From owner-freebsd-security Wed Feb 5 23: 7:27 2003 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 461C737B401 for ; Wed, 5 Feb 2003 23:07:26 -0800 (PST) Received: from HAL9000.homeunix.com (12-233-57-224.client.attbi.com [12.233.57.224]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8DDDC43FB1 for ; Wed, 5 Feb 2003 23:07:25 -0800 (PST) (envelope-from dschultz@uclink.Berkeley.EDU) Received: from HAL9000.homeunix.com (localhost [127.0.0.1]) by HAL9000.homeunix.com (8.12.6/8.12.5) with ESMTP id h1677Oo0003900; Wed, 5 Feb 2003 23:07:24 -0800 (PST) (envelope-from dschultz@uclink.Berkeley.EDU) Received: (from das@localhost) by HAL9000.homeunix.com (8.12.6/8.12.5/Submit) id h1677Oem003899; Wed, 5 Feb 2003 23:07:24 -0800 (PST) (envelope-from dschultz@uclink.Berkeley.EDU) Date: Wed, 5 Feb 2003 23:07:24 -0800 From: David Schultz To: Nicholas Esborn Cc: Marc Spitzer , freebsd-security@FreeBSD.ORG Subject: Re: The way forward Message-ID: <20030206070724.GA3760@HAL9000.homeunix.com> Mail-Followup-To: Nicholas Esborn , Marc Spitzer , freebsd-security@FreeBSD.ORG References: <20030128085617.L167@woody.ops.uunet.co.za> <3E415602.30669.FF9FC2@localhost> <20030205182601.GA59212@carbon.berkeley.netdot.net> <20030205140532.4ff4390c.mspitze1@optonline.net> <20030205192433.GB59212@carbon.berkeley.netdot.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030205192433.GB59212@carbon.berkeley.netdot.net> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Thus spake Nicholas Esborn : > Pf seems to scale better than netfilter/iptables, ipfw, or ipf. Other > than reading through OpenBSD's pf documentation, I found a paper at: > > http://www.benzedrine.cx/pf-slides.pdf The server seems to be down right now. Do you have the title of the paper? > I also like that you can use macros in its config files The macroexpander for my firewall is already pretty good. It is called the Bourne shell. > and that it > automatically structures your ruleset for you to some extent (I think > this obsoletes head/group in ipf). What do you mean by this? It sounds interesting. Do you mean that it does some sort of static or dynamic optimization, or something else? > And it can randomize TCP ISNs for > OSes which do not. And you can use lists for ports or protocols. [...] > Sadly, most of the discussion I've seen here about pf on FreeBSD is > basically "Why would we need another packet filter?" Well, I'm sorry to disappoint you, but you haven't convinced me that I need another packet filter yet! FreeBSD randomizes ISNs, and ipfw now supports lists of ports or even IP addresses. The missing feature I personally would like to see is a flexible interface for application-level firewalling. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message