Firewall doesn't load ipfw.conf

Question

This is a repost in the 10.5 forum; it was posted in the 10.4 forum by mistake as http://discussions.apple.com/thread.jspa?messageID=6834128
PROBLEMS:
1. Unable to forward port 80 to port 8080 using Apple's Firewall in Server Admin (Firewall => Settings => Advanced). I want to forward port 80 (and 443) so that I can run Tomcat 6 standalone as a non-privileged user).
2. Apple's firewall documentation states that rules in /etc/ipfilter/ipfw.conf will be loaded after /etc/ipfilter/ipfw.conf.apple is loaded, but upon reboot this does not happen. It does work if Server Admin is used to modify the Firewall rules after booting.
This is /etc/ipfilter/ipfw.conf.apple -- all standard rules as shipped by Apple except for rule 1010 which should forward port 80 to port 8080. It does not work. However, adding rule 1010 as any rule number < 1000 and it does work (but this can't be done using ServerAdmin; it must be done manually).
00001 1 74 allow udp from any 626 to any dst-port 626
01000 2348 573022 allow ip from any to any via lo0
*01010 0 0 fwd 127.0.0.1,8080 tcp from any to any dst-port 80 in*
01020 0 0 deny ip from any to 127.0.0.0/8 in
01030 0 0 deny ip from 224.0.0.0/4 to any in in
01040 0 0 deny tcp from any to 224.0.0.0/4 in in
12300 69595 10045552 allow tcp from any to any established
12301 2 128 allow tcp from any to any out
12302 0 0 allow tcp from any to any dst-port 22
12302 0 0 allow udp from any to any dst-port 22
12303 16 1144 allow udp from any to any out keep-state
12304 0 0 allow tcp from any to any dst-port 53 out keep-state
12304 0 0 allow udp from any to any dst-port 53 out keep-state
12305 0 0 allow udp from any to any in frag
12306 0 0 allow tcp from any to any dst-port 311
12307 0 0 allow tcp from any to any dst-port 625
12308 0 0 allow udp from any to any dst-port 626
12309 0 0 allow icmp from any to any icmptypes 8
12310 0 0 allow icmp from any to any icmptypes 0
12311 0 0 allow igmp from any to any
12312 0 0 allow tcp from any to any dst-port 80
12313 0 0 allow tcp from any to any dst-port 8080
12314 0 0 allow tcp from any to any dst-port 9006,8080,8443
12315 0 0 allow tcp from any to any dst-port 443
65534 20 1556 deny ip from any to any
65535 0 0 allow ip from any to any
The above rule 1010 does NOT work; no forwarding occurs. However, applying the exact same rule on the command line works perfectly:
sudo ipfw add 100 fwd 127.0.0.1,8080 tcp from any to any dst-port 80 in
After the above line is executed, port forwarding works great:
00001 1 74 allow udp from any 626 to any dst-port 626
00100 84 8975 fwd 127.0.0.1,8080 tcp from any to any dst-port 80 in
01000 3629 1853499 allow ip from any to any via lo0
01010 0 0 fwd 127.0.0.1,8080 tcp from any to any dst-port 80 in
01020 0 0 deny ip from any to 127.0.0.0/8 in
01030 0 0 deny ip from 224.0.0.0/4 to any in in
01040 0 0 deny tcp from any to 224.0.0.0/4 in in
12300 78059 11439073 allow tcp from any to any established
12301 5 320 allow tcp from any to any out
12302 0 0 allow tcp from any to any dst-port 22
12302 0 0 allow udp from any to any dst-port 22
12303 27 2304 allow udp from any to any out keep-state
12304 0 0 allow tcp from any to any dst-port 53 out keep-state
12304 0 0 allow udp from any to any dst-port 53 out keep-state
12305 0 0 allow udp from any to any in frag
12306 0 0 allow tcp from any to any dst-port 311
