Go to main content

Securing the Network in Oracle® Solaris 11.3

Exit Print View

Updated: April 2019

How to Display IP Filter Service Defaults

Before You Begin

To run the ipfstat command, you must become an administrator who is assigned the IP Filter Management rights profile. For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.3.

  1. View the configuration file names and locations for the IP Filter service.
    $ svccfg -s ipfilter:default listprop   | grep file
    config/ipf6_config_file                      astring     /etc/ipf/ipf6.conf
    config/ipnat_config_file                     astring     /etc/ipf/ipnat.conf
    config/ippool_config_file                    astring     /etc/ipf/ippool.conf
    firewall_config_default/custom_policy_file   astring     none

    The first three file properties have default file locations. These files do not exist until you create them. If you change the location of a configuration file, you must change the property value for that file. For the procedure, see How to Create IP Filter Configuration Files.

    You modify the fourth file property when you customize your own packet filtering rules. See Step 1 and Step 2 in How to Create IP Filter Configuration Files.

  2. Determine if the IP Filter service is enabled.
    • On a manually networked system, IP Filter is not enabled by default.

      $ svcs -x ipfilter:default
      svc:/network/ipfilter:default (IP Filter)
       State: disabled since Mon Sep 10 10:10:50 2012
      Reason: Disabled by an administrator.
         See: http://oracle.com/msg/SMF-8000-05
         See: ipfilter(5)
      Impact: This service is not running.
    • On an automatically networked system on an IPv4 network, run the following command to view the IP Filter policy:

      # ipfstat -io

      Note -  To view IP Filter policy on an IPv6 network, add the –6 option, as in: ipfstat -6io. For more information, see the ipfstat(1M) man page.