Date: Tue, 14 Dec 2004 11:20:56 +0300 From: Gleb Smirnoff <glebius@freebsd.org> To: James <james@towardex.com> Cc: net@freebsd.org Subject: Re: per-interface packet filters Message-ID: <20041214082056.GA42820@cell.sick.ru> In-Reply-To: <20041214053307.GA97056@scylla.towardex.com> References: <20041213124051.GB32719@cell.sick.ru> <41BDABFB.E64C0A31@freebsd.org> <20041213184700.GA37107@cell.sick.ru> <20041214053307.GA97056@scylla.towardex.com>
next in thread | previous in thread | raw e-mail | index | archive | help
James, On Tue, Dec 14, 2004 at 12:33:07AM -0500, James wrote: J> I'm personally against modifying ipfw(4) for this purpose. It gets into the J> complexity of syntax and simply violates the initial simple model of the whole J> ipfw packet filter itself. I agree in that freebsd systems acting as routers J> need a more "efficient" or "better" engine by allowing per-interface firewall J> hooks, but we all know pfil_hooks api already provides this; and modifying J> ipfw for this is just a mess for a little gain. you will not notice anything new in your day to day ipfw usage. The change will not hurt any of current users. -- Totus tuus, Glebius. GLEBIUS-RIPN GLEB-RIPE
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20041214082056.GA42820>