High performance IDS/Firewall
on at cs.ait.ac.th
Wed May 28 16:41:07 PDT 2003
> I'm considering setting up a FreeBSD firewall/IDS system to handle
> 60-80Mbit/sec of traffic. The box would have three adapters, two of them
> bridging and one for access. I will place the IDS on the outside bridge
> interface and apply IPFW rules on the system as needed. My concern is
> what the failure order is if the system is under heavy load.
I am working on the same sort of problem. I had that box, with 3
ethernet adapters that I used as a router for ages. Now that I have a
real router, I thought I could use it as a firewall.
I am not at the snort stage yet.
Bridging works fine, but it seems that statefull rules needs a high
end machine, even with a low traffic (I beleive I don't go beyond
A couple of tricks when configuring your firewall:
- incoming filter rules must be attached to the outside interface,
while outgoing rules are attached to the inside interface (despite
they are bridged, rules on the outside inteface would not catch
outgoing packets, or rather, rules on the inside interface would
catch them first, so if the inside interface has a deny all...)
- while bridge(4) says that non IP packets are transmitted without
filtering, it seems that ARP packets are passed through the
I have no answer about the default fail safe, but I will certainly
install a cron script that will reset the machine whenever it find it
cannot communicate anymore.
More information about the freebsd-performance