Date: Fri, 12 Oct 2001 12:30:09 -0600 (MDT) From: FreeBSD <freebsd@XtremeDev.com> To: "Maine LOA List Admin (Brent Bailey)" <brentb@loa.com> Cc: "Hartmann, O." <ohartman@klima.physik.uni-mainz.de>, <freebsd-stable@freebsd.org>, <freebsd-questions@freebsd.org> Subject: Re: IPFW or IPFILTER? Message-ID: <20011012121617.J96182-100000@Amber.XtremeDev.com> In-Reply-To: <004901c15338$ed9c4500$24b4a8c0@pretorian>
next in thread | previous in thread | raw e-mail | index | archive | help
IPFW has dummynet. ipf author suggests using AltQ. ipf also supports round-robin port forwarding to multiple servers (and a little app to check for downed servers etc) in ipnat if you run a cluster, and can port forward a range of ports without separate rules each (iirc). ipf has also been around much longer than ipfw in terms of development time, and is a more mature code (as evident by ipfw's past sec issues). I've found myself able to do quite a bit with ipf/ipnat, bimap/map helps a great deal. ipf also has the distinction of being on all the BSD's (used to be used exclusevely by OpenBSD as it's only firewall) and even on early 2.0.x Linux kernels, as well as on Solaris. So if you know ipf rule syntax, you are quaranteed to be useful on a good many UNIX systems. ipfw currently has bridging support in FreeBSD while ipf does not. This is being worked on and should change fairly soon. ipfw has a tighter integration with FreeBSD than ipf, which means also that it gets updated more often, and less changes in FreeBSD break things with the firewall. If you require ipfw/dummynet features but prefer or require ipf/ipnat only features, you can always combine them. I currently use ipfw/dummynet for bandwidth shaping and ipf as my primary filter processing. Just remember that ipfw gets processed first on incoming packets, then ipf. Performance is negligible unless you have hundreds or even tousands of rules (which some do). Then the tree capabilities of ipf really shines, not because it does the job it does, but because it makes really readable rules. When I tried with ipfw's skipto, I was suddently reminded of the goto statements in basic a long long time ago, and I had to cringe. As a side note, OpenBSD is no longer including ipf in it's default installs now, but is instead using pf, a new firewall being written. But pf will use the same syntax rules as ipf, so you'd still be "guaranteed a job" if you move OS's. On Fri, 12 Oct 2001, Maine LOA List Admin (Brent Bailey) wrote: > Everything ive read on FBSD site...as well from experiance is that IPFW is > more versitile...you can do more with it > including traffic shaping .. "pipe & queue" & dummynet...as well as plain > out better firewall than IPFILTER. again this is mostly > opinion as far as speed IPFW is a hair slower than IPFILTER. ..but im sure > you wouldnt even notice the differrence.. > I run 2 FBSD gateways machines running IPFW w/ NATD ...each gateway is > supporting 100+ users and workstations > each....and never had any issues with setting up for speed or > stability...both FBSD machine have uptimes in excess of 200 days. > plus the fact theres tons of "howto's " for IPFW and NAT. > > B > ----- Original Message ----- > From: "Hartmann, O." <ohartman@klima.physik.uni-mainz.de> > To: <freebsd-stable@freebsd.org> > Cc: <freebsd-questions@freebsd.org> > Sent: Friday, October 12, 2001 9:46 AM > Subject: IPFW or IPFILTER? > > > > Hello. > > > > Please do not understand this question as a question of what I believ in, > > it is simply a question of what to use for best performance. > > > > FreeBSD uses two filtering systems, ipfw and ipfilter and each of these > > both systems has its own adavantages and disadvantages. ipfilter seems to > > be more sophisticated in how to write rules. > > At the moment, we use ipfw around here due to the easy rule syntax. But > > that is not that what should be the main argument. I want to ask for the > > performance, mean the throughput/bandwith. Does anyone know something > > about the bandwith of both filters? What are the pro and contras? > > > > Thanks, > > Oliver > > > > -- > > MfG > > O. Hartmann > > > > ohartman@klima.physik.uni-mainz.de > > ---------------------------------------------------------------- > > IT-Administration des Institutes fuer Physik der Atmosphaere (IPA) > > ---------------------------------------------------------------- > > Johannes Gutenberg Universitaet Mainz > > Becherweg 21 > > 55099 Mainz > > > > Tel: +496131/3924662 (Maschinenraum) > > Tel: +496131/3924144 > > FAX: +496131/3923532 > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > > with "unsubscribe freebsd-stable" in the body of the message > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org > with "unsubscribe freebsd-questions" in the body of the message > > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011012121617.J96182-100000>