On Mon, 26 Jun 2000, Smelly Pooh wrote:
> To get a rise out of you paul
:)
fyi i'm still sitting.
[snip discussion of static vs statefull firewalling]
> The 2 free firewall packages I know of that keep state are ipfw (for
> FreeBSD) and ipfilter (which is surprisingly portable for a packet
> filter, runs on *BSD, solaris, irix, hpux and even Linux, although
> from what I hear the Linux version only works with older kernels).
> Commercial packages like Firewall-1 also keep state.
the one thing you left out:
stateful firewalling by it's very nature needs a lot more resources
compared to static rule fw, esp wrt to memory. so the linux view is
probably: 'doesn't belong in kernel -> belongs in user space' ie a
firewalling application.
alternatively: run a linux firewall with ipchains + application proxies
such as squid, caching nameserver, etc.. with the applications configured
with proper ACL's. (yes they'll still show up in SYN/FIN scans, but so
what?)
--paulj
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
