Date: Wed, 9 Jan 2002 14:19:52 +0300 From: "Andrey Simonenko" <simon@comsys.ntu-kpi.kiev.ua> To: "Heimes, Rene" <rh@com-con.net> Cc: <freebsd-questions@freebsd.org> Subject: Re: firewalling with ipfw Message-ID: <005501c198ff$8fac4a00$6d36120a@comsys.ntukpi.kiev.ua> References: <F54B610C5BFDE546BBA2F6CC595ACC75084A0B@exchange2000>
next in thread | previous in thread | raw e-mail | index | archive | help
----- Original Message ----- From: Heimes, Rene <rh@com-con.net> Newsgroups: lucky.freebsd.questions Sent: Wednesday, January 09, 2002 3:07 PM Subject: AW: firewalling with ipfw > >IP Filter also can't do it for you. Probably you should tell us your > task, > >because I can't understand really needs of such Firewall feature. > > OK, letīs try... > There is one half Class-C Network (out of 16 others....) > There are a several groups of servers and workstations with different > inbound/ outbound rulesets: > - Webservers > - Application Servers > - Full Access Workstations > - Restricted Access Workstations and finally > - No Access Workstations > > Each group matches to non-coherent IP-Addresses. > > Right now, because i wrote each ruleset for almost every single ip, > there is a 70k large rc.firewall file that affects system throughput > heavily. > > Thatīs my problem - understandable now? How can i make this file > smaller? How can i aggregate rulesets and ipīs??? > 1. Use "keep-state" 2. Use "skipto" 3. Use intermediate FreeBSD routers for IP Firewalling 4. Reorganize structure of your IP addresses space 5. Restrict access with hardware routers To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?005501c198ff$8fac4a00$6d36120a>