'\" te .\" To view license terms, attribution, and copyright for IP Filter, the default path is /usr/lib/ipf/IPFILTER.LICENCE. If the Solaris operating environment has been installed anywhere other than the default, modify the given path to access the file at the installed location. .\" Portions Copyright (c) 2009, 2015, Oracle and/or its affiliates. All rights reserved. .TH ipfilter 5 "9 Apr 2015" "SunOS 5.11" "Standards, Environments, and Macros" .SH NAME ipfilter \- IP packet filtering software .SH DESCRIPTION .sp .LP IP Filter is software that provides packet filtering capabilities on a Solaris system. On a properly setup system, it can be used to build a firewall. .sp .LP Solaris IP Filter is installed with the Solaris operating system. However, packet filtering is not enabled by default. See \fBipf\fR(1M) for a procedure to enable and activate the IP Filter feature. .SS "Interaction with Location Profiles" .sp .LP IP Filter configuration and activation is managed in Location profiles (refer to \fBnetcfg\fR(1M) for more information about location profiles). These profiles are either fixed, meaning the network configuration is being managed in the traditional way, or reactive, meaning the network configuration is being managed automatically, reacting to changes in the network environment according to policy rules specified in the profiles. .sp .LP When a fixed location (there can currently be only one, the DefaultFixed location) is active, changes made to the SMF repository will be applied to the location when it is disabled, and thus will be restored if that location is later re-enabled. .sp .LP When a reactive location is active, changes should not be applied directly to the SMF repository; these changes will not be preserved in the location profile, and will thus be lost if the location is disabled, or if the system's network configuration, as managed by \fBsvc:/network/physical:default\fR and \fBsvc:/network/location:default\fR, is refreshed or restarted Changes should instead be applied to the location itself, using the \fBnetcfg\fR command; this will save the change to the location profile repository, and will also apply it to the SMF repository (if the change is made to the currently active location). .sp .LP The \fBipfilter\fR SMF service will be enabled if an IPv4 filter configuration file is specified in the \fBipfilter-config-file\fR property. To enable additional types of filtering, the \fBipfilter-v6-config-file\fR, \fBipnat-config-file\fR, and \fBippool-config-file\fR properties may also be specified. .SH SERVICE .sp .LP The \fBipfilter\fR SMF service supports the \fBstart\fR, \fBstop\fR, \fBrestart\fR, and \fBrefresh\fR methods. The methods are invoked using \fBsvcadm\fR(1M). .sp .ne 2 .mk .na \fB\fBstart\fR\fR .ad .RS 11n .rt Loads the \fBipfilter\fR kernel module and activates any firewall or NAT rules as per the configuration. .RE .sp .ne 2 .mk .na \fB\fBstop\fR\fR .ad .RS 11n .rt Clears out all of the applied firewall and NAT rules and any active session information that has been created. Stopping the service with networking enabled should only be performed when there is no risk of any network traffic being able to enter the host. .RE .sp .ne 2 .mk .na \fB\fBrestart\fR\fR .ad .RS 11n .rt Performs a stop and then start of the \fBipfilter\fR service. Using this method on an active firewall results in a window of exposure where traffic can enter and/or pass through the firewall without being filtered. .RE .sp .ne 2 .mk .na \fB\fBrefresh\fR\fR .ad .RS 11n .rt Loads the current configuration and switches over from the old configuration to the new one without there being a moment in time when neither security policy is in active use. .RE .SH HOST-BASED FIREWALL .sp .LP To simplify IP Filter configuration management, a firewall framework is created to allow users to configure IP Filter by expressing firewall policy at system and service level. Given the user-defined firewall policy, the framework generates a set of IP Filter rules to enforce the desired system behavior. Users specify system and service firewall policies that allow or deny network traffic from certain hosts, subnets, and interface(s). The policies are translated into a set of active IPF rules to enforce the specified firewall policies. .sp .LP Users can still specify their own \fBipf\fR rule file if they choose not to take advantage of the framework. See \fBipf\fR(1M) for how to enable customized rules and \fBipf\fR(4) to find out \fBipf\fR rule syntax. .sp .LP IPF uses the \fBipmon\fR(1M) service to log firewall events. The \fBipmon\fR SMF service depends on the \fBipfilter\fR SMF service. The \fBipmon\fR service gets enabled temporarily by the \fBipfilter\fR service start method as soon as \fBipfilter\fR gets enabled automatically by "\fBsvcadm enable ipfilter\fR". .SS "Model" .sp .LP This section describes the host-based firewall framework. See \fBsvc.ipfd\fR(1M) for details on how to configure firewall policies. .sp .LP A three-layer approach with different precedence levels helps the user achieve the desired behaviors. .sp .ne 2 .mk .na \fBGlobal Default\fR .ad .sp .6 .RS 4n Global Default - Default system-wide firewall policy. This policy