Date: Wed, 28 Nov 2001 11:30:13 +0000 From: Josh Paetzel <friar_josh@webwarrior.net> To: Vikash Badal / PCS <VikashB@ComparexAfrica.co.za> Cc: "Freebsd-Questions (E-mail)" <freebsd-questions@FreeBSD.ORG> Subject: Re: Which provides a better firewall (ipfw or ipf) Message-ID: <20011128113013.B550@twincat.vladsempire.net> In-Reply-To: <501BF453CDCFD111A6E40080C83DAC04E4BB27@PSICS001>; from VikashB@ComparexAfrica.co.za on Wed, Nov 28, 2001 at 03:15:53PM %2B0200 References: <501BF453CDCFD111A6E40080C83DAC04E4BB27@PSICS001>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Nov 28, 2001 at 03:15:53PM +0200, Vikash Badal / PCS wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Greetings, > > I have been searching around and am still unsure as to which > one (ipfw or ipf) is the better solution to implement on a firewall. > > I have used ipfw before and understand it (mostly). > ipf was ported to FreeBSD recently and is it better than ipfw ? > > Which (based upon your experiences) is the better solution > > Thanks > Vikash Having used ipfw for quite a while I recently changed over to ipf. There were a couple of reasons that factored into my decision. #1 ipf is available on OpenBSD and NetBSD as well as FreeBSD, so familiarity with it enables a bit of portability that ipfw doesn't give you. #2 Ipf has the ability to keep two rulesets loaded, and allows you to easily switch between them. This is especially useful when changing or debugging rulesets on an active connection. The advantages that ipfw had over ipf in my case were: #1 I was familiar with the ipfw syntax, but not the ipf syntax. This can easily lead to a firewall that doesn't do what you expect it to. #2 ipfw uses a first match wins ruleset, whereas ipf is a last match wins setup. This can cause the ruleset to get quite bulky and hard to follow especially if it is a longish ruleset, as you end up using a lot of quick rules to keep common packets from going through every rule in the list. Hope that helps you make an informed decision. Josh To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011128113013.B550>