per-interface packet filters, design approach

[Luigi Rizzo]

On Tue, Dec 14, 2004 at 06:13:07AM -0800, Bruce M Simpson wrote:
...
> What I'm really missing in IPFW is the ability to maintain one or more
> 'shadow rulesets'. These rulesets may not be the active rulesets, but
> I can manipulate them as tables, independently of the active ruleset(s),

??? What what ???
They do exist, they are called 'set' and you can associate
rules to a specific set, atomically enable/disable/swap/rename
sets, etc. This was designed exactly for this purpose (atomic
updates of firewall configuration with a single syscall).

have a look at the ipfw manpage and then see if it answer your needs.

	cheers
	luigi

> IPF and PF have such functionality, IPFW does not. The lack of a documented
> ABI/API for access to IPFW by applications other than ipfw(8) is something
> which I'm leaving out of the picture for the moment.


> I don't really consider using 'skipto' and separate sections of rule
> index number space a valid answer here, because we should have the ability
> to independently flush each ruleset.
> 
> When extended to stateful rules (I am talking here purely about the simple
> stateless packet filter case), this comes in even more useful.
> 
> Regards,
> BMS