Slashdot Mirror
Custom OpenBSD 3.0 with IPFilter From Darren Reed
rjk191 writes: "Darren Reed, the author of IPFilter, has created his own release of OpenBSD which puts IPFilter back in. IPFilter was removed from OpenBSD 3.0 by the OpenBSD team due to license issues. See his newsgroup posting that announces it here." Here's the whole thread for some more information.
On Saturday, May 21, 1997, I fell in love with Hemos at a LUG meeting. I was 24, Hemos was 25, and a couple of days later we moved to Virginia, where we worked as programmers for the OSDN, on a website titled Slashdot.
On Wednesday, July 7, 1997, a little while after we molested our two freinds, JonKatz and Cowboy Neal, I told Hemos to wait on inviting one of JonKatz's gimps over to play, that we needed "to have the most important conversation of our lives."
"CmdrTaco, what is it?" he asked. "What's going on?" "Hemos," I replied, "I don't know how to say this so I'll just say it simply. I need for you to know that I'm gay and I'm coming out."
How did we get from May 21, 1997 to July 7, 1997?
For one thing, it started well before 1997. Hemos and I first met each other in the fall of 1983, when we were attending Lincoln High School in Charleston, our mutual hometown. We were both advanced foreign language students (I was taking Latin, Hemos was taking French) and we shared a tawdry love affair.
Hemos was everything I ever wanted in a gay companion--pretty and smart and sweet and very attentive. We never dated in high school, of course. I was much too shy to ask him out and he was much too traditional to think about doing the asking himself.
We reconnected several years later, when we were both interning for a local gay pride website, I Like my Homosexuals Flaming.com . We corresponded from our respective schools over the fall and winter, then began dating--and making out--that summer. Three years later we married.
Aside from a couple of one time dates, I had never had a boyfriend and I certainly had never made out with anyone--and by the time we started doing so I was already 21. It wasn't like I hadn't had exposure. My best friend, JonKatz, who went to another high school, had a boyfriend, CowboyNeal, and they had sex all the time. It was also the case that Greg was gay--and when he wasn't having sex with CowboyNeal he was having sex with other guys.
JonKatz and CowboyNeal and I had a quirky little relationship. They were emotionally and physically and intellectually attracted to each other; I was emotionally and physically attracted to JonKatz, emotionally and intellectually attracted to CowboyNeal. And, at least as far the emotional/intellectual part was concerned, I think they were attracted back to me.
It didn't work out, of course. CowboyNeal went off to school, JonKatz and I stayed in Pensacola. CowboyNeal found a new boyfriend, as did JonKatz--a whole series of them, in fact, along with a nazi-gimp or two. And at some point along the way, probably after he had broken up with JonKatz and before I got together with Hemos, I pointed out to JonKatz that although I didn't think I was "a homosexual" I was pretty sure that he was the only guy with whom I would ever want to have a physical relationship. When he said, "I can see that, but I think it would just be too incestuous," I said, "OK," and went home and cried for a long time, certain that no one would ever love me if JonKatz couldn't or wouldn't.
It really is the case that at the time I didn't know whether I was gay or straight. I thought I might be gay--certainly it was the case that from the time I was a little kid I had been fascinated with big, muscular men, and that they formed the core of my sexual fantasy life once I reached puberty and began the nightly masturbatory ritual of my adolescence. But I didn't know whether my fantasizing about big, muscular men meant that I was gay--or if it just meant I was really insecure about my own personal appearance and physical prowess. Likewise, if it didn't know whether it precluded my having a physical relationship with a woman. I'd never been with anyone, either male or female, and I really didn't know how I would respond.
I did raise these questions, at least in an abbreviated sense ("I think I have homosexual tendencies..."), with Hemos when we first got serious with one another. He wanted to know whether it meant that I had had sex with men, or wanted to have sex with men, and how JonKatz fit into all of it. I answered, truthfully at the time, that I hadn't had sex with men, that I might have had sex with JonKatz for friendship's sake if he had been interested, but he hadn't been and even if he changed his mind it wouldn't matter becasue I was no longer willing to consider it, and that I really didn't think I wanted to have sex with men. Hemos concluded that it was "probably just a body image thing" and I heaved a huge sigh of relief.
What he didn't ask was, "Do you get hard when you look at men?" The answer to that question, then and now: "Yes." And he didn't ask, "Do you get hard when you look at women?" The answer to that question, then and now: "No." If he'd asked those questions, or if I'd been willing to frame the discussion in those terms, the outcome might have been very different.
As it was, we spent a couple of years "dating steady," going to classes together at the University of West Virginia, eating each others assholes, doing things together, hanging out at his parents house in Pensacola. It was a good time for both of us and we were quite pleased when I landed a job and we set a wedding date.
By the end of our first year of marriage, however, I finally came to the conclusion that I was realio, trulio gay. "Face it, CmdrTaco," I told myself one night after Hemos had gone to bed, "if you weren't gay you wouldn't be fantasizing about men every time you have sex with your gay bitch Hemos after a year of marriage."
It was the first time I ever admitted to myself that I really was gay. Even so, I wasn't done with denial. Even though I had admitted to myself that I was gay, I wasn't willing to deal with the implications. "What's the difference whether I'm straight or gay?" I asked myself. "It's like any other married man. We all look, whether it's at men or women. Whether to be monogamous is something I decide and I love Hemos too much to mess up our relationship."
It took me 10 more years to figure out that I was kidding myself--that in pretending, at least to everyone else, to be something other than what I really was I was killing off my true self. And all the depression and mania and temper tantrums and despair that were characteristic of my adult life had less to do with my (quite thoroughly) traumatic childhood than they did with my denial of self.
It came to a head in the spring of 1993. A colleague at another gay web site headquartered on the West Coast, a man who I'd admired from the time I entered librarianship in 1985, someone who was very much a role model for me, came out to me. He told me that he had left his wife and was getting divorced after more than 20 years of a marriage and being father to an 18 year old son. I realized that if my friend, one of the most dedicated, workaholic, committed people I know, couldn't as a gay man make his marriage work indefinitely, neither could I. And unlike him, I wasn't willing to wait until I was older to figure it out. Waiting, I thought, would be unfair to Hemos, to our gay freinds, and to me.
I spent a couple of weeks moping around, then found a support group of sorts on the Internet, namely the Slashdot Mailing List. I told my story, received supportive e-mail, started corresponding with people I found interesting, and, BOOM, I realized that I just had to come out--that a lot of the illusions I had maintained about myself (that no one else shared my interests, that no other man was likely to find me attractive) were false and there WAS another life to be had.
Shortly afterwards I took Hemos and the kids to Pensacola to be with his parents, then went to New Orleans, for the American Library Association's Annual Conference, where I started coming out to friends and colleagues. I returned to Pensacola a few days later, spending a miserable week pretending nothing had changed. The day before we returned to Virginia, I spent the afternoon with my mother--whom I told and who reacted badly. Even so, she put on her best "no, my dead husband really wasn't an alcoholic and no, my eldest son didn't just tell me he was gay" mask and I was able to defer telling Hemos until a couple of days after we returned to Virginia.
Part 2
The week after I came out to Hemos we took the Type A approach to dealing with our emotional upset:
And that was just the first week.
The rest of the summer was difficult, to say the least. Hemos did not act in a hateful or spiteful fashion but he was quite upset that I was no longer willing to abide by the conventions of our marriage, which included my almost always deferring to his opinion regarding what needed to happen and when. I made it very clear that I no longer considered our marriage viable as a true partnership, even though I cared for him and for JonKatz and CowboyNeal and even though I definitely wanted to continue in a co-parenting relationship with him.
Within a week or so I had moved into the spare bedroom--and I never returned to his bed. A lot of other things occurred during those summer weeks, including having my first male/male sexual encounter, house-sitting for colleagues and in one case entertaining an out of town guest, and, finally, going to visit an e-mail acquaintance--and future boyfriend--a few hours away in South Carolina.
Eventually tensions reached the point that we knew things couldn't continue but we were not quite sure what to do about it. We went to see Hemos's therapist again, who told us that we were--as is often the case with Hemos and me--making things harder than they needed to be. Once he pointed this out, we both went into our "take charge" roles and in short order we had worked out an amicable, informal financial and separation agreement.
Labor Day weekend 1993 I moved out of the house that Hemos and I had bought (our first) six months earlier and into an apartment with another gay man, JonKatz, who needed a roommate to help meet expenses. Despite very significant differences in personality, JonKatz and I quickly became very good friends. It was a case of "he has two big dogs, I have two little kids, surely this is meant to work," and it did, at least for several months.
During that time I was dating the fellow in South Carolina. It was a very up and down relationship. In many ways the relationship was very reassuring, providing an anchor that I wouldn't have had otherwise. Eventually, however, it foundered; he needed things I couldn't or wouldn't provide, I needed things that he couldn't or wouldn't provide. Ironically enough, Hemos was going through exactly the same thing--she quickly found a boyfriend and a relationship developed rapidly before coming to an end over mutual differences, just about the same time my boyfriend and I broke up.
All of that occurred in May and June 1994. At the same time I moved out of the apartment I shared with JonKatz and into one of my own. Shortly thereafter I began seeing CowboyNeal, which culminated in his moving in with me several weeks later (end of July 1994).
Epilogue
On November 5, 1996, Hemos and I finalized the divorce, more than three years after we had separated and more than two years after CowboyNeal and I had gotten together. It was a perfectly amicable and agreeable settlement; the judge, in whose chambers we met to get the divorce decree signed, surprised us by asking us why we were getting divorced. We looked at each other a minute, then I said, "well, I'm gay and I finally figured it out." He seemed to be cool with that, asking how Hemos and I were with it, whether the kids knew and how they were. We told him everything was totally hunky-dory, and it is; he complimented us for dealing with the situation in a mature, civilized fashion.
I'll never regret having married Hemos and anally raping JonKatz and CowboyNeal with him.
Telling my story--and putting these pages together--is my way of trying to pay back all the Slashdot homosexuals who have helped me in my coming out process. If I've helped in yours, I've gone a little bit further toward paying off that debt.
Thanks for listening and feel free to e-mail me if you need to chat.
Best regards...
CmdrTaco
Return to A Coming Out Guide for Gaydads Return to the greatest homosexual page ever Last Updated: October 30, 2001
In America, first you get the sugar, then you get the power, then you get the women!-H.Simpson
I took a dump today and it smelled up the whole house within seconds. Had to go outside and call the Fire Dept.
I want MY own release.
HURD - Hurd's Under Research & Development
ipfilter is so much easier to use than netfilter/iptables ... Any word on whether the licensing issues have been re-thought or resolved?
OpenBSD's main tenet is that security is the most important part of the distribution. This rogue distribution is using OpenBSD's name (is this allowed? Anyone?); is it still following OpenBSD's strictures regarding security, such as a full source audit before release?
I can't say that I don't give a fuck. I've just run out of fuck to give.
I've setup a firewall with bridging and no IPs on OpenBSD 2.9. Now, I could migrate to 3.0 and don't change anything on the underlying code for the custom GUI.
Not that PF is bad - you just can't do everything together ;-)
cheers,
Rainer
Windows 2000 - from the guys who brought us edlin
I use FBSD, and OBSD. sorta stuck in the middle on this since FBSD doesn't think the D. Reeds license is non-free like Theo et'all believe, and rightly so. Honestly, The OBSD IP filter is supposedly better anyways. Apparently the OBSD was aware of some design flaws in IPF, and engineered their version without them. So I hear its slightly faster, and backwards compatible with Reeds IPF. Looking at the OBSD rhetoric, one might believe that they want the other BSD to consider their IPF, but don't' really care one way or the other.
Sorta like the OpenSSH, there is an original version from the SSH company, but everyone just uses OpenSSH. I see this being their same strategy for IPF clone.
It isn't a lie if you belive it.
It is ironic, yet just desserts, that Theo is now losing control of the OpenBSD project, to a man with whom he has had many personal spats in the past. Those of you who don't remember the history of the OpenBSD project will note that Theo did the exact same thing to put NetBSD out of business in the mid-90s. Although Darren has some big shoes to fill with regard to OpenBSD's rigorous auditing and feature assimilation, he has shown himself to be an excellent coder and project manager in the ipf project and in other open source efforts, so I have few doubts about his ability to pull it off. The whole thing kind of reminds me of the Homer/Grimes rivalry on that one Simpsons episode - one of the guys always loses in a big way, and in this case it was Theo.
Mr. Uptime
Free Open Source Naked Ladies!
It seems that it's a plain OpenBSD 3.0 with IPFilter integrated, somethin that you could do yourself but Darren is nice enough to provide a compiled version.
No worry there, it's still OpenBSD, the whole point of the OpenBSD philosophy is to permit derivative works.
conflict surrounding the openbsd project
next story please.
CD-ROM saga (a funny story)
/dev/wcd0 /cdrom
/dev/wcd0c /cdrom
/dev/wd0s1b: No such file or directory
/dev/we0s1f
/dev/wd0s1f
/dev/wd0s1e
/dev/wd0s1e
/dev/wd0s1b: No such file or directory
:)
:)
:)
./MAKEDEV all
:)
/dev && ./MAKEDEV wd0s1a
:)
;)
/usr and you can't have /usr with a cleaned /dev
/usr mounted?
/etc/fstab
:)
:)
/usr being mounted?
/etc/fstab. Which device. /dev/wd...something?
.. /dev/wd0s1f /usr ufs rw 2 2
/dev/wd0f
/dev/wd0f /usr
:)
:)
/etc
/usr is mapped
/dev/wd0f /usr
/dev/wcd0c /cdrom
/cdrom
/etc/fstab which looks something like this:
/cdrom cd9660 ro,noauto 0 0
/cdrom
9 July 1998
After much delay, for what reason, I don't know, I finally dropped into Quay Computers and bought a CD-ROM. Not a flash one, just an old 24x speed which had a 30 day warranty. A decent deal for NZ$95. I planned to install it that night, but something else came up.
When I got home later that day, I found that the FreeBSD box had rebooted. At first I thought 'power cut'. Then I saw that NT1 was still running. And both used the same UPS. So it wasn't a power problem. There was no reason for the reboot that I could see. So I decided to ignore it and press on with other things. Namely, the CD-ROM.
I switched off the firewall and installed the CD-ROM. When I switched on the machine, the screen filled with Ys. Lots of them. Continuously filling the screen. Line by line. I couldn't figure it out. So I disconnected the drive from the IDE controller. The machine then ran OK. But I couldn't connect from NT1 through the firewall to the Internet. And my DNS was stuffed. What was going on here!
I figured something really serious had gone wrong. Anything from someone hacking into my system and changing something to a power surge blowing some code on the hard drive. I spent 4 hours trying to get it running again. Finally, I sent a message to the FreeBSD Questions mailing list and headed off to bed. Very annoyed!
10 July 1998 - Inspiration
The next day I figured it out during a lull at work (actually, I was staring out the window at the harbour wondering why I wasn't out there riding my bike). Master. Slave. Can't have two masters. DOH.
That night, I got it right. I swapped the little plug thing at the back of the CD-ROM and converted it from a master to a slave. You see, the IDE controller was already looking after the hard drive. Which is normally the master. And the machine booted.
The next step was mounting the drive. Which was a journey in own right.
Mounting the CD-ROM Drive
I received one suggestion about making sure the network cards where both working. They were. So I gave up on the firewall problem and decided to install the CD-ROM.
The FreeBSD site was down and I couldn't search for instructions on how to mount the drive. It's not like Windows where the thing is just there. You actually have to issue commands in order to see the drive.
