On Fri, 14 Nov 2008, Julian Elischer wrote:
Ian Smith wrote:
On Thu, 13 Nov 2008, Julian Elischer wrote:
> At home I use the following change.
> > > basically, instead of doing 8 rules before and after the nat,
> use a table and to 1 rule on each side.
> > > any objections?
Only that if people are already using tables for anything, chances are
they've already used table 1 (well, it's the first one I used :) How about
using table 127 for this as a rather less likely prior choice?
yes I thought of that..
Separate rules provide more statistics.
in fact it should be ${BLOCKTABLE} and let the user define what he wants.
(defaulting to 99 or something).
I use shell variables giving lists of interfaces to be blocked so that
there aren't very many rules:
%%%
rfc1918n=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
dmanningn=0.0.0.0/8,169.254.0.0/16,192.0.2.0/24,224.0.0.0/4,240.0.0.0/4
${fwcmd} add deny log all from any to ${rfc1918n} via ${oif}
${fwcmd} add deny log all from any to ${dmanningn} via ${oif}
... (divert rule)
${fwcmd} add deny log all from ${rfc1918n} to any via ${oif}
${fwcmd} add deny log all from ${dmanningn} to any via ${oif}
%%%
I use separate lists mainly for documentation purposes but they also
provide separate statistics.
Remember though that a user wouldn't be using 'simple' if he's using his own
tables etc.
Separate rules are also simplest for documentation purposes.
Apart from that, this will speed up 'simple' on a path every packet takes,
which has to be a good thing.
Are tables faster than lists of addresses? I would expect lists to be
slightly more efficient.
Bruce
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
