Specifications

234 Chapter 14 Configuring and Managing Network Services
Packets are passed to ipfw from a number of places in the protocol stack. (Depending
on the source and destination of the packet, ipfw can be invoked multiple times on the
same packet.) The packet passed to the firewall is compared with each rule in the
firewall ruleset. When a match is found, the action corresponding to the matching rule
is performed.
Important: Misconfiguring the firewall can put your computer in an unusable state,
possibly shutting down network services and requiring console access to regain control
of it.
You can configure ipfw with a variety of commands. For more information, see the
ipfw man page.
The unmodified ipfw.conf file:
# ipfw.conf.default - Installed by Apple, never modified by Server Admin app
#
# ipfw.conf - The servermgrd process (the back end of Server Admin app)
# creates this from ipfw.conf.default if it's absent, but does not modify
# it.
#
# Administrators can place custom ipfw rules in ipfw.conf.
#
# Whenever a change is made to the ipfw rules by the Server Admin
# application and saved:
# 1. All ipfw rules are flushed
# 2. The rules defined by the Server Admin app (stored as plists)
# are exported to /etc/ipfilter/ipfw.conf.apple and loaded into the
# firewall via ipfw.
# 3. The rules in /etc/ipfilter/ipfw.conf are loaded into the firewall
# via ipfw.
# Note that the rules loaded into the firewall are not applied unless the
# firewall is enabled.
#
# The rules resulting from the Server Admin app's IPFirewall and NAT panels
# are numbered:
# 10 - from the NAT Service - this is the NAT divert rule, present only
# when he NAT service is started via the Server Admin app.
# 1000 - from the "Advanced" panel - the modifiable rules, ordered by
# their relative position in the drag-sortable rule list
# 12300 - from the "General" panel - "allow"" rules that punch specific
# holes in the firewall for specific services
# 63200 - from the "Advanced" panel - the non-modifiable rules at the
# bottom of the panel's rule list
#
# Refer to the man page for ipfw(8) for more information.
#
# The following default rules are already added by default:
#
#add 01000 allow all from any to any via lo0