From owner-freebsd-questions@freebsd.org  Thu Dec  8 00:23:32 2016
Return-Path: <owner-freebsd-questions@freebsd.org>
Delivered-To: freebsd-questions@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id EF71EC6CBBD
 for <freebsd-questions@mailman.ysv.freebsd.org>;
 Thu,  8 Dec 2016 00:23:32 +0000 (UTC)
 (envelope-from wblock@wonkity.com)
Received: from wonkity.com (wonkity.com [67.158.26.137])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "wonkity.com", Issuer "wonkity.com" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id B2AB4DCD
 for <freebsd-questions@freebsd.org>; Thu,  8 Dec 2016 00:23:32 +0000 (UTC)
 (envelope-from wblock@wonkity.com)
Received: from wonkity.com (localhost [127.0.0.1])
 by wonkity.com (8.15.2/8.15.2) with ESMTPS id uB80NROL019759
 (version=TLSv1.2 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO);
 Wed, 7 Dec 2016 17:23:27 -0700 (MST)
 (envelope-from wblock@wonkity.com)
Received: from localhost (wblock@localhost)
 by wonkity.com (8.15.2/8.15.2/Submit) with ESMTP id uB80NQ3h019756;
 Wed, 7 Dec 2016 17:23:27 -0700 (MST)
 (envelope-from wblock@wonkity.com)
Date: Wed, 7 Dec 2016 17:23:26 -0700 (MST)
From: Warren Block <wblock@wonkity.com>
To: Polytropon <freebsd@edvax.de>
cc: byrnejb@harte-lyne.ca, freebsd-questions@freebsd.org
Subject: Re: FreeBSD Firewalls
In-Reply-To: <20161207231046.504c2a61.freebsd@edvax.de>
Message-ID: <alpine.BSF.2.20.1612071721550.5616@wonkity.com>
References: <5bed7716cd0c9f56e7fe73e86d0cde45.squirrel@webmail.harte-lyne.ca>
 <alpine.BSF.2.20.1612071450340.5616@wonkity.com>
 <20161207231046.504c2a61.freebsd@edvax.de>
User-Agent: Alpine 2.20 (BSF 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.1
 (wonkity.com [127.0.0.1]); Wed, 07 Dec 2016 17:23:27 -0700 (MST)
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions/>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
 <mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 08 Dec 2016 00:23:33 -0000

On Wed, 7 Dec 2016, Polytropon wrote:

> On Wed, 7 Dec 2016 14:55:34 -0700 (MST), Warren Block wrote:
>> On Wed, 7 Dec 2016, James B. Byrne via freebsd-questions wrote:
>>
>>> Well, the setup and loading of Postgresql9.6 seems to have completed
>>> successfully.  Now, before this can go live I need to set up the
>>> firewall.  I am used to IPTables on CentOS but have no experience with
>>> IPFilter or PF.
>>>
>>> First, which firewall, of the three I read are available (IPFW,
>>> IPFilter and PF is the recommended choice?
>>
>> Either PF or IPFW, depending on who you ask.
>
> Or depending on _how_ you ask: For simple and "static" concepts,
> IPFW is the typical suggestion, while more advanced and extended
> firewalls setups lead to PF as a recommendation. But of course
> it's not that one of the firewalls cannot be used for the other
> "contradicting" purpose... :-)

For me, it was that PF was easier to configure, certainly for simple 
things.  I'm told IPFW has improved since then, and NAT is now better.