From owner-freebsd-pf@FreeBSD.ORG Tue Dec 13 10:13:29 2005 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 65DFF16A41F for ; Tue, 13 Dec 2005 10:13:29 +0000 (GMT) (envelope-from solinym@gmail.com) Received: from wproxy.gmail.com (wproxy.gmail.com [64.233.184.200]) by mx1.FreeBSD.org (Postfix) with ESMTP id 905E643D5C for ; Tue, 13 Dec 2005 10:13:28 +0000 (GMT) (envelope-from solinym@gmail.com) Received: by wproxy.gmail.com with SMTP id i3so86492wra for ; Tue, 13 Dec 2005 02:13:28 -0800 (PST) DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=V8FtZIaGgP+0OTDKHf28DiNdWggNL4LmHMTT2YVUxwcNuGiklwOq7ctNDqAX6/Zk7TZ64xXHU4PcsgXr7V7jWWh70coLXx4Ry1PrUJwZESTIendJqVD5KZB6vnxUfRz4D3snIDl5qfXf2CXXkZunqz7vXh6YrqVxo/aniYalpa8= Received: by 10.54.149.3 with SMTP id w3mr624734wrd; Tue, 13 Dec 2005 02:13:27 -0800 (PST) Received: by 10.54.78.20 with HTTP; Tue, 13 Dec 2005 02:13:27 -0800 (PST) Message-ID: Date: Tue, 13 Dec 2005 04:13:27 -0600 From: "Travis H." To: freebsd-pf@freebsd.org In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable Content-Disposition: inline References: Subject: Re: Firewall concepts X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2005 10:13:29 -0000 On 12/12/05, Marcus Franke wrote: > Sounds interesting, you have such a software that would compile > the actual ruleset for the local machine depending from textfiles > which could be stored on a single directory mounted from a controlling > server? > > For example, this is the way Windows works and fetches their policy > sets from domain controllers :) Yes, I have a general-purpose text preprocessor I can send you. Or you can use something like m4 although it is complicated. I would avoid using cpp because it has many C-specific assumptions last time I checked. If you "pull" the files from a central location, I recommend caching them locally in case that central location is unavailable.=20 Alternately, you can "push" the files to each computer using scp or rsync-over-ssh every time you make a change. There is a tradeoff between pull and push, mostly it depends on whether you want every client access *to* a server, or if you'd rather make every client allow connections *from* a single machine. -- http://www.lightconsulting.com/~travis/ -><- P=3DNP if (P=3D0 or N=3D1) "My love for mathematics is like 1/x as x approaches 0." GPG fingerprint: 50A1 15C5 A9DE 23B9 ED98 C93E 38E9 204A 94C2 641B