Subject: What is the grammar used by BSD/OS's ipfwcisco command?
Date: 01/19/99
A cisco style filter is comprised of one or more of the following rules.
Anything in italics is defined following the command syntax.
Anything in bold face is a literal.
-
interface interface-name
All following access-group rules will be applied only to
interface-name (until a new interface command is issued)
-
ip access-group number
-
ip access-group number in
-
ip access-group number out
Establish the direction and assign the current interface (if any)
to the rule set. The direction simply determines if the interface
must match the input or output interface.
-
access-list number action srcaddr mask
Add a rule the ruleset indicated for packets matching the given
source address with the applied mask.
-
ale
-
ale ESTABLISHED
-
ale op dstport
-
ale op dstport ESTABLISHED
-
ale SRCPORT op srcport
-
ale SRCPORT op srcport ESTABLISHED
-
ale op dstport SRCPORT op srcport
-
ale op dstport SRCPORT op srcport ESTABLISHED
An extended rule that allows specification of the destination
address as well as the destination and source ports. The addition
of established means the (TCP) packet has either the ACK or RST bit
set. This will *not* match SYN packets!
The terms in italics above are defined below. If a term can take on
more than a single value, the values are separated by a comma (,).
The ipfwcisco does not attempt to support all features found
in the cisco filter language. One
notable feature that is missing is the term any. I believe
that 0.0.0.0 255.255.255.255 is the same thing.