From owner-freebsd-security Wed Nov 21 9:31:56 2001 Delivered-To: freebsd-security@freebsd.org Received: from dreamflow.nl (dreamflow.nl [62.58.36.22]) by hub.freebsd.org (Postfix) with SMTP id 77F4737B416 for ; Wed, 21 Nov 2001 09:31:53 -0800 (PST) Received: (qmail 16909 invoked by uid 1000); 21 Nov 2001 17:31:51 -0000 Date: Wed, 21 Nov 2001 18:31:51 +0100 From: Bart Matthaei To: Dave Raven Cc: security@freebsd.org Subject: Re: Best security topology for FreeBSD Message-ID: <20011121183151.B15275@heresy.dreamflow.nl> References: <20011121181929.A15275@heresy.dreamflow.nl> <005f01c172b1$7a8503c0$3600a8c0@DAVE> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="XF85m9dhOBO43t/C" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <005f01c172b1$7a8503c0$3600a8c0@DAVE>; from dave@raven.za.net on Wed, Nov 21, 2001 at 07:25:12PM +0200 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org --XF85m9dhOBO43t/C Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Wed, Nov 21, 2001 at 07:25:12PM +0200, Dave Raven wrote: > ipfw runs in the kernel, but NAT runs in userland. hmm.. bummer :) > With IPFilter this is not so, IPNat runs in the kernel and should be faster. > If you are planning on large usage I would recommend IPFilter (less load) > and IPNat. I still dont see why ipf would be better when it comes to filtering. B. -- Bart Matthaei bart@dreamflow.nl /* Welcome to my world.. You just live in it */ --XF85m9dhOBO43t/C Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE7++UHgcc6pR+tCegRAp5fAKCKtjsVQjdN5sA7h2piTOYf46gMrgCfVEQk 8QEy7tTfc41L9ad8hJKAPGI= =vp8l -----END PGP SIGNATURE----- --XF85m9dhOBO43t/C-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message