From owner-freebsd-security Wed Nov 21 9:29:45 2001 Delivered-To: freebsd-security@freebsd.org Received: from tomts17-srv.bellnexxia.net (tomts17.bellnexxia.net [209.226.175.71]) by hub.freebsd.org (Postfix) with ESMTP id 9822B37B405 for ; Wed, 21 Nov 2001 09:29:34 -0800 (PST) Received: from khan.anarcat.dyndns.org ([65.94.128.110]) by tomts17-srv.bellnexxia.net (InterMail vM.4.01.03.16 201-229-121-116-20010115) with ESMTP id <20011121172933.BKPQ16532.tomts17-srv.bellnexxia.net@khan.anarcat.dyndns.org>; Wed, 21 Nov 2001 12:29:33 -0500 Received: from shall.anarcat.dyndns.org (shall.anarcat.dyndns.org [192.168.0.1]) by khan.anarcat.dyndns.org (Postfix) with ESMTP id C653B1A4D; Wed, 21 Nov 2001 12:30:44 -0500 (EST) Received: by shall.anarcat.dyndns.org (Postfix, from userid 1000) id 2ADF820ADB; Wed, 21 Nov 2001 12:31:06 -0500 (EST) Date: Wed, 21 Nov 2001 12:31:06 -0500 From: The Anarcat To: Bart Matthaei Cc: freebsd-security@rikrose.net, security@freebsd.org Subject: Re: Best security topology for FreeBSD Message-ID: <20011121173105.GA44370@shall.anarcat.dyndns.org> Mail-Followup-To: Bart Matthaei , freebsd-security@rikrose.net, security@freebsd.org References: <7052044C7D7AD511A20200508B5A9C585169B6@MAGRAT> <20011121181929.A15275@heresy.dreamflow.nl> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="u3/rZRmxL6MmkK24" Content-Disposition: inline In-Reply-To: <20011121181929.A15275@heresy.dreamflow.nl> User-Agent: Mutt/1.3.23.2i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --u3/rZRmxL6MmkK24 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed Nov 21, 2001 at 06:19:29PM +0100, Bart Matthaei wrote: > On Wed, Nov 21, 2001 at 05:01:15PM +0000, freebsd-security@rikrose.net wr= ote: > > Basically, ipfw doesn't give as much control over the packets and > > filtering as ipfilter, so use both. >=20 > Care to explain why ? For this I don't know. I thought both had the same capabilities too. > I think ipfw/ipf handle packets just as well.. Agreed. > The only thing i recall is a story about ipfw sending packets trough > userland (?!). But thats just a vague story i've read somewhere. It's not a vague story. *In order to do NAT*, you must send packets to the natd daemon, using a divert rule. ipf doesn't need that, as there is a ipnat kernel module to replace natd. a. --u3/rZRmxL6MmkK24 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjv75NUACgkQttcWHAnWiGd4yQCfXZcZ4Dxor00WCAbxm6zVvh4S AkYAniw+S6Ej+OW0z3pKTQa4BGaOM8no =PVkx -----END PGP SIGNATURE----- --u3/rZRmxL6MmkK24-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message