Gleb Smirnoff wrote:
>
> Dear networkers,
>
> I finally managed to pronounce my idea, although I'm afraid
> of a bikeshed it is going to be burried under.
>
> When managing a complex router with many interfaces the output
> of `ipfw show` (or ipf/pf analog) is getting long and difficult to
> understand. It is also important that many packets are checked
> against the rules that can never be applied to them, wasting CPU
> cycles.
>
> A simple example can be local network router with many inner interfaces
> and with one interface to internet. Actually filtering is desired
> only in external interface, and there is no need for local traffic
> to enter packet fitlering routines, e.g. ipfw_chk().
Then you argument about long ipfw show doesn't hold... ;)
> I'd like to implement per-interface pfil hooks, like in Cisco
> world. Each interface may have 'in' list of rules, 'out' list
> of rules. Current global ip_{input,output}, filters may coexist
> with per-interface ones, but can be turned off.
Different worlds. I wonder why everything has to "like Cisco". It's
not always the most clever way they solve a given problem.
> Our PFIL interface is quite ready for this, and this is very nice.
I don't see any changes to pfil for this. Pfil already passes the
interface in the argument call. This is something for the packet
filters (ipfw/pf/ipf) than the pfil API?
> I'll start with creating/editing alternative chains in ipfw. Then
> we will need to add possibility to register per-interface hooks
> in pfil, and add possibility to pass one more optional argument
> from pfil to the filter itself.
Can you provide example how you think the syntax should be?
> I'm glad to see any constructive comments on plan.
You have to be careful not to collide with the "in|out|via" inside
the rules.
--
Andre
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
