IPFilter

IRIX does have an IPFilter port for people looking to use firewalls on their machines. This page details several uses of it.

Setup

IPFilter is an established open source software package written and maintained by Darren Reed under a modified BSD style license. Source code is available from the project's homepage. It claims to have been tested and run under IRIX 6.2 and 6.5 (loadable kernel module), however, there have reportedly been problems with compiling versions beyond 4.1.x. It provides both filtering and NAT functionality.

SGI once made available a precompiled and patched version of the software on their (now defunct) Cool Software site. This packaged version was compiled against the 6.5.16 IRIX kernel, but is known to work with some caveats on systems running 6.5.30. The package installs itself under the product name ipfilter and should not be confused with the older kernel module ipfilterd which is a part of the eoe.sw.ipgate software subsystem. In fact, IPFilter and ipfilterd are mutually exclusive. There is even a terse but useful SGI Tech Pub document, IRIX Admin: IPFilter Firewall User's Guide, that explains some of the (intended) IRIX implimentation details. Like so many other SGI/IRIX efforts of the new millennium, this one too appears to have been abortive.

The install components of the software base subsystem (ipfilter.sw.base) include:

Note that the ipfilter filter executable utilities (e.g. mkfilters) reside in a subdirectory /usr/ipfilter/bin, that will not normally be in your path.

Configuring

IPFilter is a sophisticated tool and configuring it properly requires some effort with a small learning curve. Fortunately, there is an excellently written HowTo tutorial available for download in addition to other documentation: https://web.archive.org/web/20110822105615/http://www.obfuscation.org/ipf/ipf-howto.html

The files that control the particulars of the installation are:

The ipf.conf and ipnat.conf being the chief config files.

Enabling

To enable, shut of ipfilterd (unrelated package) and turn on ipfilter using chkconfig:

The ipfilter daemon will not have started yet, but it can be manually invoked as root using the start-up script:

If ipfilterd is already running, a reboot is probably required to fully deactivate it.

Examples

Simple Firewall

This is a relatively old example retrieved from the Nekochan Wiki, and probably can be optimized further.

Routing with NAT and Firewall

Chapter 3 of SGI's IRIX documentation, https://irix7.com/techpubs/007-2860-012.pdf, describes a very simple process of turning an IRIX machine with multiple ethernet interfaces into a router. A summary of the steps are:

1. Enable the 2nd interface (by modifying /etc/config/netif.options) and name it gate-<1st interface name>
2. Reconfigure the kernel and restart the system

Supposedly, IRIX will auto-magically start routing packets. What is not discussed is the following:

Is the routed daemon running?

chkconfig routed on|off

Should gated be used instead?

chkconfig gated on|off

Should IP Forwarding be enabled? (Software Manager->Network and Connectivity->Configure Interface)

Below are the contents of the NAT configuration file, /etc/ipnat.conf, set up so that a private network (192.168.0.x) can access the public network through an IRIX (dual-interfaced) gateway that is running IPFilter.

map tg0 192.168.0.0/24 -> <gateway's public IP address>/32

The machines on the private network should have their default routes set to the private address of the gateway (e.g. 192.168.0.1)

Testing / Bugs

The existing SGI packaged IPFilter is known to spew the following messages to the console when it is up on machines with gigabit ethernet interfaces (tg0, tg1, etc.).

IPFilter: ipl_if_output: mbuf block too small (m_len=0) for IP vers+hlen, m_type=2 m_flags=0x41

This appears to be harmless debug messages.

The best way is to set l2tcpseg to OFF (default is ON) in /etc/config/tgconfig.options, assuming the machine is using an original SGI Gigabit interface on IRIX 6.5.27.