Hi, Ipfw Bridging works well for our large network. You need a good network interface though.If you are trying load balancing pf is the best bet. For bridging, I suppose ipfw is better.
-Sunil Sunder Raj ----- Original Message ----- From: "Mircea Popescu" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Friday, September 08, 2006 8:26 PM Subject: TRansparent firewalll (pf vs ipfw) > Hi! > > I have an Freebsd 6.0 box with a functioning bridge (bridge0 = fxp0 + rl0) > > My problem is that if I try to cut access to any port on bridge0 > interface using PF, nothing happens. > > For example I've tried to cut access to ssh service from a certain ip > ... putty still managed to get through. > > The rule was: > block on bridge0 proto { tcp udp } from yy.yy.yy.yy to xx.xx.xx.xx port pppppp > > BUT, with the following rule: > block on rl0 proto { tcp udp } from yy.yy.yy.yy to xx.xx.xx.xx. port pppppp > > Putty couldn't obtain a connection. > > Considering the fact that in linux, which I gave up using, making a > bridge would disable the interfaces within, I WOULD LIKE TO HAVE SOME > QUESTIONS ANSWERED: > > 1. Once the bridge0 interface is created, the fxp0 and rl0 interfaces > could still get their own ip addresses? (in linux this would be > imposible) > > 2. Which firewall it is more desirable to use with a bridge? PF or IPFW) > > > Thx a lot > _______________________________________________ > [email protected] mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-pf > To unsubscribe, send any mail to "[EMAIL PROTECTED]" > _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-pf To unsubscribe, send any mail to "[EMAIL PROTECTED]"
