Firewalls - Ease of Use and Maintenance?
Nick Hilliard
nick at foobar.org
Wed Nov 9 13:24:20 UTC 2011
On 09/11/2011 12:22, Richard Kulawiec wrote:
> You will find it very difficult to beat pf on OpenBSD for efficiency,
> features, flexibility, robustness, and security. Maintenance is very
> easy: edit a configuration file, reload, done.
There are several areas where pf falls down. One is auto-synchronisation
from primary to backup firewall (not really a pf problem, but it's
important for production firewall systems). Another is ipv6 fragments,
although this was mostly fixed in a commit on 20110329 (released in 5.0),
which unfortunately has not yet made its way to freebsd yet. A third is
openbsd's poor ethernet hardware interrupt handling. Again, this has
improved recently, but it's still lags seriously behind linux / freebsd.
Having said that, it's still my least disfavoured stateful packet filtering
system.
Nick
More information about the NANOG
mailing list