---
name: "ipacct"
section: "4"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/ipaccounting"
---

# ipacct(4)

IP packet filter and traffic accounting

Part of [ipaccounting(4)](/ipaccounting/4.md).

## NAME

**ipfw** – IP packet filter and traffic accounting

## SYNOPSIS

To compile the driver into the kernel, place the following option in the kernel configuration file:

**options IPFIREWALL**

Other related kernel options which may also be useful are:

**options IPFIREWALL\_DEFAULT\_TO\_ACCEPT** **options IPDIVERT** **options IPFIREWALL\_NAT** **options IPFIREWALL\_NAT64** **options IPFIREWALL\_NPTV6** **options IPFIREWALL\_PMOD** **options IPFIREWALL\_VERBOSE** **options IPFIREWALL\_VERBOSE\_LIMIT=100** **options LIBALIAS**

To load the driver as a module at boot time, add the following line into the [loader.conf(5)](/loader.conf/5.md) file:

```
ipfw_load="YES"
```

## DESCRIPTION

The **ipfw** system facility allows filtering, redirecting, and other operations on IP packets travelling through network interfaces.

The default behavior of **ipfw** is to block all incoming and outgoing traffic. This behavior can be modified, to allow all traffic through the **ipfw** firewall by default, by enabling the IPFIREWALL\_DEFAULT\_TO\_ACCEPT kernel option. This option may be useful when configuring **ipfw** for the first time. If the default **ipfw** behavior is to allow everything, it is easier to cope with firewall-tuning mistakes which may accidentally block all traffic.

When using [natd(8)](/natd/8.md) in conjunction with **ipfw** as NAT facility, the kernel option IPDIVERT enables diverting packets to [natd(8)](/natd/8.md) for translation.

When using the in-kernel NAT facility of **ipfw**, the kernel option IPFIREWALL\_NAT enables basic [libalias(3)](/libalias/3.md) functionality in the kernel.

When using any of the IPv4 to IPv6 transition mechanisms in **ipfw**, the kernel option IPFIREWALL\_NAT64 enables all of these NAT64 methods in the kernel.

When using the IPv6 network prefix translation facility of **ipfw**, the kernel option IPFIREWALL\_NPTV6 enables this functionality in the kernel.

When using the packet modification facility of **ipfw**, the kernel option IPFIREWALL\_PMOD enables this functionality in the kernel.

To enable logging of packets passing through **ipfw**, enable the IPFIREWALL\_VERBOSE kernel option. The IPFIREWALL\_VERBOSE\_LIMIT option will prevent [syslogd(8)](/syslogd/8.md) from flooding system logs or causing local Denial of Service. This option may be set to the number of packets which will be logged on a per-entry basis before the entry is rate-limited.

When using the in-kernel NAT facility of **ipfw**, the kernel option LIBALIAS enables full [libalias(3)](/libalias/3.md) functionality in the kernel. Full functionality refers to included support for ftp, bbt, skinny, irc, pptp and smedia packets, which are missing in the basic [libalias(3)](/libalias/3.md) functionality accomplished with the IPFIREWALL\_NAT kernel option.

The user interface for **ipfw** is implemented by the [ipfw(8)](/ipfw/8.md) utility, so please refer to the [ipfw(8)](/ipfw/8.md) man page for a complete description of the **ipfw** capabilities and how to use it.

## SEE ALSO

[setsockopt(2)](/setsockopt/2.md), [libalias(3)](/libalias/3.md), [divert(4)](/divert/4.md), [ip(4)](/ip/4.md), [ip6(4)](/ip6/4.md), [ipfw(8)](/ipfw/8.md), [natd(8)](/natd/8.md), [sysctl(8)](/sysctl/8.md), [syslogd(8)](/syslogd/8.md), [pfil(9)](/pfil/9.md)