From owner-freebsd-net@FreeBSD.ORG  Fri Nov 14 10:38:29 2008
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@FreeBSD.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id E67FF1065674;
	Fri, 14 Nov 2008 10:38:29 +0000 (UTC)
	(envelope-from brde@optusnet.com.au)
Received: from fallbackmx10.syd.optusnet.com.au
	(fallbackmx10.syd.optusnet.com.au [211.29.132.251])
	by mx1.freebsd.org (Postfix) with ESMTP id 382A78FC1A;
	Fri, 14 Nov 2008 10:38:29 +0000 (UTC)
	(envelope-from brde@optusnet.com.au)
Received: from mail02.syd.optusnet.com.au (mail02.syd.optusnet.com.au
	[211.29.132.183])
	by fallbackmx10.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id
	mAEAM3PT022097; Fri, 14 Nov 2008 21:22:03 +1100
Received: from c122-106-151-199.carlnfd1.nsw.optusnet.com.au
	(c122-106-151-199.carlnfd1.nsw.optusnet.com.au [122.106.151.199])
	by mail02.syd.optusnet.com.au (8.13.1/8.13.1) with ESMTP id
	mAEALt9I015701
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Fri, 14 Nov 2008 21:21:58 +1100
Date: Fri, 14 Nov 2008 21:21:55 +1100 (EST)
From: Bruce Evans <brde@optusnet.com.au>
X-X-Sender: bde@delplex.bde.org
To: Julian Elischer <julian@elischer.org>
In-Reply-To: <491D375D.1070809@elischer.org>
Message-ID: <20081114211043.W54700@delplex.bde.org>
References: <491CD94F.3020207@elischer.org>
	<20081114133913.K70117@sola.nimnet.asn.au>
	<491D375D.1070809@elischer.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: FreeBSD Net <freebsd-net@FreeBSD.org>, ipfw@FreeBSD.org,
	Ian Smith <smithi@nimnet.asn.au>
Subject: Re: rc.firewall quick change
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 14 Nov 2008 10:38:30 -0000

On Fri, 14 Nov 2008, Julian Elischer wrote:

> Ian Smith wrote:
>> On Thu, 13 Nov 2008, Julian Elischer wrote:
>>  > At home I use the following change.
>>  >  >  > basically, instead of doing 8 rules before and after the nat,
>>  > use a table and to 1 rule on each side.
>>  >  >  > any objections?
>> 
>> Only that if people are already using tables for anything, chances are 
>> they've already used table 1 (well, it's the first one I used :)  How about 
>> using table 127 for this as a rather less likely prior choice?
>
> yes I thought of that..

Separate rules provide more statistics.

> in fact it should be ${BLOCKTABLE} and let the user define what he wants. 
> (defaulting to 99 or something).

I use shell variables giving lists of interfaces to be blocked so that
there aren't very many rules:

%%%
rfc1918n=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
dmanningn=0.0.0.0/8,169.254.0.0/16,192.0.2.0/24,224.0.0.0/4,240.0.0.0/4

${fwcmd} add deny log all from any to ${rfc1918n} via ${oif}
${fwcmd} add deny log all from any to ${dmanningn} via ${oif}

... (divert rule)

${fwcmd} add deny log all from ${rfc1918n} to any via ${oif}
${fwcmd} add deny log all from ${dmanningn} to any via ${oif}
%%%

I use separate lists mainly for documentation purposes but they also
provide separate statistics.

> Remember though that a user wouldn't be using 'simple' if he's using his own 
> tables etc.

Separate rules are also simplest for documentation purposes.

>> Apart from that, this will speed up 'simple' on a path every packet takes, 
>> which has to be a good thing.

Are tables faster than lists of addresses?  I would expect lists to be
slightly more efficient.

Bruce