1

We are using ipfw in OSX 10.6 Server, 10.7 Server... all working fine until we add too many rules, I think.

ipfw will still work, but only process up to certain number of rules.

Currently wc -l /etc/ipfilter/ipfw.conf gives 10486.

ipfw is giving an Abort Trap after partially processing the file /etc/ipfilter/ipfw.conf. It seems that the default limit of the number of rules is below 10486.

We searched for answer extensively and come to the conclusion that to raise this limit we should use sysctl -w net.inet.ip.fw.dyn_max=A LARGER NUMBER.

We tried:

sh-3.2# sysctl -w net.inet.ip.fw.dyn_max=32768
net.inet.ip.fw.dyn_max: 4096 -> 32768

but Abort Trap still occur at the same line number at /etc/ipfilter/ipfw.conf. It makes no difference.

Here is what's in Console:

Process:         Line 9999 [92737]
Path:            /sbin/ipfw
Identifier:      Line 9999
Version:         ??? (???)
Code Type:       X86-64 (Native)
Parent Process:  running job [92734]

Date/Time:       2017-01-01 06:14:05.155 +0800
OS Version:      Mac OS X Server 10.6.4 (10F616)
Report Version:  6

Anonymous UUID:                      A34B328D-1392-4E66-AE5A-A1AAD361FB0F

Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Application Specific Information:
__abort() called

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   libSystem.B.dylib               0x00007fff818b83d6 __kill + 10
1   libSystem.B.dylib               0x00007fff81958913 __abort + 103
2   libSystem.B.dylib               0x00007fff8194d157 mach_msg_receive + 0
3   libSystem.B.dylib               0x00007fff818ab898 __sprintf_chk + 196
4   ipfw                            0x000000010000829c 0x100000000 + 33436
5   ipfw                            0x00000001000016a0 0x100000000 + 5792

Thread 0 crashed with X86 Thread State (64-bit):
  rax: 0x0000000000000000  rbx: 0x00007fff5fbff830  rcx: 0x00007fff5fbff828  rdx: 0x0000000000000000
  rdi: 0x0000000000016a41  rsi: 0x0000000000000006  rbp: 0x00007fff5fbff850  rsp: 0x00007fff5fbff828
   r8: 0x0000000000000001   r9: 0x0000000100100ec0  r10: 0x00007fff818b4412  r11: 0x0000000000000206
  r12: 0x00007fff702d0ec0  r13: 0x00007fff5fbff9c0  r14: 0x00007fff702c25c0  r15: 0x00007fff5fbffdc0
  rip: 0x00007fff818b83d6  rfl: 0x0000000000000206  cr2: 0x000000002bcb1000

Binary Images:
       0x100000000 -        0x10000afff +ipfw ??? (???) <54351948-0FF7-75DA-5974-ECA1CE04565A> /sbin/ipfw
    0x7fff5fc00000 -     0x7fff5fc3bdef  dyld 132.1 (???) <B536F2F1-9DF1-3B6C-1C2C-9075EA219A06> /usr/lib/dyld
    0x7fff81869000 -     0x7fff81a29fef  libSystem.B.dylib 125.2.0 (compatibility 1.0.0) <95E02DD0-ADEA-745B-E7FA-ABA064E4658C> /usr/lib/libSystem.B.dylib
    0x7fff83937000 -     0x7fff8393bff7  libmathCommon.A.dylib 315.0.0 (compatibility 1.0.0) <95718673-FEEE-B6ED-B127-BCDBDB60D4E5> /usr/lib/system/libmathCommon.A.dylib
    0x7fffffe00000 -     0x7fffffe01fff  libSystem.B.dylib ??? (???) <95E02DD0-ADEA-745B-E7FA-ABA064E4658C> /usr/lib/libSystem.B.dylib

The output from sysctl -a is as below:

net.inet.ip.fw.enable: 1
net.inet.ip.fw.autoinc_step: 100
net.inet.ip.fw.one_pass: 0
net.inet.ip.fw.debug: 0
net.inet.ip.fw.verbose: 0
net.inet.ip.fw.verbose_limit: 0
net.inet.ip.fw.dyn_buckets: 256
net.inet.ip.fw.curr_dyn_buckets: 256
net.inet.ip.fw.dyn_count: 0
net.inet.ip.fw.dyn_max: 24576
net.inet.ip.fw.static_count: 9964
net.inet.ip.fw.dyn_ack_lifetime: 300
net.inet.ip.fw.dyn_syn_lifetime: 20
net.inet.ip.fw.dyn_fin_lifetime: 1
net.inet.ip.fw.dyn_rst_lifetime: 1
net.inet.ip.fw.dyn_udp_lifetime: 10
net.inet.ip.fw.dyn_short_lifetime: 5
net.inet.ip.fw.dyn_keepalive: 1

We placed the following line in /etc/sysctl.conf and rebooted.

net.inet.ip.fw.dyn_max=24576
Improve this question
2
  • Based on what do you assume that ipfw fails due to too many rules (and not just an error in the configuration)?
    – nohillside ♦
    Commented Jan 5, 2017 at 13:09
  • I would think so...
    – charleslcso
    Commented Jan 5, 2017 at 13:30

2 Answers 2

Reset to default
1

To increase the number of possible dynamic rules you have to either create /etc/sysctl.conf with the content net.inet.ip.fw.dyn_max=32768 or if the file already exists, add the respective line.

It's not sufficient to change the value temporarily with (sudo) sysctl -w net.inet.ip.fw.dyn_max=32768 because it will not survive a reboot.

Improve this answer
8
  • Found out that putting the above in file survives reboots, but it has no effect on how many dyn rules ipfw can store. Found out that the number of active rules in ipfw is 9963, which coincides with the value net.inet.ip.fw.static_count=9963 from sysctl. But having a larger value stored in /etc/sysctl.conf won't make a difference... after reboot the active value is still 9963...
    – charleslcso
    Commented Jan 5, 2017 at 15:32
  • @charleslcso the *.static_count value can't be increased or decreased because it simply represents the number of all static rules but doesn't limit them. Please add the output of sysctl -A | grep net.inet.ip.fwto your question. You will also get some unrelated kern.* entries - remove them before adding the output.
    – klanomath
    Commented Jan 5, 2017 at 15:46
  • Edited the question with output from sysctl -a
    – charleslcso
    Commented Jan 6, 2017 at 0:55
  • Anyone can help?
    – charleslcso
    Commented Jan 8, 2017 at 13:32
  • @charleslcso Can you send me the ruleset somehow (or publish it somehwere). I tried to find a >10k lines ruleset in the Internet but failed and I was too lazy to create one myself. To some extent you may mask your private IP addresses by using a aaa.xxx.yyy.zzz notation for different local IPs so I can easily replace them by IPs in my virtual network.
    – klanomath
    Commented Jan 8, 2017 at 13:37
0

The problem might well be an inordinately large Ipfw.conf.

This is what the output of the wc command states.

The ipfw likely was written with the presumption that the config file can only be a small file. Your conf probably overran the allocated memory for the config.

Next, if you need 10,000 rules on your firewall, then something is wrong with your approach. Can you succinctly define needed rules in pseudo code or actual ipfw grammar? Then we can devise a streamlined ruleset.

F.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .