FreeBSD has Two Firewalls?

Lowell Gilbert freebsd-questions-local at
Wed Feb 11 15:10:32 PST 2004

"Loren M. Lang" <lorenl at> writes:

> It looks like ipfilter is a newer and more improved over ipfw

They're independent implementations.

> It looks like ipfilter is a newer and more improved over ipfw, but I'm
> not sure.  I'm looking for a good firewall with similar functionality to
> linux's netfilter.

Which, as I understand it, is a descendent of ipchains.  ipchains is a
descendent of an older version of ipfw.

> linux's netfilter.  Previously I was doing some somewhat sophisticated
> things like disabling or limiting internet access for certain indivuals
> depending on the time of day, as well as using connection helpers for
> ftp, irc, etc.  What's the best firewall to use for this?

There's a lot of Linux-specific terminology in there, so I can't
really unwind it very well.  I don't know of any support for
time-of-day modifications, but I'd expect that somebody out there has
written it.  Depending on the exact requirements, it may even be
trivial.  "Connection helpers" sounds like automatic proxy support,
which I'm not crazy about but which I know ipfilter does somewhat more
extensively than ipfw.

The big advantage of ipfw is that dummynet(4) hooks in through it.
Dummynet is a traffic shaper, as well as a framework that sort of
resembles (as far as I understand) netfilter.

Also note that it's perfectly possible and often quite convenient to
use more than one firewall program...

More information about the freebsd-questions mailing list