Date: 30 Nov 2003 10:59:12 -0000 From: alo@iki.fi.invalid (Antti Louko) To: stolz@i2.informatik.rwth-aachen.de Cc: hackers@freebsd.org Subject: Re: ipfw/ipf IP filtering thoughts Message-ID: <20031130105912.45288.qmail@alo.louko.com> In-Reply-To: <20031130085211.GA14925@i2.informatik.rwth-aachen.de> (message from Volker Stolz on Sun, 30 Nov 2003 09:52:11 %2B0100) References: <20031130065310.29349.qmail@alo.louko.com> <20031130085211.GA14925@i2.informatik.rwth-aachen.de>
next in thread | previous in thread | raw e-mail | index | archive | help
You should be able to accomplish the same -- although in a more convoluted way -- with ipf[w]. You might want to use a higher-level tool though instead of writing all the rules by hand. Try using fwbuilder or code your own ab- straction which translates to ipfw rules. ipfw for example doesn't have call action. It only has skipto action and the information where the skipto came, is not available anymore. I am trying to find out if implementing the call action was sufficient or would it be useful to have also several named search lists like iptables has. Implementing just the call action and adding the return stack in ipfw processing should be quite simple. Fwbuilder of course helps in visualizing filter but it doesn't help if one already has the application which creates filters and wants to optimize filter list search.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031130105912.45288.qmail>