From owner-freebsd-hackers Thu Jan 16 22:28:18 2003 Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5CC6437B401 for ; Thu, 16 Jan 2003 22:28:17 -0800 (PST) Received: from kanga.honeypot.net (kanga.honeypot.net [208.162.254.122]) by mx1.FreeBSD.org (Postfix) with ESMTP id A6A4043EB2 for ; Thu, 16 Jan 2003 22:28:12 -0800 (PST) (envelope-from kirk@strauser.com) Received: from pooh.honeypot.net (pooh.honeypot.net [10.0.5.128]) by kanga.honeypot.net (8.12.6/8.12.6) with ESMTP id h0H6S2JF053565 for ; Fri, 17 Jan 2003 00:28:02 -0600 (CST) (envelope-from kirk@strauser.com) Received: from pooh.honeypot.net (localhost [127.0.0.1]) by pooh.honeypot.net (8.12.7/8.12.7/Debian-2) with ESMTP id h0H6RxZI024352 for ; Fri, 17 Jan 2003 00:27:59 -0600 Received: (from kirk@localhost) by pooh.honeypot.net (8.12.7/8.12.7/Debian-2) id h0H6RwN3024351; Fri, 17 Jan 2003 00:27:58 -0600 X-Authentication-Warning: pooh.honeypot.net: kirk set sender to kirk@strauser.com using -f To: freebsd-hackers@freebsd.org Subject: Re: FreeBSD firewall for high profile hosts - waste of time ? References: <20030116104652.T86991-100000@mail.econolodgetulsa.com> From: Kirk Strauser Date: Fri, 17 Jan 2003 00:27:54 -0600 In-Reply-To: <20030116104652.T86991-100000@mail.econolodgetulsa.com> (Josh Brooks's message of "Thu, 16 Jan 2003 10:52:00 -0800 (PST)") Message-ID: <873cnsjno5.fsf@pooh.honeypot.net> Lines: 26 X-Mailer: Gnus/5.090008 (Oort Gnus v0.08) Emacs/21.2 (i386-pc-linux-gnu) MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature" Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG --=-=-= Content-Transfer-Encoding: quoted-printable At 2003-01-16T18:52:00Z, Josh Brooks writes: > If I have a large network with high profile hosts (50+ shell servers, 50 > or more different ircds running) am I wasting my time trying to hack and > tweak a FreeBSD host-based firewall running ipfw ? Out of curiosity, have you tried FreeBSD + ipfilter (or even OpenBSD + pf, for that matter)? I've really come to appreciate ipfilter's syntax and flexibility, and it's statefulness always seemed to work better than IPFW's for me for some odd reason. Note that I mentioned statefulness. You should really, really investigate the potential useful of a stateful firewall. The massive win there is that once a connection is accepted, it gets added to a known-good list which is searched before incoming packets get sent through the filter list, and usually much more quickly. In other words, each "accept" rule will only get processed once *per connection*, rather than once *per packet*. Finally, I'm not sure of the lastest hardware recommendations, but I'd put the absolute best NICs in that machine that I could afford. Anyone know what the current king of the FreeBSD hill is? =2D-=20 Kirk Strauser In Googlis non est, ergo non est. --=-=-= Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQA+J6Ju5sRg+Y0CpvERAnzoAJ0Q3H1A2HbwyvA13Ylx3NMjTR5ODgCfWe+3 vfUC7ePnC1XyoMqzZRzPYFs= =HP4H -----END PGP SIGNATURE----- --=-=-=-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message