ줿ˡǥޥɥ饤ˤƻꤹ롣
.TP
.BR -a " [\fIpolicy\fP]"
ꤷκǸ˰İʾξɲä롣
ȾξϡpolicyԤʤ
ե䡼ξϡʲ˼ΰĤꤹ
.IR accept() ,
.IR deny (Ե),
ޤ
.IR reject ()

() ȥǥƥ͡()Υۥ̾İʾ
ɥ쥹ǤäϤιͤ줦Ȥ߹碌ɲä롣
.TP
.BR -i " [\fIpolicy\fP]"
ꤷƬ˰İʾξ롣
ܺ٤ʽ񼰤ˤĤƤ
.B -a
򻲾Ȥλ
.TP
.BR -d " [\fIpolicy\fP]"
ꤷΤİʾξ롣
̣礤ȤƤɲ/ޥɤƱǤ롣
ꤹѥ᡼ϤǤɲ/ޥɤƱˤ
ۤʤ԰פȤʤꡢξϺʤ
ޤǽ˰פ롣
.TP
.B -l
ꤷΰɽ롣
Υޥɤ
.B -z
(reset counters to zero󥿤Σꥻå)ޥɤ
Ȥ߹碌ƻѤǤ 
ξ硢ѥåȤȥХȥ󥿤ϡߤͤɽľ
ꥻåȤ롣
.B -x
ץդʤȡѥåȤȥХȥ(ꤵƤ)

.IR  K
ޤ
.IR  M
ɽ롣
ǡ1K1000Ǥꡢ1M1000Ḳ롣(Ǥᤤ˴ݤ)

.B -e

.B -x
Υե饰¿εǽ⻲Ȥλ
.TP
.B -z
ꤷΥѥåȿȥХȿΥ󥿤ꥻåȤ롣
Υޥɤ
.B -l
(ꥹȡlist)ޥɤȤȤ߹碌ƻѤ¿Ǥ
.TP
.B -f
ꤷä롣
.TP
.BI -p " policy"
򤷤ե䡼륿פΥǥեȤ"policy"ѹ롣
Ϳ٤"policy"
.IR accept 
.IR deny 
ޤ
.IR reject 
ΰĤǤʤФʤʤ
ǥե"policy"ϰפ郎ʤ˻Ѥ롣
IPե䡼ˤΤͭǤ롣äƲ
.BR -I 
.BR -O 
ޤ
.B -F
Υե饰ȤȤ߹碌ǻѤ롣
.TP
.BI -s " tcp tcpfin udp"
IPޥ졼ɤǻѤ륿ॢͤѹ롣
ΥޥɤϾ3ĤΥѥ᡼ȤꡢϤ줾
äñ̤TCPFINѥåȤTCP
UDPѥåȤΥॢͤ򵭽Ҥ롣
ॢͤȤ0ꤷϡߤΥȥ
ѤƤͤΤޤްѤ롣
ϡ
.B -M
ե饰ȤȤ߹碌ǤΤͭǤ롣
.TP
.B -c
򤷤ե䡼ˤơIPѥåȤaccept()
deny (Ե)ޤreject ()Ǥ뤫ɤǧ롣
ϡ
.BR -I ,
.BR -O ,
ޤ
.B -F
ե饰ȤȤ߹碌ǤΤͭǤ롣
.TP
.B -h
Help(إ)Ǥ롣
ޥɤεˡ(ߤ˴ñ)ɽ롣
.SS PARAMETERS
ʲ˼ѥ᡼append(ɲ)insert()delete()
ޤcheck(ǧ)Ȥ߹碌ƻѲǽǤ롣
.TP
.BI "-P " protocol
ޤϳǧ٤ѥåȤΥץȥ򼨤
ҤǤץȥȤƤ
.IR tcp 
.IR udp 
.IR icmp 
ޤ
.IR all()
ΥץȥΤΰĤǤ롣
.I all
ꤷϤΥץ󤬾άƤˤȤꤦ
٤ƤΥץȥ뤬оݤˤʤ롣
.I All
check(ǧ)ޥɤȤȤ߹碌ѤϤʤǤ
.TP
.BR "-S " "\fIaddress\fP[/\fImask\fP] [\fIport\fP ...]"
λ(ץ)
.I Address
host̾ͥåȥ̾IPɥ쥹ˤ꤬ǽǤ롣
.I mask
ϥͥåȥޥˤȿͤˤ꤬ǽǤꡢ
ͤˤϺ¦Υͥåȥޥӥåȿꤹ롣
äơޥ
.I 24

