Date: Mon, 17 Jan 2000 23:54:29 +0200 From: Giorgos Keramidas <charon@hades.hell.gr> To: Brian Anderson <bunicula@rcn.com> Cc: freebsd-questions@FreeBSD.ORG Subject: Re: ipf/ipnat vs. ipfw/natd Message-ID: <20000117235429.A4455@hades.hell.gr> In-Reply-To: <Pine.BSF.4.21.0001171517030.2666-100000@asmodeus.diabolis.net> References: <Pine.BSF.4.21.0001171517030.2666-100000@asmodeus.diabolis.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, Jan 17, 2000 at 03:19:06PM -0500, Brian Anderson wrote:
>
> so, the latest step in my freebsd education is firewalling. from what
> i can see, there are 2 told that seem heavily used: ipf with ipnat,
> and ipfw with natd.
>
> is there any place i can find a comparison of the two: pros and cons,
> and all that happy stuff?
None that I know of.
> it looks like ipfw is the default, but ipf is easier to find
> documentation on...
Yup, ipfw is the default, but ipf works like a charm too, once you get
the kernel to compile with the proper options.
One thing that I really like in ipf is that rules can be split in
groups, depending on criteria of your own, i.e.
block in on lo0 head 10
block out on lo0 head 20
block in on tun0 head 30
block out on tun0 head 40
will use ruleset 10 for incoming lo0 traffic, ruleset 20 for outgoing
lo0 traffic, etc. But, someone might prefer:
block in head 10
block in quick proto tcp head 20
block in quick proto udp head 30
block in quick proto icmp head 40
and use ruleset 10 for filtering all protocols, 20 for filtering tcp,
etc. you get my point.
It seems to me that ipf is more flexible than ipfw, but this might be
my own personal (and admittedly humble) opinion. The best thing to do
is try them both and see what you come up with, which one suits you
better. Since I was playing with ipfw a few months ago, you might find
the two articles in my home page listed below of some use when trying
it out :)
[1] Annotated sample ipfw(8) configuration.
http://students.ceid.upatras.gr/~keramida/freebsd/ipfw.html
[2] A closed-firewall with ipfw(8)
http://students.ceid.upatras.gr/~keramida/freebsd/ipfw-closed.html
Ciao.
--
Giorgos Keramidas, < keramida @ ceid . upatras . gr >
"What we have to learn to do, we learn by doing." [Aristotle]
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20000117235429.A4455>