Address pools establish a single reference for a group of address/netmask pairs. Address pools reduce the time needed to match IP addresses with rules. Address pools also make managing large groups of addresses easier.
Address pool configuration rules can reside in a file that is loaded by the IP Filter service. You must create a file, then set its pathname as the value of the config/ippool_config_file property of the service. The default value is /etc/ipf/ippool.conf.
Use the following syntax to create an address pool:
table role = role-name type = storage-format number = reference-number
Defines the reference for the multiple addresses.
Specifies the role of the pool in IP Filter. The only role you can reference is ipf.
Specifies the storage format for the pool.
Specifies the reference number that is used by the filtering rule.
For example, to reference the group of addresses 10.1.1.1 and 10.1.1.2, and the network 192.16.1.0 as pool number 13, you would include the following rule in the address pool configuration file:
table role = ipf type = tree number = 13
{ 10.1.1.1/32, 10.1.1.2/32, 192.168.1.0/24 };Then, to reference pool number 13 in a filtering rule, you would construct the rule similar to the following example:
pass in from pool/13 to any
Note that you must load the pool file before loading the rules file that contains a reference to the pool. If you do not, the pool is undefined, as shown in the following output:
# ipfstat -io empty list for ipfilter(out) block in from pool/13(!) to any
Even if you add the pool later, the addition of the pool does not update the kernel rule set. You also need to reload the rules file that references the pool.
For the complete grammar and syntax, see the ippool(4) man page.