From owner-freebsd-pf@FreeBSD.ORG  Tue Jan 23 23:54:31 2007
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 199C616A402
	for <freebsd-pf@freebsd.org>; Tue, 23 Jan 2007 23:54:31 +0000 (UTC)
	(envelope-from Greg.Hennessy@nviz.net)
Received: from smtp.nildram.co.uk (smtp.nildram.co.uk [195.149.33.74])
	by mx1.freebsd.org (Postfix) with ESMTP id DEE5513C4C6
	for <freebsd-pf@freebsd.org>; Tue, 23 Jan 2007 23:54:30 +0000 (UTC)
	(envelope-from Greg.Hennessy@nviz.net)
Received: from gw2.local.net (unknown [62.3.210.251])
	by smtp.nildram.co.uk (Postfix) with ESMTP id 90D75559F5
	for <freebsd-pf@freebsd.org>; Tue, 23 Jan 2007 23:34:50 +0000 (GMT)
From: "Greg Hennessy" <Greg.Hennessy@nviz.net>
To: "'Martin Turgeon'" <turgeon.martin@gmail.com>
References: <45B684BD.8090706@gmail.com>
In-Reply-To: <45B684BD.8090706@gmail.com>
Date: Tue, 23 Jan 2007 23:34:24 -0000
Message-ID: <000001c73f47$041659b0$0c430d10$@Hennessy@nviz.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: Acc/PqHkR1HdBTomS/uGkZF9PoXPuAAByhOA
Content-Language: en-gb
Cc: freebsd-pf@freebsd.org
Subject: RE: PF in kernel or as a module
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Jan 2007 23:54:31 -0000

> Hi all!
> 
> I would like to start a debate on this subject. Which method of
> enabling
> PF is the more secure (buffer overflow for example), the fastest, the
> most stable, etc. I searched the web for some info but without result.
> So I would like to know your opinion on the pros and cons of each
> method.

For production Freebsd based firewalls I have always built the kernel with
PF. The idea being that if something does go pear shaped, there's a good
chance that at least the packet filter will stay operational. 

OpenBSDs standard pre loaded /etc/rc filter  (which drops everything except
ssh & IIRC dns) would also be nice, but my understanding is that to
implement it on Free would break the startup elsewhere. 


Greg