rc.firewall quick change

Julian Elischer julian at elischer.org
Fri Nov 14 10:16:28 PST 2008

Bruce Evans wrote:
> On Fri, 14 Nov 2008, Julian Elischer wrote:
>> Ian Smith wrote:
>>> On Thu, 13 Nov 2008, Julian Elischer wrote:
>>>  > At home I use the following change.
>>>  >  >  > basically, instead of doing 8 rules before and after the nat,
>>>  > use a table and to 1 rule on each side.
>>>  >  >  > any objections?
>>> Only that if people are already using tables for anything, chances 
>>> are they've already used table 1 (well, it's the first one I used :)  
>>> How about using table 127 for this as a rather less likely prior choice?
>> yes I thought of that..
> Separate rules provide more statistics.

true but generally people don't need to distinguish between those,
and if you do then you probably want to log them.

>> in fact it should be ${BLOCKTABLE} and let the user define what he 
>> wants. (defaulting to 99 or something).
> I use shell variables giving lists of interfaces to be blocked so that
> there aren't very many rules:
> %%%
> rfc1918n=,,
> dmanningn=,,,,
> ${fwcmd} add deny log all from any to ${rfc1918n} via ${oif}
> ${fwcmd} add deny log all from any to ${dmanningn} via ${oif}
> ... (divert rule)
> ${fwcmd} add deny log all from ${rfc1918n} to any via ${oif}
> ${fwcmd} add deny log all from ${dmanningn} to any via ${oif}
> %%%
> I use separate lists mainly for documentation purposes but they also
> provide separate statistics.
>> Remember though that a user wouldn't be using 'simple' if he's using 
>> his own tables etc.
> Separate rules are also simplest for documentation purposes.
>>> Apart from that, this will speed up 'simple' on a path every packet 
>>> takes, which has to be a good thing.
> Are tables faster than lists of addresses?  I would expect lists to be
> slightly more efficient.

I think the table is faster for mor ethan about 8 addresses (so we
are borderline) but it's be hard to test..  You however use two rules
so that would be slower.

In my sites I tend to have other stuff put in those tables too

> Bruce

More information about the freebsd-net mailing list