At 2003-01-16T18:52:00Z, Josh Brooks <[EMAIL PROTECTED]> writes: > If I have a large network with high profile hosts (50+ shell servers, 50 > or more different ircds running) am I wasting my time trying to hack and > tweak a FreeBSD host-based firewall running ipfw ?
Out of curiosity, have you tried FreeBSD + ipfilter (or even OpenBSD + pf, for that matter)? I've really come to appreciate ipfilter's syntax and flexibility, and it's statefulness always seemed to work better than IPFW's for me for some odd reason. Note that I mentioned statefulness. You should really, really investigate the potential useful of a stateful firewall. The massive win there is that once a connection is accepted, it gets added to a known-good list which is searched before incoming packets get sent through the filter list, and usually much more quickly. In other words, each "accept" rule will only get processed once *per connection*, rather than once *per packet*. Finally, I'm not sure of the lastest hardware recommendations, but I'd put the absolute best NICs in that machine that I could afford. Anyone know what the current king of the FreeBSD hill is? -- Kirk Strauser In Googlis non est, ergo non est.
msg39271/pgp00000.pgp
Description: PGP signature
