On Tue, Jun 27, 2000 at 03:30:50PM +0100, Paul Jakma wrote:
> > It should have been clear from the context that he was referring to
> > your mythical user space stateful inspection firewall, not user space
> > application proxies.
>> so? draw the parallel fer chrisake..
>> squid goes down -> no www access
> userspace firewall goes down -> absolutely no access
>> (cause the application is doing the forwarding/proxying. The kernel won't
A firewall with IP forwarding switched off! No such thing, sorry! If you switch
off IP forwarding you can soley use netfilter or IP tables or the turbopacket
facilities of Linux 2.3/2.4 kernel for IDS purposes as they use hooks into the
kernel from userland to manage the state table & extract packet data, but all
the routing & forwarding and firewall rules lookups are done in kernel space.
If these were done in userland (hey yeah let's use MySql to manage the state
table *grin*) and IP forwarding is switched off then you have the tasty
situation of when your userspace firewall dies, *all* packets get forwarded to
wherever they desire. Not nice.
Dermot Hanley, Systems & Network Administrator
Irish Times New Media - http://www.ireland.com
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!