From owner-freebsd-questions@freebsd.org Mon Mar 6 13:44:21 2017 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id F3193CFB0CC for ; Mon, 6 Mar 2017 13:44:21 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) Received: from relay2.tomsk.ru (mail.sibptus.tomsk.ru [212.73.124.5]) by mx1.freebsd.org (Postfix) with ESMTP id 69E031471 for ; Mon, 6 Mar 2017 13:44:20 +0000 (UTC) (envelope-from vas@mpeks.tomsk.su) X-Virus-Scanned: by clamd daemon 0.98.5_1 for FreeBSD at relay2.tomsk.ru Received: from [212.73.125.240] (HELO admin.sibptus.transneft.ru) by relay2.tomsk.ru (CommuniGate Pro SMTP 5.1.16) with ESMTPS id 39630442; Mon, 06 Mar 2017 19:39:48 +0600 Received: from admin.sibptus.transneft.ru (sudakov@localhost [127.0.0.1]) by admin.sibptus.transneft.ru (8.14.9/8.14.9) with ESMTP id v26Di0kd031775; Mon, 6 Mar 2017 20:44:00 +0700 (KRAT) (envelope-from vas@mpeks.tomsk.su) Received: (from sudakov@localhost) by admin.sibptus.transneft.ru (8.14.9/8.14.9/Submit) id v26Dhutq031774; Mon, 6 Mar 2017 20:43:56 +0700 (KRAT) (envelope-from vas@mpeks.tomsk.su) X-Authentication-Warning: admin.sibptus.transneft.ru: sudakov set sender to vas@mpeks.tomsk.su using -f Date: Mon, 6 Mar 2017 20:43:56 +0700 From: Victor Sudakov To: Polytropon Cc: Michael Wilcox , freebsd-questions@freebsd.org Subject: Re: UFW-Like frontend for IPFW Message-ID: <20170306134355.GA31641@admin.sibptus.transneft.ru> References: <20170305154702.cf5ceb9d.freebsd@edvax.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170305154702.cf5ceb9d.freebsd@edvax.de> Organization: AO "Svyaztransneft", SibPTUS X-PGP-Key: http://www.dreamwidth.org/pubkey?user=victor_sudakov X-PGP-Fingerprint: 10E3 1171 1273 E007 C2E9 3532 0DA4 F259 9B5E C634 User-Agent: Mutt/1.7.1 (2016-10-04) X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Mar 2017 13:44:22 -0000 Polytropon wrote: > On Sun, 5 Mar 2017 17:57:02 +0530, Michael Wilcox wrote: > > I was wondering if there is any frontend for IPFW. > > > > Does anyone have one or must I use it directly? > > If I see the analogy correctly, a "UFW-like frontend" already > is "included" with ipfw, i. e., ipfw works at a comparable > level. If you compare the ufw commands with the ipfw commands, > they are quite similar, so you'd use ipfw directly in the same > manner as you use ufw to interact with iptables. > > As an equation: > > ufw ipfw > ---------- = ------ > iptables ipfw > > More or less... ;-) There is one thing that a higher level macro language on top of ipfw would be nice to have for. Several times I have tried to emulate Cisco PIX/ASA logic with ipfw. I just want to have e.g. 3 interfaces: inside, outside, dmz with security levels of 100, 0, 50 respectively. Traffic can flow from the interface with a higher security level to the interface with a lower security level, and return traffic is permitted too. Every time I have tried to express this with ipfw rules, I failed miserably, though superficially it looks simple (with keep-state). Has anyone done this? -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN AS43859