From owner-freebsd-security Sun Jul 30 9:27:23 2000 Delivered-To: freebsd-security@freebsd.org Received: from jade.chc-chimes.com (jade.chc-chimes.com [216.28.46.6]) by hub.freebsd.org (Postfix) with ESMTP id 844EB37B561 for ; Sun, 30 Jul 2000 09:27:19 -0700 (PDT) (envelope-from billf@jade.chc-chimes.com) Received: by jade.chc-chimes.com (Postfix, from userid 1001) id 6B61C1C65; Sun, 30 Jul 2000 12:27:18 -0400 (EDT) Date: Sun, 30 Jul 2000 12:27:18 -0400 From: Bill Fumerola To: Miklos Niedermayer Cc: Mike Hoskins , Darren Reed , Pavol Adamec , freebsd-security@FreeBSD.ORG Subject: Re: ipf or ipfw (was: log with dynamic firewall rules) Message-ID: <20000730122718.P5021@jade.chc-chimes.com> References: <200007270800.SAA23526@cairo.anu.edu.au> <20000729194821.B1716@bsd.hu> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: <20000729194821.B1716@bsd.hu>; from mico@bsd.hu on Sat, Jul 29, 2000 at 07:48:21PM +0200 X-Operating-System: FreeBSD 3.3-STABLE i386 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Sat, Jul 29, 2000 at 07:48:21PM +0200, Miklos Niedermayer wrote: > > The only real reason I've heard ipf reccomended since ipfw got > > keep-state/check-state is ipnat. > > I think that ipfw's statefullness is in a very early stage. It's unusable for any server that makes connections with a lot of clients (irc client server, www server, etc) but is useful for a server that only makes a few connections (application, irc hub server, etc..). Why? Add 6000 rules to your ipfw-based firewall and see what happens. -- Bill Fumerola - Network Architect, BOFH / Chimes, Inc. billf@chimesnet.com / billf@FreeBSD.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message