Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 9 Jan 2002 14:19:52 +0300
From:      "Andrey Simonenko" <simon@comsys.ntu-kpi.kiev.ua>
To:        "Heimes, Rene" <rh@com-con.net>
Cc:        <freebsd-questions@freebsd.org>
Subject:   Re: firewalling with ipfw
Message-ID:  <005501c198ff$8fac4a00$6d36120a@comsys.ntukpi.kiev.ua>
References:  <F54B610C5BFDE546BBA2F6CC595ACC75084A0B@exchange2000>

next in thread | previous in thread | raw e-mail | index | archive | help

----- Original Message -----
From: Heimes, Rene <rh@com-con.net>
Newsgroups: lucky.freebsd.questions
Sent: Wednesday, January 09, 2002 3:07 PM
Subject: AW: firewalling with ipfw


> >IP Filter also can't do it for you. Probably you should tell us your
> task,
> >because I can't understand really needs of such Firewall feature.
>
> OK, letīs try...
> There is one half Class-C Network (out of 16 others....)
> There are a several groups of servers and workstations with different
> inbound/ outbound rulesets:
> - Webservers
> - Application Servers
> - Full Access Workstations
> - Restricted Access Workstations and finally
> - No Access Workstations
>
> Each group matches to non-coherent IP-Addresses.
>
> Right now, because i wrote each ruleset for almost every single ip,
> there is a 70k large rc.firewall file that affects system throughput
> heavily.
>
> Thatīs my problem - understandable now? How can i make this file
> smaller? How can i aggregate rulesets and ipīs???
>

1. Use "keep-state"
2. Use "skipto"
3. Use intermediate FreeBSD routers for IP Firewalling
4. Reorganize structure of your IP addresses space
5. Restrict access with hardware routers




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?005501c198ff$8fac4a00$6d36120a>