TRansparent firewalll (pf vs ipfw)

[Max Laier]

On Friday 08 September 2006 16:56, Mircea Popescu wrote:
> I have an Freebsd 6.0 box with a functioning bridge (bridge0 = fxp0 +
> rl0)
>
> My problem is that if I try to cut access to any port on bridge0
> interface using PF, nothing happens.
>
> For example I've tried to cut access to ssh service from a certain ip
> ... putty still managed to get through.
>
> The rule was:
> block on bridge0 proto { tcp udp } from yy.yy.yy.yy to xx.xx.xx.xx port
> pppppp
>
> BUT, with the following rule:
> block on rl0 proto { tcp udp } from yy.yy.yy.yy to xx.xx.xx.xx. port
> pppppp
>
> Putty couldn't obtain a connection.

I suggest that you read the if_bridge(4) manual page, which talks 
extensively about packet filtering options.

> Considering the fact that in linux, which I gave up using, making a
> bridge would disable the interfaces within, I WOULD LIKE TO HAVE SOME
> QUESTIONS ANSWERED:
>
> 1. Once the bridge0 interface is created, the fxp0 and rl0 interfaces
> could still get their own ip addresses? (in linux this would be
> imposible)

You can either assign an IP to the interface or to the bridge itself, 
iirc.

> 2. Which firewall it is more desirable to use with a bridge? PF or
> IPFW)

The one you understand best and like the most.

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20060908/5fd96f11/attachment.pgp