Re: [fw-wiz] IPTables QUEUE target equivalency in other firewalls

From: Barney Wolff (
Date: 02/26/03

  • Next message: Mike Hoskins: "Re: [fw-wiz] Webex and the like"
    From: Barney Wolff <>
    To: Rod Marten <>
    Date: Wed, 26 Feb 2003 15:21:28 -0500

    ipfw certainly does, called divert. It's used by natd but is general
    and usable by others instead or in addition to natd.

    On Wed, Feb 26, 2003 at 01:01:01PM -0700, Rod Marten wrote:
    > Netfilter/IPTables supports a target of QUEUE which delivers packets to
    > a userspace interface where they can be modified,inspected etc. For
    > example, the QUEUE target is used by Snort-inline to inspect and
    > allow/drop packets in realtime.
    > Do any other firewalls have a similar function? I am particularly
    > interested in ipFilter, ipfw, packetfilter, or PIX (I know PIX is highly
    > unlikely since it is more of a dedicated appliance).

    Barney Wolff
    I'm available by contract or FT, in the NYC metro area or via the 'Net.
    firewall-wizards mailing list

    Relevant Pages

    • Re: ipfw/nated stateful rules example
      ... I found it OK for stateful rules, as long as you don't use natd! ... packets went out including the natd in the middle. ... > ipfw add allow udp from any ntp to any in recv $ext_if ... > ipfw add allow udp from any to any ntp out xmit $ext_if ...
    • Re: nat and ipfw
      ... packets to be translated. ... the packets to natd is one thing, ... > dsl and the other for an internal subnet. ... > ipfw configured and running. ...
    • Re: IPFW questions
      ... natd is a daemon userland process which performs way poorly than a kernel ... use ipfw for rest of packet filtering. ... > bdg_forward packets. ...
    • IPFW and NAT - blocking RFC 1918 ("unregistered") network that matches my own
      ... I am up and running with ipfw 2 and natd, but not all is quite well. ... I can't figure out how to block "spoofed" packets from the outside ... that use the same RFC 1918 network as the one I'm translating to. ...
    • Re: Port forwarding with router, natd and firewall
      ... >> Check whether these packets are getting to the FreeBSD machine at all. ... The counters on the IPFW rule I specified in my last post are ... not the target). ... You want natd to handle it instead. ...