rc.firewall quick change

Bruce Evans brde at optusnet.com.au
Fri Nov 14 02:38:30 PST 2008

On Fri, 14 Nov 2008, Julian Elischer wrote:

> Ian Smith wrote:
>> On Thu, 13 Nov 2008, Julian Elischer wrote:
>>  > At home I use the following change.
>>  >  >  > basically, instead of doing 8 rules before and after the nat,
>>  > use a table and to 1 rule on each side.
>>  >  >  > any objections?
>> Only that if people are already using tables for anything, chances are 
>> they've already used table 1 (well, it's the first one I used :)  How about 
>> using table 127 for this as a rather less likely prior choice?
> yes I thought of that..

Separate rules provide more statistics.

> in fact it should be ${BLOCKTABLE} and let the user define what he wants. 
> (defaulting to 99 or something).

I use shell variables giving lists of interfaces to be blocked so that
there aren't very many rules:


${fwcmd} add deny log all from any to ${rfc1918n} via ${oif}
${fwcmd} add deny log all from any to ${dmanningn} via ${oif}

... (divert rule)

${fwcmd} add deny log all from ${rfc1918n} to any via ${oif}
${fwcmd} add deny log all from ${dmanningn} to any via ${oif}

I use separate lists mainly for documentation purposes but they also
provide separate statistics.

> Remember though that a user wouldn't be using 'simple' if he's using his own 
> tables etc.

Separate rules are also simplest for documentation purposes.

>> Apart from that, this will speed up 'simple' on a path every packet takes, 
>> which has to be a good thing.

Are tables faster than lists of addresses?  I would expect lists to be
slightly more efficient.


More information about the freebsd-net mailing list