IP Filter FAQ

Previous | TOC | Next

VII. IP FILTER AND SOLARIS

  1. Why don't my return-rst's work?
  2. It won't compile, something about /usr/ucb/cc.
  3. I'm using a 64-bit kernel, and when it tries to load ipf, it gets an error.
  4. How can I tell if I'm using a 32-bit or 64-bit kernel?
  5. Can the gcc to make 64-bit Sparc kernel modules?
  6. What do I need to make a 64 bit Sparc kernel module?
  7. Wait, my Sparc host is running in 64 bit mode, but I don't want to buy Sun's Forte compiler, nor do I want to install the try-and-buy. What can I do to get IPF up?
  8. When I try and pkgadd the precompiled IPF package I downloaded, there are two sub-packages. What do I do?
  9. Can I use IPF on Solaris as a Layer 2 bridge?
  10. How can I tweak some of IPF's internal values at boot time?
  11. How can I build a transparent proxy using Squid on Solaris 8?
  1. Why don't my return-rst's work?
    There is a bug in Solaris. Basically you have to add a rule allowing the TCP Reset to leave. So let's say that you want to return-rst on ident, port 113, so that sending mail doesn't give long delays, and IRC work:
    #return-rst for ident
    block return-rst in quick on ppp0 proto tcp from any to any port = 113
    pass out quick on ppp0 proto tcp from any port = 113 to any flags R/RSFUP
     The first rule just blocks with return-rst, the second rule allows packets out from port 113 with the RESET flag.
  2. It won't compile, something about /usr/ucb/cc.
    Sun has a compiler usually installed in /usr/ucb/cc. Unfortunately, it's a really expensive compiler that doesn't ship with Solaris by default. Fortunately, since Solaris 8, they've included gcc for you on the Solaris Companion CD, it's a package called SFWgcc.

    If you're using and older version of Solaris you can get gcc from SunFreeware.com.
  3. I'm using a 64-bit kernel, and when it tries to load ipf, it gets an error.
    You must use the cc with SUNWspro - gcc will not work. SUNWspro is available from Sun, you get a demo license.
  4. How can I tell if I'm using a 32-bit or 64-bit kernel?
    Type isainfo -vk. Note that Solaris x86 only runs in 32-bit mode.
  5. Can the gcc to make 64-bit Sparc kernel modules?
    No. Some experimental versions of gcc 3.x are reported to build 64-bit binaries. Use these at your own risk
  6. What do I need to make a 64 bit Sparc kernel module?
    Sun's Forte Compiler can make 64 bit modules. This compiler is not standard with the OS, you have to buy it separately. However, there is a "try-and-buy" version which you can install, and use for a limited time. You can get this time limited version on cdrom or you can download it from Sun.com. Note that the download is very large.
  7. My Sparc host is running in 64-bit mode, but I don't want to buy Sun's Forte compiler, nor do I want to install the try-and-buy. What can I do to get IPF up?
    Some generous individuals have made available precompiled IPF binaries for 64-bit machines. Try http://www.maraudingpirates.org/ipfilter/.
  8. When I try and pkgadd the precompiled IPF package I downloaded, there are two sub-packages. What do I do?
    First select "ipfx", and install that subpackage. When pkgadd completes, rerun pkgadd and then install the "ipf" sub-package.
  9. Can I use IPF on Solaris as a Layer 2 bridge?
    No. IPF on Solaris only operates as a Layer 3 device (router). This means you need distinct subnets for each host interface.
  10. How can I tweak some of IPF's internal values at boot time?
    Solaris's /etc/system is consulted when booting, so you can modify IPF kernel parameters there, for example:
    
*
* ipf: adjust the default tcp timeouts downward so that
*      idle (dead) and half closed states get killed off quicker.
set ipf:fr_tcpidletimeout = 172800
set ipf:fr_tcphalfclosed = 7200
*
* ipf: adjust the state table sizes so we have enough buckets.
*      IPSTATE_MAX (=fr_statemax) should be ~70% of IPSTATE_SIZE
*      IPSTATE_SIZE (=fr_statesize) has to be a prime number
set ipf:fr_statemax = 7000
set ipf:fr_statesize = 10009
*
* ipf: adjust the NAT table sizes so we have enough buckets.
*      generally you have fewer than 127 rules in ipnat.conf
*      so no need to waste memory for more.
set ipf:ipf_nattable_sz = 10009
set ipf:ipf_natrules_sz = 127
set ipf:ipf_rdrrules_sz = 127
  11. How can I build a transparent proxy using Squid on Solaris 8?
    Solaris8 on Sparc is straightforward, however, doing this on Intel requires a tweak. Here's instructions for both platforms:
    • Get Squid-2.4STABLE1
    • Get and apply the 6 patches at http://www.squid-cache.org/Versions/v2/2.4/bugs/
      save these as the-patch-filename.patch
      $ for file in `ls *.patch`
      > do
      > echo "applying patch $file..."
      > patch -p0 < $file
      > done
    • Edit out the ipv6 struct as described in http://marc.theaimsgroup.com/?l=ipfilter&m=99557783205895&w=2

      Now for Solaris 8 on Sparc you are ready to go:
      # ./configure --enable-ipf-transparent ; make

      But for Solaris 8 on x86 you need two more steps...
    • First solve the va_args issue with gcc 2.95.2 on x86
      # diff -c src/client_side.c.orig src/client_side.c
      *** src/client_side.c.orig      Thu Jul 19 17:41:12 2001
      
--- src/client_side.c   Thu Jul 19 17:41:45 2001
      
***************
      
*** 37,42 ****
      
--- 37,45 ----
      

  #if IPF_TRANSPARENT
  #if HAVE_SYS_IOCTL_H
+ #if     defined(va_start) /* dirty hack. sol7/8 x86 + gcc 2.95.2 */
+ #define _SYS_VARARGS_H
+ #endif
  #include 
  #endif
  #include
      #

    • Next solve the #define free issue (WTF?)
      # diff -c src/squid.h.orig src/squid.h
      *** src/squid.h.orig    Thu Jul 19 17:38:57 2001
--- src/squid.h Thu Jul 19 17:40:26 2001
***************
*** 403,411 ****
  #ifndef malloc
  #define malloc +
  #endif
! #ifndef free
! #define free +
! #endif
  #ifndef calloc
  #define calloc +
  #endif
--- 403,411 ----
  #ifndef malloc
  #define malloc +
  #endif
! //#ifndef free
! //#define free +
! //#endif
  #ifndef calloc
  #define calloc +
  #endif
      #

    • Now finally for Solaris8 x86 you can
      # ./configure --enable-ipf-transparent ; make
    That should be it.
Previous | TOC | Next