TRansparent firewalll (pf vs ipfw)

[unixtools at hotmail.com]

Hi,

 Ipfw Bridging works well for our large network. You need a good network
interface though.If you are trying load balancing pf is the best bet. For
bridging, I suppose ipfw is better.

-Sunil Sunder Raj

----- Original Message ----- 
From: "Mircea Popescu" <popescu.mircea at gmail.com>
To: <freebsd-pf at freebsd.org>
Sent: Friday, September 08, 2006 8:26 PM
Subject: TRansparent firewalll (pf vs ipfw)


> Hi!
>
> I have an Freebsd 6.0 box with a functioning bridge (bridge0 = fxp0 + rl0)
>
> My problem is that if I try to cut access to any port on bridge0
> interface using PF, nothing happens.
>
> For example I've tried to cut access to ssh service from a certain ip
> ... putty still managed to get through.
>
> The rule was:
> block on bridge0 proto { tcp udp } from yy.yy.yy.yy to xx.xx.xx.xx port
pppppp
>
> BUT, with the following rule:
> block on rl0 proto { tcp udp } from yy.yy.yy.yy to xx.xx.xx.xx. port
pppppp
>
> Putty couldn't obtain a connection.
>
> Considering the fact that in linux, which I gave up using, making a
> bridge would disable the interfaces within, I WOULD LIKE TO HAVE SOME
> QUESTIONS ANSWERED:
>
> 1. Once the bridge0 interface is created, the fxp0 and rl0 interfaces
> could still get their own ip addresses? (in linux this would be
> imposible)
>
> 2. Which firewall it is more desirable to use with a bridge? PF or IPFW)
>
>
> Thx a lot
> _______________________________________________
> freebsd-pf at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-pf
> To unsubscribe, send any mail to "freebsd-pf-unsubscribe at freebsd.org"
>