Date: Wed, 17 Jan 2001 09:28:46 -0700 From: Mike Porter <mupi@mknet.org> To: Kwangyul Seo <skyul@plus.or.kr>, freebsd-questions <freebsd-questions@freebsd.org> Subject: Re: ipf/ipnatd vs ipfw/natd ? Message-ID: <01011709284603.57385@mukappa.home.com> In-Reply-To: <20010117122933.A11424@plus.or.kr> References: <20010117122933.A11424@plus.or.kr>
next in thread | previous in thread | raw e-mail | index | archive | help
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Tuesday 16 January 2001 20:29, Kwangyul Seo wrote: > > Hello, > > What's the main difference between ipfw/natd and ipf/ipnatd? > And where can I get detailed documents related to ipf/ipnatd? I'm sure there are other people more qualified to answer this, and if you need more technical details, or info on the implications of the various things I am saying, you may want to wait and read there messages. All I can tell you is what my experience with them has been. First, IN GENERAL, it is easier to set up and use ipfw and natd on freeBSD. Given that FreeBSD has as a stated mission "ease of use" (and does better than the other BSD's at it IMHO), this is consistent. For example, the rc.firewall script, run when you set firewall_enable="YES" in /etc/rc.conf, uses ipfw, and comes preset with a bunch of rules. All you have to do is add your own IP address, and you are pretty much taken care of. natd is likewise easy to use, it's even included in rc.firewall so you can enable it from rc.conf (natd_enable="YES", natd_interface="<interface_name>") and you're done. Any packet coming into you system with a different IP than the one assigned to <interface> will be "translated" to match. OF course, there are a lot of additional options that you CAN use, but the basic use is pretty simple. IPF, on the other hand, sacrifices some of that ease of use, and exchanges it for a bit more power (though from a practical standpoint, how much more power you need is debateable). ipf compared to ipfw the biggest difference is that ipf uses kernel space, and ipfw performs its magic outside of that. I have found that even though ipf is a little more complex to use, once you get the hang of it, it is easier than ipfw to get the same level of functionality. Among other things, you can flush and reload the entire ruleset with one comand, rather than having to run ipfw xxx <rule> a bunch of times. granted that could be scripted, as rc.firewall (in fact, you can simply run rc.firewall again if you wish). For my money, though, the biggest difference lies in the difference between natd and ipnat. natd is very easy to use, but ipnat offers the ability to monitor your nat'd connections without haveing to re-start the nat process using the -v option (which also kills any running nat sessions in the process). ipnat also makes it easier to specify a range of addresses (useful, for example, when your ISP gives you 16 IP's instead of just one, but you have 32 computers and don't want to buy additional IPs..ratehr than translating all of your connections to a single IP (and essentially wasting the other 15) you can specify the whole range. It also APPEARS to work better with IPSec becuase it 1) has better ability to detect when a connection is over 2) tries to not reasssign the port if it can help it and 3) frees the port/ip address pair much sooner than natd so it can be reused (IPsec tunnels from a host on the private network are a major PITA, but ipnat works better than natd. Supposedly some work was being done on libalias which would "fix" that in natd, but as yet I haven't seen it happen). There was a thread discussing some of the differences from a more technical standpoint a while back on the -stable list; I would recommend that you search the archives there if you need more info. mike -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.3 (FreeBSD) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjplyD4ACgkQZ7GovTQbIm6UfwCeL5vf0n3E870MNyTxZSfTmmYY WYoAn0Ei/axoJXvQO0Yc/rYzxZrxGWVw =WLW5 -----END PGP SIGNATURE----- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?01011709284603.57385>