On Mon, 29 Jul 2002, Philip Reynolds wrote:> Well, that doesn't help you reading your listing.i can read it fine. :)if you want readability - a good script is worth just as much.> > isnt the ipfw code in BSD brand-new aswell? (the old code was
> > rewritten for OpenBSD recently due to licensing concerns).
> 
> I think you're talking about IPFilter, and OpenBSD's new PF code.
> Now who's talking FUD :)ah doh! yes.i thought the firewalling code on all the BSDs was fairly related -
sorry. So FreeBSD's ipfw is not encumbered in the same way the old
OBSD firewalling was?> Perhaps, although I think when seriously considering something like
> a firewall, tried and trusted means a hell of a lot. IPFilter would
> probably win that race.to an extent, i guess so, yes. but i've a few boxes with reasonable 
uptimes that run netfilter/iptables. (i've one that has crashed twice 
now after 60+ day uptimes. but that doesnt seem to be netfilter).course, there's a lot more that can go wrong with a firewall than the
firewall code. in that case get 2 boxes and heartbeat them.> I was talking in terms of the actual firewall. If the company in
> question knows plenty about Linux and nothing about FreeBSD, I'd go
> with a Linux box, merely because when something goes wrong (that
> isn't got to do with ipfw/ipchains/ipfilter), then someone knows
> how to fix it.indeed. couldnt agree more.(that's the nice thing about *nix - fact we /can/ have nit-picking 
arguments about which *nix and firewall code is better).> As I said before, I have little to no in-depth experience with
> netfilter, I'm aware of it's basic capabilities and had a quick
> look at it's features in early 2.4 editions but that's it.i've no experience of ipfw. (closest i've come is looking at IPFilter 
for IRIX - but it had a problem in that it wasnt maintained 
anymore. however, while the englishy syntax is nice, i dont think 
iptables command  syntax is a big obstacle).anyway.. there's choice. and as i understand it, with the advent of 
netfilter/iptables there's now almost nothing between them from a 
technical POV. (apart from ipfw being in use a lot longer).regards,
-- 
Paul Jakma	paul@clubi.ie	paul@jakma.org	Key ID: 64A2FF6A
Fortune:
What a strange game.  The only winning move is not to play.
		-- WOP, "War Games"
-- 
Irish Linux Users' Group: ilug@linux.ie
http://www.linux.ie/mailman/listinfo/ilug for (un)subscription information.
List maintainer: listmaster@linux.ie
