[Bug 238694] Configuring & using a customized IPFW rule set now causes additional rles to be (involuntarily) added

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=238694

--- Comment #4 from rkoberman at gmail.com ---
Bottom line default requirements:

1. System firewall must start with a deny-by-default rule in place when network
starts

2. Both IPv4 and IPv6 must start

3. Mandatory packets must be allowed from network starts This includes loopback
for both IPv4 and IPv6 as well as support for several ICMPv6 and group
addresses that are mandatory for default IPv6 function.

When I suggested starting the firewall after the network had started, I was
immediately (and correctly) shut down because of the security vulnerability
this presents. That is why it needs proper documentation so you can insert
rules between those that are mandatory. With spacing of every 100, there is a
lot of room.

I have no answer for the issue of efficiency via the ordering of rules. While
the time required to process these rules is very small, it is not zero. (Darn
close for the trivial, stateless rules, though.)

Since I agree the way it is done now is totally non-transparent, the only
solution I can see is proper documentation.

-- 
You are receiving this mail because:
You are the assignee for the bug.