From owner-freebsd-pf@FreeBSD.ORG Wed Aug 31 12:07:54 2005 Return-Path: X-Original-To: freebsd-pf@freebsd.org Delivered-To: freebsd-pf@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id DE00516A420 for ; Wed, 31 Aug 2005 12:07:54 +0000 (GMT) (envelope-from eculp@bafirst.com) Received: from bafirst.com (72-12-2-214.wan.networktel.net [72.12.2.214]) by mx1.FreeBSD.org (Postfix) with ESMTP id 93FBA43D78 for ; Wed, 31 Aug 2005 12:07:50 +0000 (GMT) (envelope-from eculp@bafirst.com) Received: from localhost (localhost [127.0.0.1]) (uid 80) by bafirst.com with local; Wed, 31 Aug 2005 07:07:49 -0500 id 0009580A.43159D95.000176A0 Received: from dsl-201-144-82-159.prod-infinitum.com.mx (dsl-201-144-82-159.prod-infinitum.com.mx [201.144.82.159]) by mail.bafirst.com (Horde MIME library) with HTTP; Wed, 31 Aug 2005 07:07:49 -0500 Message-ID: <20050831070749.b200501hq80w0csg@mail.bafirst.com> Date: Wed, 31 Aug 2005 07:07:49 -0500 From: eculp@bafirst.com To: freebsd-pf@freebsd.org References: <20050831001634.63B2C4E704@pipa.profix.cz> In-Reply-To: <20050831001634.63B2C4E704@pipa.profix.cz> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format="flowed" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable User-Agent: Internet Messaging Program (IMP) 4.1-cvs Subject: Re: FW: Application layer firewall on FreeBSD, is it possible ? X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 31 Aug 2005 12:07:55 -0000 Quoting Daniel Dvo=C5=99=C3=A1k : > ... but you know, proxy is not what I am asking, proxy is not firewall. > > We do not need to restrict everything and all members. > > We like full routeable network with full access to IPv6 / IPv4 internet > without any necessary action like configure proxy clients at all pc=C2=B4= s our > members. > > We only want to deny only p2p applications by default for all pc=C2=B4s > regardless of used protocol/ports and to allow grantting access to p2p > networks each members in individual way, because we have to prevent anoth= er > letter from our ISP which was contacted by BSA that from our public IP ( > from one member in private ip space ) ... traffic ... share ... violate .= .. > authorial law. > > So of course it must be combination of IP and application osi model > firewall. > > Gateway server should check all packets and their contents to decide if > allowed or denied in fast way like l7-filter on Linux OS. > > So is it possible on FreeBSD OS ? Dan, Thanks for bringing this up. I have been looking for a way to control p2p for a while also. It is a problem that I can see only getting worse. I was unaware of l7-filter on Linux and want to see how it works because for us the word "FAST" is key. If you find a solution, I would appreciate your posting it to the list, which I'm sure you will do anyway. Have a great day, ed