From owner-freebsd-ipfw Fri Jan 7 5:45:23 2000 Delivered-To: freebsd-ipfw@freebsd.org Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by hub.freebsd.org (Postfix) with ESMTP id 5F209156A2 for ; Fri, 7 Jan 2000 05:45:21 -0800 (PST) (envelope-from robert@cyrus.watson.org) Received: from fledge.watson.org (robert@fledge.pr.watson.org [192.0.2.3]) by fledge.watson.org (8.9.3/8.9.3) with SMTP id IAA38607 for ; Fri, 7 Jan 2000 08:45:29 -0500 (EST) (envelope-from robert@cyrus.watson.org) Date: Fri, 7 Jan 2000 08:45:29 -0500 (EST) From: Robert Watson X-Sender: robert@fledge.watson.org Reply-To: Robert Watson To: freebsd-ipfw@freebsd.org Subject: Two-way transparency Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Last night at the fug-washdc meeting, we discussed expansions to ipfw that might be useful--not doubt someone will post a summary soon. One of the issues I raised and am interested in is the ability to have userland proxies filter traffic in a completely transparent way -- i.e., two way transparency. Right now with NAT and divert sockets, fwds, etc, it's easy to do transparency from the perspective of a client application *making* a connection, but I'm not sure how to go about allowing the proxy to go about making an outgoing connection that appears to come from the client. There are a number of applications where this would be useful, including transparent local firewalls on multi-user machines, filtering incoming connections, firewalls for protocols that bind address information into their connections, etc. It would allow a userland proxy-based firewall (such as fwtk, etc) to look more like a traditional packet filter not running with NAT. Anyone have any thoughts on this? :-) Robert N M Watson robert@fledge.watson.org http://www.watson.org/~robert/ PGP key fingerprint: AF B5 5F FF A6 4A 79 37 ED 5F 55 E9 58 04 6A B1 TIS Labs at Network Associates, Safeport Network Services To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message