FreeBSD uses the configuration file "/etc/hosts.allow" to both allow and restrict network access to other machines on a network. The file is read by the "inetd" daemon (service wrapper) when services are requested to decide if the request should be granted or denied. Unlike Linux which uses both hosts.allow and hosts.deny, BSD uses only hosts.allow to configure permissions.

The syntax of the hosts.allow file is:

	daemon_list : client_list : option : option ...
	service : domain : permission
	service : domain1 domain2 domain3: permission

Special Directives:

	ALL   - The ALL directive will match anything when used in place
	        of either the 'service' or 'domain' area.

		To specify all services:
			ALL : domain : permission
		To specify all domains:
			service : ALL : permission

LOGGING:
	severity mail.info
	severity notice
	Change the severity level at which the event will be logged.
	Facility names (such as mail) are optional, and are not supported
	on systems with older syslog implementations. The severity option
	can be used to emphasize or to ignore specific events.





RUNNING OTHER COMMANDS
       spawn shell_command
              Execute,  in  a  child process, the specified shell
              command, after performing the %  expansions
              described  in the hosts_access(5) manual page.  The
              command is executed with stdin, stdout  and  stderr
              connected to the null device, so that it won't mess
              up the conversation with the client host. Example:

                 spawn (/some/where/safe_finger -l @%h | /usr/ucb/mail root) &

              executes, in a background child process, the  shell
              command  "safe_finger  -l  @%h  |  mail root" after
              replacing %h by the name or address of  the  remot

       twist shell_command
              Replace  the  current process by an instance of the
              specified  shell  command,  after  performing   the
              %     expansions     described    in    the
              hosts_access(5) manual  page.   Stdin,  stdout  and
              stderr  are  connected  to the client process. This
              option must appear at the end of a rule.

              To send a customized bounce message to  the  client
              instead of running the real ftp daemon:

                 in.ftpd : ... : twist /bin/echo 421 Some bounce message

              For an alternative way to talk to client processes,
              see the banners option below.

              To run /some/other/in.telnetd without polluting its
              command-line array or its process environment:

                 in.telnetd : ... : twist PATH=/some/other; exec in.telnetd

              Warning:   in case of UDP services, do not twist to
              Warning:   in case of UDP services, do not twist to
              commands  that  use  the  standard   I/O   or   the
              read(2)/write(2)  routines  to communicate with the
              client process; UDP requires other I/O  primitives.

NETWORK OPTIONS
       keepalive
              Causes the server to periodically send a message to
              the client.  The connection  is  considered  broken
              when  the  client  does  not respond. The keepalive
              option can be useful  when  users  turn  off  their
              machine  while  it  is still connected to a server.
              The keepalive option is  not  useful  for  datagram
              (UDP) services.

       linger number_of_seconds
              Specifies  how  long the kernel will try to deliver
              not-yet delivered data  after  the  server  process
              closes a connection.

USERNAME LOOKUP
       rfc931 [ timeout_in_seconds ]
              Look up the client user name with the RFC 931 (TAP,
              IDENT, RFC 1413) protocol.  This option is silently
              ignored  in  case  of  services based on transports
              other than TCP.  It requires that the client system
              runs  an  RFC  931 (IDENT, etc.) -compliant daemon,
              and may cause noticeable  delays  with  connections
              from  non-UNIX  clients.   The  timeout  period  is
              optional. If no timeout is specified a compile-time
              defined default value is taken.







To Prevent those with no reverse DNS from connecting:
	ALL : PARANOID : RFC931 20 : deny

fingerd : ALL : spawn (echo Finger. | /usr/bin/mail -s "tcpd\: %u@%h[%a] fingered me!" root) & : deny
ALL : ALL : severity auth.info : twist /bin/echo "You are not welcome to use %d from %h."

FreeBSD "hosts.allow" Example

#	See hosts_options(5) for the format of this file.
#	hosts_access(5) no longer fully applies.

# Start by allowing everything (this prevents the rest of the file
# from working, so remove it when you need protection).
# The rules here work on a "First match wins" basis.
ALL : ALL : allow

# Wrapping sshd(8) is not normally a good idea, but if you
# need to do it, here's how
#sshd : .evil.cracker.example.com : deny 

# Prevent those with no reverse DNS from connecting.
#ALL : PARANOID : RFC931 20 : deny

# Allow anything from localhost.  Note that an IP address (not a host
# name) *MUST* be specified for portmap(8).
ALL : localhost 127.0.0.1 : allow
#ALL : my.machine.example.com 192.0.2.35 : allow

# To use IPv6 addresses you must enclose them in []'s
ALL : [fe80::%fxp0]/10 : allow
ALL : [fe80::]/10 : deny
ALL : [3ffe:fffe:2:1:2:3:4:3fe1] : deny
ALL : [3ffe:fffe:2:1::]/64 : allow

# Sendmail can help protect you against spammers and relay-rapers
sendmail : localhost : allow
sendmail : .nice.guy.example.com : allow
sendmail : .evil.cracker.example.com : deny
sendmail : ALL : allow

# Exim is an alternative to sendmail, available in the ports tree
exim : localhost : allow
exim : .nice.guy.example.com : allow
exim : .evil.cracker.example.com : deny
exim : ALL : allow

# Portmapper is used for all RPC services; protect your NFS!
# (IP addresses rather than hostnames *MUST* be used here)
portmap : 192.168.1.0/255.255.255.0 : allow
portmap : ALL : deny

# Provide a small amount of protection for ftpd
ftpd : localhost : allow
ftpd : .nice.guy.example.com : allow
ftpd : .evil.cracker.example.com : deny
ftpd : ALL : allow

# You need to be clever with finger; do _not_ backfinger!! You can easily
# start a "finger war".
fingerd : ALL \
	: spawn (echo Finger. | \
	 /usr/bin/mail -s "tcpd\: %u@%h[%a] fingered me!" root) & \
	: deny

# The rest of the daemons are protected.
ALL : ALL \
	: severity auth.info \
	: twist /bin/echo "You are not welcome to use %d from %h."