.IR 255.255.255.0 
Ǥ롣
.sp 0.5
ϰİʾΥݡȤޤICMPפޤࡣ
줾λservice̾portֹ桢ޤ(ͤǤ)ICMP
פǻǤ롣
ξϤλĤʬǵҤ
.I port
ϡportֹޤICMPפ򼨤
λ⡢portֹϰϤꤹϡ
.IR port : port 
ȡҤ롣
ˡ()ȥǥƥ͡()λǤport

.B IP_FW_MAX_PORTS
( 10)ĶƤϤʤʤ
ǡportϰϻξϣȿ롣
.sp 0.5
TCPUDPޤICMPѥåȤΡֺǽΥե饰ȤǤʤʬϾ
ե䡼˵Ĥ롣
ˤƤϡܰʹߤΥե饰Ȥ
̤˰졢ˡǥȤǤ롣
portֹ0xFFFF(65535)ܰʹߤTCPޤUDPѥåȤȤ
롣
portֹ0xFFFFΥѥåȤϥŪѤ롣
0xFF (255)ICMPѥåȤܰʹߤΤȤư롣
ޤICMPפ0xFFΥѥåȤϥŪѤ롣
դ٤ϡҤޥɤץȥϡportۤ¤롣
portϲץȥȤȤ߹碌ǻѤ롣
.IR tcp 
.IR udp 
ޤ
.I icmp
.sp 0.5
Υץ󤬾ά줿ϡǥեȤΥɥ쥹/ͥåȥޥȤ
.I 0.0.0.0/0
(٤ƤΥɥ쥹Ŭ礹)ɥ쥹ȤƻѤ롣
åޥɤˤƤϤΥץɬܤǤꡢɬ1ĤΥݡȤ
ꤵƤʤФʤʤ
.TP
.BR "-D " "\fIaddress\fP[/\fImask\fP] [\fIport\fP ...]
ǥƥ͡()ꤹ롣(ץ)
ˡξܺ٤˴ؤƤ
.B -S
ˡάɸ͡¾λܤˤĤƤ(source)ե饰ι
Ȥλ
դ٤ϡICMPפ
.B -D
ե饰ȤȤ߹碌ǤϻѤǤʤʤ
.B -S
ե饰θ˻ꤹ
.TP
.BI "-V " address
ץȤơѥåȤޤ
ͳ륤󥿥եΥɥ쥹ꤹ롣
.I Address
host̾ǤͤˤIPɥ쥹Ǥ褤
host̾ꤵ줿ϡĤIPɥ쥹˳Ƥ롣
Υץ󤬾ά줿ϡɥ쥹
.I 0.0.0.0
ꤵ졢̤ˤɤΥ󥿥եɥ쥹Ŭ礵롣
åޥɤˤƤϤΥץɬܤǤ롣
.TP
.BI "-W " name
ץȤơѥåȤޤ
ͳ륤󥿥ե̾ꤹ롣
Υץ󤬾ά줿ϡ̾empty string(ʸ)
ꤵ졢̤ˤɤΥ󥿥ե̾Ŭ礵롣
åޥɤˤƤϤΥץɬܤǤ롣
.SS "OTHER OPTIONS"
ʲ˼ץ󤬻ѲǽǤ롣
.TP
.BI -b
Bidirectional()⡼ɡ

ꤷIPѥåȤŬ礹롣
Υץappend(ɲ)insert()ޤdelete()
ޥɤȤ߹碌ƻѲǽǤ롣
.TP
.BI -e
Extended output(ĥ)
Υץꤹlist(ꥹ)ޥɤǤνϤ
󥿥ե(⤷)ɽ롣
ե䡼ꥹȤˤƤϡѥåȤȥХȥ
(ǥեȤξ֤ǤϡԤäƤХȥ
Τߤɽ)TOSޥϤ롣
.BR -M 
ȤȤ߹碌ǻѤϡdelta sequence numbers˴Ϣ
ɽ롣
Υץlist(ꥹ)ޥɤȤȤ߹碌ǤΤͭǤ롣
.TP
.BI -k
TCPѥåȤACKӥåȤåȤƤΤΤŬ礹롣
(Υץ¾ΥץȥǤ̵뤵)
Υץappend(ɲ)insert()ޤdelete()
ޥɤȤ߹碌ƻѲǽǤ롣
.TP
.BI -m
žѤΥޥ졼ɥѥåȤεġ

