From owner-freebsd-questions@FreeBSD.ORG Sun Jul 20 18:13:01 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id F1F75FC9 for ; Sun, 20 Jul 2014 18:13:01 +0000 (UTC) Received: from mx02.qsc.de (mx02.qsc.de [213.148.130.14]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id AEE782CFF for ; Sun, 20 Jul 2014 18:13:01 +0000 (UTC) Received: from r56.edvax.de (port-92-195-69-249.dynamic.qsc.de [92.195.69.249]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx02.qsc.de (Postfix) with ESMTPS id 999D227610; Sun, 20 Jul 2014 20:12:52 +0200 (CEST) Received: from r56.edvax.de (localhost [127.0.0.1]) by r56.edvax.de (8.14.5/8.14.5) with SMTP id s6KICp7g002404; Sun, 20 Jul 2014 20:12:51 +0200 (CEST) (envelope-from freebsd@edvax.de) Date: Sun, 20 Jul 2014 20:12:51 +0200 From: Polytropon To: Alexander Kabaev Subject: Re: Future of pf / firewall in FreeBSD ? - does it have one ? Message-Id: <20140720201251.3bdd2226.freebsd@edvax.de> In-Reply-To: <20140720134133.1d30f725@kan> References: <53C706C9.6090506@com.jkkn.dk> <20140718110645.GN87212@FreeBSD.org> <20140718151255.b3e677d9.gerrit.kuehn@aei.mpg.de> <53CA2D39.6000204@sasktel.net> <20140720123916.GV96250@e-new.0x20.net> <20140720134133.1d30f725@kan> Reply-To: Polytropon Organization: EDVAX X-Mailer: Sylpheed 3.1.1 (GTK+ 2.24.5; i386-portbld-freebsd8.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Cc: FreeBSD Mailing List X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Jul 2014 18:13:02 -0000 On Sun, 20 Jul 2014 13:41:33 -0400, Alexander Kabaev wrote: > It was stated repeatedly by multiple people that FreeBSD's network > stack is way too different from OpenBSD, we support features > OpenBSD doesn't and vice versa, vimage is a good example, which throws a > giant wrench into the plan of following OpenBSD 'as closely as > possible', even as the expense of throwing away all of the SMP work > done in pf to date. The difference between FreeBSD's and OpenBSD's network stack is also a problem that you can hardly compensate by maintaining two versions of pf, one provided with the system, one available via ports (as FreeBSD 10 did with unbound / bind), and you also would have to decide which version ("old" or "new") goes with the OS and which comes from ports. Of course following a "moving target" is much easier to do with ports (higher frequency of changes is possible) than with an OS component, and I should emphasize OS _core_ component, as pf is _very_ tightly integrated with kernel and OS mechanisms. Learning a new syntax is the smallest problem here, and BSD folks (as UNIX people in general) have a great reputation of being able to learn new things, evaluate them, and use them as needed, in comparison to those poor guys over in MICROS~1 land... ;-) -- Polytropon Magdeburg, Germany Happy FreeBSD user since 4.0 Andra moi ennepe, Mousa, ...