ipf(8) on Solnix vs Linux and the BSDs
On Solnix, ipf is the illumos IP Filter rule loader at /usr/sbin/ipf. It is the same program family as FreeBSD and NetBSD ipf(8). Linux (iptables, nft), FreeBSD ipfw, OpenBSD pfctl and NetBSD npfctl are different tools. Packet filtering is off by default and is switched on through the SMF service network/ipfilter.
The manual pages
- Solnix: ipf(8) from
pkgs.solnix.illumos-world-man· illumos.org - Linux: iptables(8) iptables-1.8.13 (different command, similar job)
- Linux: nft(8) nftables-1.1.6 (different command, similar job)
- FreeBSD: ipf(8) 15.1-RELEASE
- FreeBSD: ipfw(8) 15.1-RELEASE (different command, similar job)
- OpenBSD: pfctl(8) 8.0 (different command, similar job)
- NetBSD: ipf(8) 11.0
- NetBSD: npfctl(8) 11.0 (different command, similar job)
What Solnix runs
A default Solnix system runs the illumos ipf at /usr/sbin/ipf, published in pkgs.solnix.illumos-world-man. No other variants are shipped. The page says packet filtering is not enabled by default. Enable it with `svcadm enable network/ipfilter`, which runs `ipf -E`, `ippool -f`, `ipf -f` and `ipnat -f`. ipf needs root, because /dev/ipauth, /dev/ipl and /dev/ipstate are root-only by default.
Differences
| Compared with | Topic | What differs |
|---|---|---|
| FreeBSD, NetBSD | same program family | Solnix, FreeBSD and NetBSD ipf share the same core options: -A, -I, -o, -r, -s, -n, -E, -D, -F, -f, -l, -T, -v, -V, -y, -z and -Z. An ipf rule file and these invocations carry over with few changes.Source: Solnix ipf(8) OPTIONS; FreeBSD ipf(8) OPTIONS; NetBSD ipf(8) OPTIONS |
| FreeBSD | -6 for IPv6 rules | On Solnix, -6 is required to parse and load IPv6 rules. On FreeBSD, IPv4 and IPv6 rules share one table and -6 is no longer required. A script that omits -6 loads IPv6 rules on FreeBSD but not on Solnix.Source: Solnix ipf(8) -6; FreeBSD ipf(8) -6 |
| NetBSD | -6 for IPv6 rules | Solnix and NetBSD agree: -6 is required to parse IPv6 rules and have them loaded.Source: Solnix ipf(8) -6; NetBSD ipf(8) -6 |
| FreeBSD, NetBSD | -c compiled rules | FreeBSD and NetBSD ipf accept -c language (only C, -cc), which writes ip_rules.c and ip_rules.h for the IPFILTER_COMPILED kernel option. The Solnix synopsis and options have no -c.Source: FreeBSD ipf(8) -c; NetBSD ipf(8) -c; Solnix ipf(8) SYNOPSIS |
| FreeBSD, NetBSD | zones: -G and zonename | Solnix ipf takes an optional zonename argument and -G, which changes the global-zone-controlled ipfilter for that zone. FreeBSD and NetBSD ipf have neither.Source: Solnix ipf(8) SYNOPSIS, -G; FreeBSD ipf(8) SYNOPSIS; NetBSD ipf(8) SYNOPSIS |
| FreeBSD, NetBSD | -R name resolution | Solnix ipf -R disables IP address-to-hostname and port-to-service name resolution. FreeBSD and NetBSD ipf list no -R.Source: Solnix ipf(8) -R; FreeBSD ipf(8) OPTIONS; NetBSD ipf(8) OPTIONS |
| FreeBSD, NetBSD | -F state flushing | FreeBSD and NetBSD ipf also accept -F5 to -F11 (flush by TCP state) and -F<number> above 30 (flush state idle for that many seconds). Solnix documents only -F i|o|a and -F s|S.Source: FreeBSD ipf(8) -F<5|...|11>, -F<number>; NetBSD ipf(8) same; Solnix ipf(8) -F |
