Date: Fri, 2 May 2003 15:57:50 +0100 From: Matthew Seaman <m.seaman@infracaninophile.co.uk> To: Vince Hoffman <Vince.Hoffman@uk.circle.com> Cc: "'freebsd-questions@freebsd.org'" <freebsd-questions@freebsd.org> Subject: Re: firewalling choice Message-ID: <20030502145750.GA13479@happy-idiot-talk.infracaninophile.co.uk> In-Reply-To: <3500515B75D9D311948800508BA37955014BDAB6@EX-LONDON> References: <3500515B75D9D311948800508BA37955014BDAB6@EX-LONDON>
next in thread | previous in thread | raw e-mail | index | archive | help
--7AUc2qLy4jB3hD7Z
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Fri, May 02, 2003 at 02:19:25PM +0100, Vince Hoffman wrote:
> Hi,=20
> i'm looking at implementing a freebsd (4.8-RELEASE) firewall. Since
> Freebsd supports ipfw and ipf I was wondering if either one has a particu=
lar
> advantage over the other. Can anyone point me at a comparison/give me an
> informed opinion ?
This has become a FAQ on this list over the last few weeks.
Unfortunately, there is no definitive answer as to which one is
"better", nor is there huge disparity between the sizes of the
constituencies that favour one over the other.
Either ipfw or ipf will almost certainly do what you want: which one
you choose is pretty much a matter of taste nowadays. Oh, there are
anecdotal reports that one will out-perfom the other at a particular
task, and that the other is better for something else, but for a
normally loaded machine just doing packet filtering and/or NAT, the
differences are probably not going to be significant.
The biggest difference between the two from the user perspective is
that ipfw(8) is a 'first match wins' type ruleset, whereas ipf(8) is
'last match wins'. Read the manual pages to find out which syntax
suits you best. If you can't decide, toss a coin. In extremis, you
can run *both* ipfw and ipf, but check the archives for details of how
they interact and what order the rulesets get applied to packets in
various situations. If you choose ipfw(8), do read the section in the
man page about enabling ipfw2 support --- it offers some handy new
syntax for writing rulesets and personally I think ipfw2 should be the
default ipfw version in 4.x by now (as it is in FreeBSD 5.x).
Cheers,
Matthew
--=20
Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks
Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614 Bucks., SL7 1TH UK
--7AUc2qLy4jB3hD7Z
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)
iD8DBQE+sodudtESqEQa7a0RArjTAJ9IVyZStqh1r7b/e2tL2R0Mas50fACeNVt6
7Vsia34LAIyT8fMY4nDU0pM=
=1xB0
-----END PGP SIGNATURE-----
--7AUc2qLy4jB3hD7Z--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030502145750.GA13479>