Date: 30 Nov 2003 06:53:10 -0000 From: alo@iki.fi.invalid (Antti Louko) To: freebsd-hackers@freebsd.org Subject: ipfw/ipf IP filtering thoughts Message-ID: <20031130065310.29349.qmail@alo.louko.com>
next in thread | raw e-mail | index | archive | help
Generally, I like the (Free)BSD way of doing things. But the IP filtering modules available for FreeBSD lack one feature when compared to Linux way (ipchains and iptables). In ipchains and iptables you have a sequential list of rules, very much like in ipfw and ipf, but you can have several different lists which have symbolic names and you can make calls from lists to other lists based on normal packet criteria. If the list is exchausted, the scan returns to the previous list. This makes it possible to make filtering decisions much more efficient in complex situation. You can for example scan a certain list only for eg. packets going to for example port 25 and so on. In FreeBSD, you don't have this "subroutine call" feature at all and you are limited to only one sequential list with a "goto". Any ideas how to proceed. I think this would be really needed and widely used if available.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20031130065310.29349.qmail>