| FreeBSD, NetBSD | fully established state count | The Solnix page says a fully established connection shows as 4/4 in `ipfstat -s`. FreeBSD and NetBSD pages say 5/5. A script matching that string must account for this.Source: Solnix ipf(8) -F s | S; FreeBSD ipf(8) -F <s|S>; NetBSD ipf(8) -F <s|S> |
| NetBSD | -l arguments | NetBSD ipf -l also accepts none, state and nat. Solnix (like FreeBSD) accepts only pass, block and nomatch.Source: NetBSD ipf(8) -l; Solnix ipf(8) -l; FreeBSD ipf(8) -l |
| FreeBSD | IPF_PREDEFINED variable | FreeBSD ipf reads IPF_PREDEFINED to supply ipfilter and ipnat variables from the shell. The Solnix page documents no environment variables. Source: FreeBSD ipf(8) ENVIRONMENT; Solnix ipf(8) (no ENVIRONMENT section in bundle) |
| all four | how ipf -f changes the rule set | Solnix `ipf -f` appends rules to the end of the kernel lists in file order (-r removes them). OpenBSD `pfctl -f` replaces the current ruleset, and NetBSD `npfctl reload` atomically replaces the ruleset, NAT policies and tables.Source: Solnix ipf(8) DESCRIPTION, -r; OpenBSD pfctl(8) -f; NetBSD npfctl(8) reload |
| OpenBSD | flag clash with pfctl | ipf -d turns on debug hex dumps and ipf -D disables the filter. pfctl -d disables the packet filter and pfctl -D defines a macro. ipf -E enables the filter; pfctl -e does.Source: Solnix ipf(8) -d, -D, -E; OpenBSD pfctl(8) -d, -D, -e |
| OpenBSD | default state | Solnix packet filtering is not enabled until network/ipfilter is enabled. The OpenBSD pfctl page says the packet filter is enabled by default. Source: Solnix ipf(8) Enabling Solaris IP Filter Feature; OpenBSD pfctl(8) DESCRIPTION |
Everyday tasks
| Task | Solnix | Linux | FreeBSD | OpenBSD | NetBSD |
|---|---|---|---|---|---|
| enable the firewall | svcadm enable network/ipfilter (runs ipf -E) | — | ipf -E; ipfw enable firewall | pfctl -e | ipf -E; npfctl start |
| disable the firewall | ipf -D | — | ipf -D; ipfw disable firewall | pfctl -d | ipf -D; npfctl stop |
| load rules from a file | ipf -f file | nft -f file | ipf -f file; ipfw pathname | pfctl -f file | ipf -f file; npfctl reload [path] |
| load rules from stdin | ipf -f - | nft -f - | ipf -f - | — | ipf -f -; npfctl validate - (validate only) |
| check rules without applying | ipf -n -f file | nft -c -f file | ipf -n -f file | — | ipf -n -f file; npfctl validate [path] |
| remove matching rules | ipf -r -f file | iptables -D chain rule-specification | ipf -r -f file; ipfw delete number | — | ipf -r -f file; npfctl rule name rem-id id |
| flush all rules | ipf -F a | iptables -F [chain] | ipf -F a; ipfw flush | pfctl -F rules | ipf -F a; npfctl flush |
| flush the state table | ipf -F S | — | ipf -F S | pfctl -F states | ipf -F S |
| list loaded rules | see ipfstat(8); not in this page | iptables -L or -S; nft list ruleset | ipfw list | pfctl -s rules | npfctl show |
Standards
- POSIX: ipf is not a POSIX.1-2024 utility.
Writing portable scripts
- The iptables, nft, ipfw, pfctl and npfctl tools use different commands and rule languages. Keep one rule file per firewall and branch on the tool present; only Solnix, FreeBSD and NetBSD share the ipf syntax.
- With ipf, pass
-6whenever the file has IPv6 rules. It is required on Solnix and NetBSD and is accepted on FreeBSD.
Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.