is automatically inherited by all services unless services modify their firewall policy. .RE .sp .ne 2 .mk .na \fBNetwork Services\fR .ad .sp .6 .RS 4n Higher precedence than Global Default. A service's policy allows/disallows traffic to its specific ports, regardless of Global Default policy. .RE .sp .ne 2 .mk .na \fBGlobal Override\fR .ad .sp .6 .RS 4n Another system-wide policy that takes precedence over the needs of specific services in Network Services layer. .RE .sp .in +2 .nf Global Override | | Network Services | | Global Default .fi .in -2 .sp .sp .LP A firewall policy includes a firewall mode and an optional set of network sources. Network sources are IP addresses, subnets, and local network interfaces, from all of which a system can receive incoming traffic. The basic set of firewall modes are: .sp .ne 2 .mk .na \fBNone\fR .ad .sp .6 .RS 4n No firewall, allow all incoming traffic. .RE .sp .ne 2 .mk .na \fBDeny\fR .ad .sp .6 .RS 4n Allow all incoming traffic but deny from specified source(s). .RE .sp .ne 2 .mk .na \fBAllow\fR .ad .sp .6 .RS 4n Deny all incoming traffic but allow from specified source(s). .RE .SS "Layers in Detail" .sp .LP The first system-wide layer, Global Default, defines a firewall policy that applies to \fBany\fR incoming traffic, for example, allowing or blocking all traffic from an IP address. This makes it simple to have a policy that blocks all incoming traffic or all incoming traffic from unwanted source(s). .sp .LP The Network Services layer contains firewall policies for local programs that provide service to remote clients, for example, \fBtelnetd\fR, \fBsshd\fR, and \fBhttpd\fR. Each of these programs, a network service, has its own firewall policy that controls access to its service. Initially, a service's policy is set to inherit Global Default policy, a "Use Global Default" mode. This makes it simple to set a single policy, at the Global Default layer, that can be inherited by all services. .sp .LP When a service's policy is different from Global Default policy, the service's policy has higher precedence. If Global Default policy is set to block all traffic from a subnet, the SSH service could be configured to allow access from certain hosts in that subnet. The set of all policies for all network services comprises the Network Service layer. .sp .LP The second system-wide layer, Global Override, has a firewall policy that also applies to any incoming network traffic. This policy has highest precedence and overrides policies in the other layers, specifically overriding the needs of network services. The example is when it is desirable to block known malicious source(s) regardless of services' policies. .SS "User Interaction" .sp .LP This framework leverages IP Filter functionality and is active only when \fBsvc:/network/ipfilter\fR is enabled and inactive when \fBnetwork/ipfilter\fR is disabled. Similarly, a network service's firewall policy is only active when that service is enabled and inactive when the service is disabled. A system with an active firewall has IP Filter rules for each running/enabled network service and system-wide policy(s) whose firewall mode is not \fBNone\fR. .sp .LP A user configures a firewall by setting the system-wide policies and policy for each network service. See svc.ipfd(1M) on how to configure a firewall policy. .sp .LP The firewall framework composes of policy configuration and a mechanism to generate IP Filter rules from the policy and applying those rules to get the desired IP Filter configuration. A quick summary of the design and user interaction: .RS +4 .TP .ie t \(bu .el o system-wide policy(s) are stored in \fBnetwork/ipfilter\fR .RE .RS +4 .TP .ie t \(bu .el o network services' policies are stored in each SMF service .RE .RS +4 .TP .ie t \(bu .el o a user activates a firewall by enabling \fBnetwork/ipfilter\fR (see \fBipf\fR(1M)) .RE .RS +4 .TP .ie t \(bu .el o a user activates/deactivate a service's firewall by enabling/disabling that network service .RE .RS +4 .TP .ie t \(bu .el o changes to system-wide or per-service firewall policy results in an update to the system's firewall rules .RE .SH ATTRIBUTES .sp .LP See \fBattributes\fR(5) for a description of the following attributes: .sp .sp .TS tab() box; cw(2.75i) |cw(2.75i) lw(2.75i) |lw(2.75i) . \fBATTRIBUTE TYPE\fR\fBATTRIBUTE VALUE\fR _ Interface StabilityCommitted .TE .SH SEE ALSO .sp .LP \fBsvcs\fR(1), \fBipf\fR(1M), \fBipmon\fR(1M), \fBipnat\fR(1M), \fBnetcfg\fR(1M), \fBsvcadm\fR(1M), \fBsvc.ipfd\fR(1M), \fBipf\fR(4), \fBipnat\fR(4), \fBattributes\fR(5), \fBsmf\fR(5) .sp .LP \fIManaging IP Quality of Service in Oracle Solaris 11.3\fR .sp .LP \fIConfiguring and Managing Network Components in Oracle Solaris 11.3\fR .SH NOTES .sp .LP The \fBipfilter\fR service is managed by the service management facility, \fBsmf\fR(5), under the service identifier: .sp .in +2 .nf svc:/network/ipfilter:default .fi .in -2 .sp .sp .LP Administrative actions on this service, such as enabling, disabling, or requesting restart, can be performed using \fBsvcadm\fR(1M). The service's status can be queried using the \fBsvcs\fR(1) command. .sp .LP IP Filter startup configuration files are stored in \fB/etc/ipf\fR.