Ipfw

ipfw is one of the first, if not _the_ first firewall in Open Source software. It was written first on FreeBSD and has been ported to NetBSD and Apple Mac OS X. It is a first-match-wins firewall meaning the first rule that matches a packet will be used in the pass/deny policy. At first it was not stateful, this has been added at a later time.

AUTHORS
The following people implemented ipfw:

Ugen J. S. Antsilevich, Poul-Henning Kamp, Alex Nash, Archie Cobbs, Luigi Rizzo.

Userland API
The ipfw command is used to add, delete, show rules.

To add a rule you would type the following:

00001 deny ip from 10.0.0.1 to any
 * 1) ipfw add 1 deny IP from 10.0.0.1 to any

To see the rules added to the system you would type the following (also note dynamic rules, these are open states):

00001    0       0 deny ip from 10.0.0.1 to any ... 01400   46    3816 allow udp from me to any keep-state out ... 01400 1 80 (T 0, # 160) ty 0 udp, 85.74.45.248 49169 <-> xxx.xxx.173.124 53 01400 1 84 (T 0, # 161) ty 0 udp, 85.74.45.248 49168 <-> xxx.xxx.173.124 53 ... To delete a rule you would type:
 * 1) ipfw show
 * 1) Dynamic rules:

ipfw: rule 1 does not exist
 * 1) ipfw delete 1
 * 2) ipfw show 1

To flush the entire firewall rules you would type:

Are you sure? [yn] n
 * 1) ipfw flush

If you are scripting a flush you may want to add the -q flag to ipfw, this will not prompt to flush the rules anymore and just flushes. Be very careful with this by default ipfw will deny all traffic unless the kernel is compiled with the IPFIREWALL_DEFAULT_TO_ACCEPT kernel option. When reloading rules in a script it's important to run it in the background or else the script will not complete loading the rules after the flush.

natd
natd stands for network address translation daemon. It reads from an ipfw divert socket, does the translation and injects the translated packet back into the next firewall rule that processed it. Natd runs in userland not in kernel.