From owner-freebsd-questions@FreeBSD.ORG Mon Apr 28 19:50:12 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2003F106564A for ; Mon, 28 Apr 2008 19:50:12 +0000 (UTC) (envelope-from bruce@cran.org.uk) Received: from muon.bluestop.org (unknown [IPv6:2001:41c8:1:548a::2]) by mx1.freebsd.org (Postfix) with ESMTP id B98758FC14 for ; Mon, 28 Apr 2008 19:50:11 +0000 (UTC) (envelope-from bruce@cran.org.uk) Received: from [IPv6:2a01:348:10f:0:6d0d:28f6:f87:a81] (unknown [IPv6:2a01:348:10f:0:6d0d:28f6:f87:a81]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by muon.bluestop.org (Postfix) with ESMTP id 4F0EF30108; Mon, 28 Apr 2008 20:50:10 +0100 (BST) Message-ID: <48162A6E.8050607@cran.org.uk> Date: Mon, 28 Apr 2008 20:50:06 +0100 From: Bruce Cran User-Agent: Thunderbird 2.0.0.12 (Windows/20080213) MIME-Version: 1.0 To: Doug Hardie References: <05B6619C-9771-41EA-B43E-05DB40CB3258@lafn.org> In-Reply-To: <05B6619C-9771-41EA-B43E-05DB40CB3258@lafn.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-questions Subject: Re: Firewalls X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 28 Apr 2008 19:50:12 -0000 Doug Hardie wrote: > FreeBSD supports 3 firewalls: IPF, IPFW, and PF. Some time ago > (perhaps years) I seem to recall some discussion that one or more of > those was better maintained and higher quality than the others. I don't > see any indications of this in the handbook. Several years ago I needed > to do traffic shaping and used IPFW with dummynet. It worked but the > need eventually went away. More recently I needed to incorporate spamd > which defaults to PF so I used that. However, now I am back to needing > traffic shaping again. I suspect trying to use both PF and IPFW > simultaneously will not be a good approach. In addition, there now are > instructions for using spamd with IPFW so it appears that either PF or > IPFW will do what I need. Is there any additional information available > to assist in selecting between those? Thanks. As I understand it pf is often found to be easiest to use and has lots of features like altq and os fingerprinting but is quite a bit slower than ipfw. -- Bruce