Re: controlling ext. inbound traffic on int. interface - few doubts/thoughts

2006-07-18 Thread Travis H.
On 7/17/06, Michal Soltys [EMAIL PROTECTED] wrote: Back to my point: with limited inbound traffic (by isp) to 1mbit, the incoming traffic is just some traffic. If whatever comes in, assigned to ext_bulk1 saturates a bit ext_bulk2 - total traffic will be still 1mbit, and there won't be any hmmm,

Re: pf default deny compile-time option?

2006-07-18 Thread Can Erkin Acar
On Sun, Jul 16, 2006 at 07:02:00PM -0500, Travis H. wrote: On 7/15/06, Ryan McBride [EMAIL PROTECTED] wrote: Root can do stupid things which compromise security. Obfuscation or needles complexity in an attempt to protect yourself from the root account will only make your system less secure.

Re: pf default deny compile-time option?

2006-07-18 Thread Travis H.
On 7/18/06, Can Erkin Acar [EMAIL PROTECTED] wrote: No, needless complexity is a compile time option that makes it impossible to know whether a given installation needs the block rule or not. Good point. packets are sent using bpf(4) so ruleset does not really matter. Every day a school

Re: pf default deny compile-time option?

2006-07-18 Thread Damien Miller
On Tue, 18 Jul 2006, Can Erkin Acar wrote: On Sun, Jul 16, 2006 at 07:02:00PM -0500, Travis H. wrote: On 7/15/06, Ryan McBride [EMAIL PROTECTED] wrote: Root can do stupid things which compromise security. Obfuscation or needles complexity in an attempt to protect yourself from the root