From owner-freebsd-security Thu Feb 17 5:28:21 2000 Delivered-To: freebsd-security@freebsd.org Received: from mail.euroweb.hu (mail.euroweb.hu [193.226.220.4]) by hub.freebsd.org (Postfix) with ESMTP id 51C9937B723 for ; Thu, 17 Feb 2000 05:28:16 -0800 (PST) (envelope-from hu006co@mail.euroweb.hu) Received: (from hu006co@localhost) by mail.euroweb.hu (8.8.5/8.8.5) id OAA27547 for freebsd-security@freebsd.org; Thu, 17 Feb 2000 14:28:04 +0100 (MET) Received: (from zgabor@localhost) by CoDe.hu (8.9.3/8.8.8) id LAA00428 for freebsd-security@freebsd.org; Thu, 17 Feb 2000 11:45:28 +0100 (CET) (envelope-from zgabor) From: Zahemszky Gabor Message-Id: <200002171045.LAA00428@CoDe.hu> Subject: Re: ipfw - ipf In-Reply-To: from Andrew Kopeyko at "Feb 15, 0 09:44:29 am" To: freebsd-security@freebsd.org Date: Thu, 17 Feb 2000 11:44:13 +0100 (CET) X-Mailer: ELM [version 2.4ME+ PL38 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hi! > > a) if I have both ipf and ipfw in my kernel, which is the flow of a packet? > > in -> ipf -> ipfw -> kernel | kernel -> ipfw -> ipf -> out > > or the other? (I used to use ipfw, and I'd like to switch - or learn - ipf.) > > It depends on the order you modload their lkm's - earlier loaded will be "closer" to kernel. Hm. Can I load ipf dinamically? Btw on 3.x, lkms are switched to klds, and I didn't find a way to generate kld from ipf. Every time, I compiled them into the kernel. > But why do you use such strange thing? I had to used this for a week when i was switching from ipfw to ipf without interrupting clients services For example, I like DUMMYNET and the bandwidth limiting with it. But if I know well, it's only available from ipfw's pipe commands. Or is it possible from ipf, or are there any other mechanism like dummynet? > > b) Are there any ipfw to ipf converter? I'd like to use (or write) it. > > There is an addition to ipf - 'flc', 'filter language compiler'. It can compile some ruleset written in his own simple language to various firewalls rulesets: ipf, ipfw, CISCO, fwadmin, etc. See http://coombs.anu.edu.au/ipfilter/ for details. Yes, I know it. But I'd like to _convert_ my actual rules, and not to rewrite them in another language. (Of course, I can rewrite them in ipf's own language :-) By, ZGabor at CoDe dot HU -- #!/bin/ksh Z='21N16I25C25E30, 40M30E33E25T15U!' ;IFS=' ABCDEFGHIJKLMNOPQRSTUVWXYZ ';set $Z ;for i { [[ $i = ? ]]&&print $i&&break;[[ $i = ??? ]]&&j=$i&&i=${i%?};typeset -i40 i=8#$i;print -n ${i#???};[[ "$j" = ??? ]]&&print -n "${j#??} "&&j=;typeset +i i;};IFS=' 0123456789 ';set $Z;X=;for i { [[ $i = , ]]&&i=2;[[ $i = ?? ]]||typeset -l i;X="$X $i";typeset +l i;};print "$X" To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message