Current version: 5.1.2
Next release status
Patches for last release
What's new ? Click here!
Last 4.1 Release: 4.1.35
Mailing list ?
Send mail to
with "subscribe ipfilter"
in the body of the mail.
What is it ?
IPFilter is a software package that can be used to provide network address
translation (NAT) or firewall services. To use, it can either be used as a
loadable kernel module or incorporated into your UNIX kernel; use as a
loadable kernel module where possible is highly recommended. Scripts are
provided to install and patch system files, as required.
To see an overview of how IP Filter fits into the overall picture of TCP/IP
with your kernel and the order in which the various phases of packet
processing is done,
FAQ by Phil Dibowitz!
It comes as a part of the following operating systems:
It has been tested and run on:
FreeBSD-current (post 2.2)
NetBSD-current (post 1.2)
* - It has been tested and shown to work on RedHat 9.0, SuSE 9.1 and will,
in general work with 2.4 and 2.6 kernels. It should be noted that not all
Linux distros are the same so using others may not be smooth.
- Solaris/Solaris-x86 2.3 - 9
- SunOS 4.1.4 - 4.1.4
- NetBSD 1.0 - 1.4
- FreeBSD 2.0.0 - 2.2.8
- BSD/OS-1.1 - 4
- IRIX 6.2, 6.5
- OpenBSD 2.0 - 3.5
- Linux(*) 2.4 - 2.6
- HP-UX 11.00
- Tru64 5.1a
AIX 5.3 ML05
QNX 6 Port
Thanks to those who have been able to support IP Filter through
donations of hardware.
To ftp this package, see:
- the list of mirrors
- ftp to
- or via http from
- Beta-versions can usually be found, if available, in
A How-To document is being written for IP Filter and is avialable at
In German, you can download this document:
IP Filter Based Firewalls HOWTO-German.pdf
The firewall can:
and can match on the follow IP header fields:
any packet from passing through
- distinguish between various
In addition, IPFilter can
source/destination IP address (including inverted matches)
- TOS (Type of Service)
- any of the 19
IP options or 8 registered
IP security classes
fragments (if it is or isn't)
Special provision is made for the three most common Internet protocols,
TCP, UDP and ICMP. IP Filter rules allow for packets to be matched
- send back an
ICMP error/TCP reset for denied packets
packet state information for TCP, UDP and ICMP packet flows.
- keep fragment state information for any IP
packet, applying the same rule to all fragments.
- act as a
Network Address Translator (NAT)
redirection to setup true transparent proxy
- provide packet header details to a user program
- in addition, supports temporary storage of
pre-authenticated rules for passing packets through
- TCP/UDP packets by
port number or a
port number range
- ICMP packets by
"established" TCP packets
- on any arbitrary combination of
"short" (fragmented) IP packets with
To keep track of the performance of IP Filter, a
logging device is used which supports logging of:
- the TCP/UDP/ICMP and IP packet headers
- the first 128 bytes of the packet
To examine a set of example rule files and an example of what can be
done, click here.
- a packet is successfully passed through
- a packet is blocked from passing through
- it matches a rule setup to look for suspicious
IPFilter keeps its own set of statistics on:
- packets blocked
- packets (and bytes!) used for accounting
- packets passed
- packets logged
- attempts to log which failed (buffer full)
and much more, for packets going both in and out.
The current implementation provides a small set of tools, which
can easily be used and integrated with regular unix shells and tools.
Amongst these tools is a new addition, ipftest, which is
provided so that you can test a rule set before committing it to
use in your kernel. A brief description of the tools provided:
Documentation on ioctl's and the format of data saved to the logging
character device is provided so that you may develop your own applications
to work with or in place of any of the above.
- ipf - reads in a set of rules, from
either stdin or a file, and adds them to the kernels current list
(appending them). It can also be used to flush the current firewall rule
set or delete individual firewall rules.
- ipfstat - interrogates the kernel for
statistics on packet processing, so far, and retrieves the list of firewall
rules in operation for inbound and outbound packets.
- ipftest - reads in a ipf rule file
and then applies sample IP packets to the rule file. This allows for testing
of firewall rule list and examination of how a packet is passed along through
- ipmon - reads buffered data from the
logging device (default is /dev/ipl) for output to either:
- * screen (standard output)
- * file
- * syslog
- ipsend - generates arbitary IP packets
for ethernet connected machines.
- ipresend - reads in a data file of saved
IP packets (ie snoop/tcpdump/etherfind output) and sends it back across the
- iptest - contains a set of test "programs"
which send out a series of IP packets, aimed at testing the strength of the
TCP/IP stack at which it is aimed at. WARNING: may crash machine(s)
- ipnat - reads in a set of rules, from
either stdin or a file and adds them to the kernels current list of active
NAT rules. NAT rules can also be deleted using ipnat.
To retrieve this package via anonymous ftp, use:
Mailing List Archive
The mailing list for IP Filter is now archived at:
This site also supports searching of the IP Filter list archive.
- mirrors coombs.anu.edu.au:/pub/net/ip-filter/
ftp.localhost.ca - mirrors coombs.anu.edu.au:/pub/net/ip-filter/
nic.funet.fi - mirrors coombs.anu.edu.au:/pub/net/firewall/ip-filter
- United Kingdom:
ftp.tardis.ed.ac.uk - mirrors coombs.anu.edu.au:/pub/net/firewall/ip-filter
http://ipfilter.wormulon.net/ - mirrors coombs.anu.edu.au:/pub/net/firewall/ip-filter.
ftp.ntua.gr - mirrors coombs.anu.edu.au:/pub/net/firewall/ip-filter
ftp.kfki.hu - mirrors coombs.anu.edu.au:/pub/net/firewall/ip-filter
ftp.unipi.it - mirror coombs.anu.edu.au:/pub/net/ip-filter
ftp.ayamura.org - mirrors coombs.anu.edu.au/pub/net/firewall/ip-filter
ftp.netrunner.nu - mirror coombs.anu.edu.au:/pub/net/ip-filter
ftp.task.gda.pl - mirrors coombs.anu.edu.au:/pub/net/ip-filter
cache.unicies.cesga.es - mirrors /pub/net/firewall/ip-filter
http://pds.nchu.edu.tw/pub/firewall/ip-filter - mirrors this web site.
ftp.umbc.edu - mirrors coombs.anu.edu.au:/pub/net/kernel
ftp.twtelecom.net - mirrors coombs.anu.edu.au:/pub/firewall/ip-filter
ftp.tmcs.net - mirrors coombs.anu.edu.au:/pub/net/firewall/ip-filter
The UCD SNMP package now supports IP Filter. For more information, retrieve
version 3.6.2 (or later) of the UCD SNMP package from
Other IP Filter links:
IP Filter HOW-TO
Connecting a Private Network to an ISP on Solaris
HOW-TO Guide for using NAT/PPP on Solaris 2
Transparent WWW Proxying with Squid
- IP Accounting package
Tranparent IP Proxy
NAT for OpenBSD
IP Filter 3.2.10 for SCO
A Guide to IPFilter written in Turkish.