Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

The (Lion) Server Admin.app has a nice ability to apply firewall rules to ip address groups without having to edit ipfw config files.

But having to enter large and long lists of IP addresses using the Server Admin GUI is a tedious task.

Therefore I am wondering how can a firewall IP address group be made from the command line?

I know there is a /usr/sbin/serveradmin which has the ability to output settings, like using $ sudo serveradmin settings ipfilter:ipAddressGroupsWithRules:_array_id:10-net:* which outputs:

ipfilter:ipAddressGroupsWithRules:_array_id:10-net:rules = _empty_array
ipfilter:ipAddressGroupsWithRules:_array_id:10-net:readOnly = no
ipfilter:ipAddressGroupsWithRules:_array_id:10-net:allowAll = no
ipfilter:ipAddressGroupsWithRules:_array_id:10-net:addresses:_array_index:0 = "10.0.0.0/8"
ipfilter:ipAddressGroupsWithRules:_array_id:10-net:name = "10-net"

Which one can dump to a file using $ sudo serveradmin settings ipfilter:ipAddressGroupsWithRules:_array_id:10-net:* > 10-net.txt. But then editing that file to rename it to a new group, like:

ipfilter:ipAddressGroupsWithRules:_array_id:11-net:rules = _empty_array
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:readOnly = no
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:allowAll = no
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:addresses:_array_index:0 = "11.0.0.0/8"
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:name = "11-net"

and loading that into serveradmin using $ sudo serveradmin settings < 10-net.txt doesn't create a new "ipAddressGroupsWithRules" rule in ipfilter. As verified using $ sudo serveradmin settings ipfilter:ipAddressGroupsWithRules:_array_id:11-net:*.

What am I doing wrong?

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

After 12 hours of searching and and not finding any example for ipfilter:ipAddressGroupsWithRules this https://help.apple.com/advancedserveradmin/mac/10.7/#apdA0111C46-F018-4C2C-B8D1-EDAEF73AC27E brought a helpful insight.

The only thing that need to be changed to create a new rule, and not update an existing one, is a first line that creates the rule. For example:

ipfilter:ipAddressGroupsWithRules:_array_id:11-net = create
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:readOnly = no
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:allowAll = no
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:addresses:_array_index:0 = "11.0.0.0/8"
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:name = "11-net"

Now the output of $ sudo serveradmin settings < 10-net.txt is no longer:

ipfilter:ipAddressGroupsWithRules = _empty_array

but:

ipfilter:ipAddressGroupsWithRules:_array_id:11-net:readOnly = no
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:allowAll = no
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:addresses:_array_index:0 = "11.0.0.0/8"
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:rules = _empty_array
ipfilter:ipAddressGroupsWithRules:_array_id:11-net:name = "11-net"

Which is the synonym for that entering the new setting succeeded.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.