ippool.conf man page on SunOS

Man page or keyword search:  
man Server   20652 pages
apropos Keyword Search (all sections)
Output format
SunOS logo
[printable version]

ippool(4)			 File Formats			     ippool(4)

NAME
       ippool, ippool.conf - IP pool file format

SYNOPSIS
       ippool.conf

DESCRIPTION
       The format for files accepted by ippool(1M) is described by the follow‐
       ing grammar:

	 line ::= table | groupmap .
	 table ::= "table" role tabletype .
	 groupmap ::= "group-map" inout role number ipfgroup
	 tabletype ::= ipftree | ipfhash .

	 role ::= "role" "=" "ipf" .
	 inout ::= "in" | "out" .

	 ipftree ::= "type" "=" "tree" number "{" addrlist "}" .
	 ipfhash ::= "type" "=" "hash" number hashopts "{" hashlist "}" .

	 ipfgroup ::= setgroup hashopts "{" grouplist "}" |
	    hashopts "{" setgrouplist "}" .
	 setgroup ::= "group" "=" groupname .

	 hashopts ::= size [ seed ] | seed .

	 size ::= "size" "=" number .
	 seed ::= "seed" "=" number .

	 addrlist ::= range [ "," addrlist ] .
	 grouplist ::= groupentry [ ";" grouplist ] | groupentry ";" |
		      addrmask ";" | addrmask ";" [ grouplist ] .

	 setgrouplist ::= groupentry ";" [ setgrouplist ] .

	 groupentry ::= addrmask "," setgroup .

	 range ::= addrmask | "!" addrmask .

	 hashlist ::= hashentry ";" [ hashlist ] .
	 hashentry ::= addrmask .

	 addrmask ::= ipaddr | ipaddr "/" mask .

	 mask ::= number | ipaddr .

	 groupname ::= number | name .

	 number ::= digit { digit } .

	 ipaddr	 = host-num "." host-num "." host-num "." host-num | ipv6addr .

	 host-num = digit [ digit [ digit ] ] .

	 digit ::= "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" .

	 name ::= letter { letter | digit } .

       The IP pool configuration file is used for  defining  a	single	object
       that  contains a reference to multiple IP address/netmask pairs. A pool
       can consist of a mixture of netmask sizes, from 0 to 32.

       In the current release, only IPv4 addressing is supported in IP pools.

       The IP pool configuration file  provides	 for  defining	two  different
       mechanisms for improving speed in matching IP addresses with rules. The
       first, table, defines a lookup table to provide a single reference in a
       filter  rule to multiple targets. The second mechanism, group-map, pro‐
       vides a mechanism to target multiple groups from a single filter line.

       The group-map command can be used only with filter rules that  use  the
       call  command to invoke either fr_srcgrpmap or fr_dstgrpmap, to use the
       source or destination address, respectively, for determining which fil‐
       ter group to jump to next for continuation of filter packet processing.

   Pool Types
       Two  storage  formats are provided: hash tables and tree structure. The
       hash table is intended for use with objects that all contain  the  same
       netmask	or  a few, different sized-netmasks of non-overlapping address
       space. The tree is designed for supporting  exceptions  to  a  covering
       mask,  in addition to normal searching as you would do with a table. It
       is not possible to use the tree data storage type with  group-map  con‐
       figuration entries.

   Pool Roles
       When a pool is defined in the configuration file, it must have an asso‐
       ciated role. At present the only supported role is ipf. Future develop‐
       ment  might see further expansion of the use of roles by other sections
       of IPFilter code.

EXAMPLES
       The following examples show how the pool	 configuration	file  is  used
       with the ipf configuration file to enhance the succinctness of the lat‐
       ter file's entries.

       Example 1 Referencing Specific Pool

       The following example shows how a filter rule makes reference to a spe‐
       cific pool for matching of the source address.

	 pass in from pool/100 to any

       The  following  pool configuration matches IP addresses 1.1.1.1 and any
       in 2.2.0.0/16, except for those in 2.2.2.0/24.

	 table role = ipf type = tree number = 100
		{ 1.1.1.1/32, 2.2.0.0/16, !2.2.2.0/24 };

       Example 2 ipf Configuration Entry

       The  following  ipf.conf	 excerpt  uses	the  fr_srcgrpmap/fr_dstgrpmap
       lookups	to use the group-map facility to look up the next group to use
       for filter processing, providing the call filter rule is matched.

	 call now fr_srcgrpmap/1010 in all
	 call now fr_dstgrpmap/2010 out all
	 pass in all group 1020
	 block in all group 1030
	 pass out all group 2020
	 block out all group 2040

       An ippool configuration to work with  the  preceding  ipf.conf  segment
       might look like the following:

	 group-map in role = ipf number = 1010
	     { 1.1.1.1/32, group = 1020; 3.3.0.0/16, group = 1030; };
	 group-map out role = ipf number = 2010 group = 2020
	     { 2.2.2.2/32; 4.4.0.0/16; 5.0.0.0/8, group = 2040; };

FILES
	   o	  /dev/ippool

	   o	  /etc/ipf/ippool.conf

	   o	  /etc/hosts

ATTRIBUTES
       See attributes(5) for descriptions of the following attributes:

       ┌─────────────────────────────┬─────────────────────────────┐
       │      ATTRIBUTE TYPE	     │	    ATTRIBUTE VALUE	   │
       ├─────────────────────────────┼─────────────────────────────┤
       │Availability		     │SUNWipfu			   │
       ├─────────────────────────────┼─────────────────────────────┤
       │Interface Stability	     │Evolving			   │
       └─────────────────────────────┴─────────────────────────────┘

SEE ALSO
       ipf(1M), ipnat(1M), ippool(1M), ipf(4), attributes(5), hosts(4)

SunOS 5.10			  28 Jul 2005			     ippool(4)
[top]

List of man pages available for SunOS

Copyright (c) for man pages and the logo by the respective OS vendor.

For those who want to learn more, the polarhome community provides shell access and support.

[legal] [privacy] [GNU] [policy] [cookies] [netiquette] [sponsors] [FAQ]
Tweet
Polarhome, production since 1999.
Member of Polarhome portal.
Based on Fawad Halim's script.
....................................................................
Vote for polarhome
Free Shell Accounts :: the biggest list on the net