-----BEGIN PGP SIGNED MESSAGE-----
Since a couple of months now, I use IPFW on several projects. I use IPFW again
long term hiatus since ~ 2003. Before I used pf. The reasons are mannyfold and
is very dogmatic - it is the FreeBSD's native firewall and several performance
shown in the net tells me a significant performance benefit in case being setup
over pf. pf in FreeBSD lacks behind the OpenBSD's development.
Since last year I try to setup IPFW only on all of our systems. So I do also at
and at some places, where we have to use NAT via PPPoE/modem. And here the
begins. While most setups of a firewall on a router/gateway with several NICs
attached to the internet with on interface, the outbound interface, the same
be a horrible story when it comes to NAT.
The handbook offers some simple examples, but in most cases, I see the supposed
outdated external natd daemon still in favour over in-kernel NAT! This is also
case with the manpage for ipfw(8). I miss a more recent example of setting up
in-kernel NAT and the caveats of one-pass and none-one-pass and some hints how
packet's header gets rewritten when being translated by NAT and reinjected into
pipeline. For me, as a non-source-code-expert-and-simple-system's
administrator, it is
sometimes hard to understand how IPFW works. And the problems reported do tell
I'm not alone.
The handbook has some examples. One of them contains a traversal of 37/TCP,
It is a long time since I saw this kind of setup, most time synchronisation
NTP and 123/UDP. The example also seems a bit outdated.
Manpage firewall(7) lacks also of an modern in-kernel NAT example - it still
the natd. Also, there is a kind of anti-spoof rule shown that leaves the
this page is quite antique. Doesn't IPFW has a antispoof rule, or even
the manpage ipfw(8) states?
Somehow I miss some more detailed explanations what happens with check-state,
causes much trouble, even in combination with NAT.
Well, as said, I'm no expert, maybe I'm simply too blunt to understand, but
seems I'm not alone. People switched to pf and even Apple moved from ipfw to
leaves the question here: what is the status of the development of IPFW in
FreeBSD? is it
maintained-only or is there development going on? Are there plans for
up to time man pages and examples?
Thanks in advance and for your patience reading my bad English.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
-----END PGP SIGNATURE-----
firstname.lastname@example.org mailing list
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"