Re: Why merging recent OpenBSD PF code is not easy (was Re: FOLLOW-UP)

2014-12-08 Thread Maxim Khitrov
On Sun, Dec 7, 2014 at 9:22 PM, Jim Thompson wrote: > OpenBSD may eventually grow proper multicore support, but that is of little > concern to the FreeBSD project. It took FreeBSD years to get proper > multicore support, and I doubt > OpenBSD gets there any faster. Nor have they started. This

Re: PF bugs

2013-06-21 Thread Maxim Khitrov
On Fri, Jun 21, 2013 at 9:49 PM, Stan Gammons wrote: > I see there are several PF bugs and wondered if it's because PF isn't > maintained on FreeBSD? Perhaps that's the case given the version > differences versus PF on OpenBSD. If not, is Ipfilter the "preferred" > firewall on FreeBSD? Or is IPF

Re: Upgrading FreeBSD to use the NEW pf syntax.

2012-12-21 Thread Maxim Khitrov
On Mon, Nov 26, 2012 at 10:00 AM, Gleb Smirnoff wrote: > Paul, > > On Sat, Nov 24, 2012 at 02:11:32PM -, Paul Webster wrote: > P> I only really need one question answered in honesty; > P> > P> I personally think that by forking our own version of PF we have > P> essentially made something to

Re: Upgrading FreeBSD to use the NEW pf syntax.

2012-11-22 Thread Maxim Khitrov
On Thu, Nov 22, 2012 at 10:00 AM, Ermal Luçi wrote: > On Thu, Nov 22, 2012 at 3:13 PM, Ian FREISLICH wrote: > >> =?ISO-8859-1?Q?Ermal_Lu=E7i?= wrote: >> > On Tue, Nov 20, 2012 at 9:07 AM, Sami Halabi wrote: >> > > This was actually discussed much before, as I read it would make some >> > > issue

Re: Upgrading FreeBSD to use the NEW pf syntax.

2012-11-19 Thread Maxim Khitrov
On Mon, Nov 19, 2012 at 9:23 PM, Paul Webster wrote: > Good day all, > > I am aware this is a much discussed subject since the upgrade of PF, I > believe the final decision was that to many users are used to the old > style pf and an upgrade to the new syntax would cause to much confusion. > > The

Implications of "set require-order no"

2011-12-06 Thread Maxim Khitrov
Hello all, The "require-order" option has the following ominous warning: "There may be non-trivial and non-obvious implications to an out of order ruleset. Consider carefully before disabling the order enforcement." In OpenBSD 4.6 this directive was changed to 'no' by default, and it was taken o

Re: PF from OpenBSD 4.7

2011-02-21 Thread Maxim Khitrov
On Mon, Feb 21, 2011 at 3:17 AM, Damien Fleuriot wrote: > On 20 Feb 2011, at 23:16, Maxim Khitrov wrote: > >> On Sun, Feb 20, 2011 at 4:16 PM, jhell wrote: >>> >>> On Sun, 20 Feb 2011 13:27, eirnym@ wrote: >>>> >>>> On 20 February 2011 06:5

Re: PF from OpenBSD 4.7

2011-02-20 Thread Maxim Khitrov
On Sun, Feb 20, 2011 at 4:16 PM, jhell wrote: > > On Sun, 20 Feb 2011 13:27, eirnym@ wrote: >> >> On 20 February 2011 06:50, jhell wrote: >>> >>> On Fri, 18 Feb 2011 03:26, eirnym@ wrote: I heard while ago about packet filter update coming, but there're no news about. Which status

Same priority pf/altq queues not supported?

2010-07-04 Thread Maxim Khitrov
Hello all, I'm configuring pf on FreeBSD 7.3 and would like to use the following altq settings: altq on $ext priq bandwidth 9240Kb queue {low, red, med, top} altq on {$int1, $int2, $srv} priq bandwidth 100Mb queue {low, red, med, top} queue low priority 1 priq(default) # Default priority queue

Re: pf starts too early

2009-10-15 Thread Maxim Khitrov
On Thu, Oct 15, 2009 at 5:17 PM, Michal wrote: > Hello, > > I'm using pf on FreeBSD 8.0-RC1. My wlan0-ath0 card is set up via > wpa_supplicant.conf and rc.conf (ifconfig_wlan0="WPA DHCP"). pf also starts > via rc.conf > > Problem is that pf cannot start during the system boot because it tries to >

Re: Moving the pf rc.d scripts to run before netif

2009-09-15 Thread Maxim Khitrov
On Mon, Jun 15, 2009 at 3:26 PM, Doug Barton wrote: > Gert Doering wrote: >> Hi Doug, >> >> thanks for taking this up - and sorry for not responding more timely. >> >> I can't answer all the questions but might have a yet-unmentioned idea >> that could solve all this in one go :-) >> >> On Mon, Ju

Rule equivalence of uRPF check

2009-09-10 Thread Maxim Khitrov
Hello all, I would like to verify my assumptions regarding the way uRPF check works. I'm using a Soekris net5501 board as a firewall; port 0 ($ext_if) is internet uplink, ports 1-3 ($int_if, $mil_if, $vpn_if) are separate lan segments that should not be communicating with one another. Here is the

Filtering on multi-interface firewall

2009-08-25 Thread Maxim Khitrov
Hello all, A quick question regarding the behavior of FreeBSD and pf when you have multiple local interfaces. In my case, I have a Soekris net5501 board with one interface being the uplink to ISP and the other three dedicated to separate networks. There should be no traffic passing from one networ