https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=238694
--- Comment #4 from [email protected] --- Bottom line default requirements: 1. System firewall must start with a deny-by-default rule in place when network starts 2. Both IPv4 and IPv6 must start 3. Mandatory packets must be allowed from network starts This includes loopback for both IPv4 and IPv6 as well as support for several ICMPv6 and group addresses that are mandatory for default IPv6 function. When I suggested starting the firewall after the network had started, I was immediately (and correctly) shut down because of the security vulnerability this presents. That is why it needs proper documentation so you can insert rules between those that are mandatory. With spacing of every 100, there is a lot of room. I have no answer for the issue of efficiency via the ordering of rules. While the time required to process these rules is very small, it is not zero. (Darn close for the trivial, stateless rules, though.) Since I agree the way it is done now is totally non-transparent, the only solution I can see is proper documentation. -- You are receiving this mail because: You are the assignee for the bug. _______________________________________________ [email protected] mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-ipfw To unsubscribe, send any mail to "[email protected]"