Υץꤷ硢ѥåȤۥȤ
ΤǤХޥ졼ɥѥåȤȤư롣
ˡոΥѥåȤϼưŪ˵եޥ졼ɥѥåȤȤ
졢ե䡼Хѥ롣
Υץϡžե䡼ξ"policy"Ȥ
.I accept
(ޤϥǥեȤ"policy"Ȥ
.I accept
ꤵƤ)˻Ѳǽǡ˥ͥ륳ѥ

.B CONFIG_IP_MASQUERADE
ƤʤФʤʤ
.TP
.BI -n
Numeric output(ͤǤν)
IPɥ쥹portֹͤɽ롣
ǥեȤǤϡ(Ǥʤ)host̾ͥåȥ̾
service̾ɽ롣
.TP
.BI -o
Ŭ礷ѥåȤФ륫ͥ󥰤Ԥ
ФƤΥץꤹLinuxͥ
Ŭ礷ѥå(IPإåեɤΤۤȤ)ξ
.IR printk ()
ؿȤäƽϤ롣
ΥץLinuxͥ륳ѥ
.B CONFIG_IP_FIREWALL_VERBOSE
ͭǤ롣
Υץappend(ɲ)insert()ޤdelete()
ޥɤȤ߹碌ǤΤͭǤ롣
.TP
.BR "-r " [\fIport\fP]
륽åȤ˥쥯Ȥ롣
ΥץꤵƤϡ⤷ΥѥåȤ⡼Ȥ
ۥȤ줿ΤǤäƤ⤳ξˤäƥ
åȤ˥쥯Ȥ롣
쥯ȤԤݡֹ椬0ξ(ǥեȤǤ)ϡ
ΥѥåȤΥǥƥ͡ݡȤ쥯Ȥ
ݡȤȤѤ롣

Υץϡϥե䡼ξ"policy"Ȥ
.I accept
ꤵƤ˻Ѳǽǡ˥ͥ륳ѥ
.B CONFIG_IP_TRANSPARENT_PROXY
ƤʤФʤʤ
.TP
.BI "-t " "andmask xormask"
IPإåTOSեɤѤȤѤޥ
(ޥ졼ɤ̵ͭ˴ؤ餺)ե䡼ξˤ
ѥåȤĤ줿ˡΥѥåȤTOSեɤФ
˻ꤷޥͤȥӥåAND()ˤη̤
ФƼΥޥͤȥӥåXOR(¾Ū)Ԥ
줾Υޥ16ʿ8ӥåȤǻꤹ롣
Υץappend(ɲ)insert()ޤdelete()
ޥɤȤ߹碌ƤǤΤͭǤꡢ䡢
reject()deny(Ե)Υե䡼Υޥɻˤ
̣ʤ
.TP
.BI -v
Verbose output(ܺٽ)

ѥåȤɲáӳǧˤƾܺپϤ롣
Υץappend(ɲ)insert()delete()
ޤcheck(ǧ)ޥɤȤ߹碌ǤΤͭǤ롣
.TP
.BI -x
Expand numbers(ĥͽ)
ѥåȿӥХȥͤνϤˤơK(1000)
M(1000K)Ȥäݤ᤿ͤǤϤʤΤͤϤ롣
ΥץϥͤϤˤΤͭǤ롣
(ץ
.B -e
Ȥλ)
.TP
.BI -y
TCPѥåȤSYNӥåȤåȤƤꡢACKӥåȤꥻå
ƤΤΤŬ礹롣
(Υץ¾ΥץȥǤ̵뤵)
Υץappend(ɲ)insert()ޤdelete()
ޥɤȤ߹碌ƻѲǽǤ롣
.SH ե
.I /proc/net/ip_acct
.br
.I /proc/net/ip_input
.br
.I /proc/net/ip_output
.br
.I /proc/net/ip_forward
.br
.I /proc/net/ip_masquerade
.\" .SH Х
.SH Ϣ
ipfw(4)
.SH 
Jos Vos <jos@xos.nl>
.br
X/OS Experts in Open Systems BV, Amsterdam, The Netherlands

.SH 
 ()  <shibata@opost1.netspace.or.jp> 1997/02/15 ver. 0.0