12307 0 0 allow tcp from any to any dst-port 625
12308 0 0 allow udp from any to any dst-port 626
12309 0 0 allow icmp from any to any icmptypes 8
12310 0 0 allow icmp from any to any icmptypes 0
12311 0 0 allow igmp from any to any
12312 0 0 allow tcp from any to any dst-port 80
12313 0 0 allow tcp from any to any dst-port 8080
12314 0 0 allow tcp from any to any dst-port 9006,8080,8443
12315 0 0 allow tcp from any to any dst-port 443
65534 29 2270 deny ip from any to any
65535 0 0 allow ip from any to any
Of course, rule #100 added via "sudo ipfw..." disappears upon reboot. So I tried adding it to /etc/ipfilter/ipfw.conf because Apple's comments in /etc/ipfilter/ipfw.conf.default state:
+# Administrators can place custom ipfw rules in ipfw.conf.+
+# Whenever a change is made to the ipfw rules by the Server Admin application and saved:+
+# 1. All ipfw rules are flushed+
+# 2. The rules defined by the Server Admin app (stored as plists) are exported to+
+# /etc/ipfilter/ipfw.conf.apple and loaded into the firewall via ipfw.+
+# 3. The rules in /etc/ipfilter/ipfw.conf are loaded into the firewall via ipfw.+
+# Note that the rules loaded into the firewall are not applied unless the firewall is enabled.+
But this is not true--upon reboot the rules are not loaded as seen by 'ipfw show'. However, making a change in the Server Admin GUI does add the rules in ipfw.conf! Go figure.
Workaround
I created a 'launchd' plist/script just to add the rule I need, and that works OK. But why can't this just work like it's supposed to?
*The file setup-ipfw.plist in /Library/LaunchDaemons:*
<?xml version=“1.0” encoding=“UTF-8”?>
<!DOCTYPE plist PUBLIC “-//Apple Computer//DTD PLIST 1.0//EN” “<a class="jive-link-external-small" href="http://www.apple.com/DTDs/PropertyList-1.0.dtd”>">http://www.apple.com/DT Ds/PropertyList-1.0.dtd”>
<plist version=“1.0”>
<dict>
<key>Disabled</key> <false/>
<key>LaunchOnlyOnce</key><true/>
<key>EnvironmentVariables</key>
<dict>
<key>DIGLLOYD_WEB</key><string>/web</string>
</dict>
<key>Label</key><string>DIGLLOYD Firewall Setup</string>
<key>OnDemand</key><false/>
<key>ProgramArguments</key>
<array>
<string>/web/scripts/setup-ipfw.sh</string>
</array>
<key>RunAtLoad</key><true/>
<key>ServiceDescription</key><string>DIGLLOYD map ports</string>
<key>UserName</key><string>root</string>
</dict>
</plist>
*The script (mangled in part by this forum):*
DIGLLOYD-INC-Server:~ lloyd$ cat /web/scripts/setup-ipfw.sh
export RULE_NUM=101
function shutdown()
ipfw delete $RULE_NUM
ipfw add $RULE_NUM fwd 127.0.0.1,8080 tcp from any to any 80 in
echo DIGLLOYD: added 'ipfw' rule for mapping port 80 to 8080

Answer 1

grep EE /var/log/Xorg.0.log while booted from Arch CD
Current Operating System: Linux apollo 2.6.22-ARCH #1 SMP PREEMPT Wed Sep 26 20:57:40 CEST 2007 i686
(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(II) Loading extension MIT-SCREEN-SAVER
(EE) RADEON(0): [dri] RADEONDRIGetVersion failed to open the DRM
grep EE /var/log/Xorg.0.log after switching to regular boot and removing hash from marked comments in xorg.conf
Current Operating System: Linux apollo 2.6.23-ARCH #1 SMP PREEMPT Sun Nov 18 07:43:05 UTC 2007 i686
(WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(II) Loading extension MIT-SCREEN-SAVER
Yeah, not a whole lot.
Last edited by ghyspran (2007-12-05 05:14:06)