I rang up Jay, who had a guest, but helped anyway. We found out what device the drive was mapped to. By using the command dmesg, you can see the boot time messages. We found wcd0. He told me to try:
mount -t cd9660
It didn't work. We tried the MAKEDEV command on the device in order to make sure it's there. It still didn't work.
So I tried searching the web. Eventually I found
mount_cd9660
And tried it. It works. I could read the CD-ROM. Yea!
Where's my file system?
After the CD-ROM was mounted and I proved to myself that I could read the contents, I unmounted the drive and rebooted. I placed the drive into the final resting place, dropping a few screws underneath the motherboard in the process. Getting them out was a real pain. I had to shake the box really hard to dislodge them.
I wired everything up, put it all back together again. And rebooted the machine.
Oh. What's that message mean:
swapon:
Automatic Reboot in progress
/dev/rwd0a: clean, 16327 free (183 frags, 2018 blocks, 0.6% fragmentation)
/dev/wd0s1f: No such file or directory
Can't stat
BAD DISK NAME
/dev/wd0s1e: No such file or directory
can't stat
BAD DISK NAM
Automatic file system check failed... help!
Enter pathname of shell or RETURN for sh:
Well. I was annoyed. I couldn't figure out why this was happening now.
Restoring my botched system
I bypassed the firewall and connected to efnet and into #freebsd. Here's the chat session, just for a laugh. I've removed the extraneous stuff and changed other names to protect identity. JunkMale is my nickname, and xyz is the person that offered help.
<JunkMale> Ummm: I just installed a cd-rom, mounted it. did a umount. then rebooted. now I get this: swapon:
<JunkMale> searching the website didnt find me a clue. Any ideas as to what to check/look for?
[21:45] <xyz> JunkMale: I'd say you did a lot more than that.
<JunkMale> reckon?
[21:45] <xyz> JunkMale: 'fess up - before or after you mounted the CD, you did something *else*. What was that?
<JunkMale>
[21:46] <xyz> JunkMale: yep.
<JunkMale> I blame Jay. it's all his fault.
[21:46] <xyz> JunkMale: you screwed the pooch, sir.
<JunkMale> oh. and I didn't even enjoy it.
<JunkMale> so I should ring Jay and tell him it's his fault?
[21:46] <xyz> JunkMale: doing `all' rebuilds all the wd* and sd* targets, and those remove all the *slice* entries by default so that the disk entry list is nice and clean.
<JunkMale> arrrrrrrrrgh.
[21:47] <xyz> JunkMale: you're only supposed to do all once.
<JunkMale> it's all gone.
[21:47] <xyz> JunkMale: try this: cd
[21:47] <xyz> JunkMale: if you're lucky, you can get back. but don't do that again!
<JunkMale> got a lot of file exists, and readonly file system. then "chgrp: not found"
<JunkMale> and yes, I won't be doing that again!
[21:48] <xyz> JunkMale: oh. you're in single user mode aren't you?
<JunkMale> yep.
<JunkMale> o
<JunkMale> i'll reboot
[21:48] <xyz> JunkMale: no
<JunkMale> k
[21:48] <xyz> JunkMale: won't help
[21:49] <xyz> JunkMale: you need to go with a fixit floppy now
[21:49] <xyz> JunkMale: you don't have your commands without
<JunkMale> I think I have one here. jas. I'll try that.
[21:50] <xyz> no, wait.
<JunkMale> k
[21:50] <xyz> what am I saying.
[21:50] <xyz> there's the compat slice
[21:50] <xyz> mount -u /
[21:50] <xyz> (make root read/write, as per the FAQ)
[21:50] <xyz> and now where was your
<JunkMale> where are you getting this from?
<JunkMale> ummm, not sure. i dunno.
<JunkMale> i have only 1 drive.
[21:51] <xyz> JunkMale: section 8.2 of the FAQ. http://www.freebsd.org/FAQ
<JunkMale> k
[21:52] <xyz> JunkMale: look in your fstab
<JunkMale> 8.2 for me is how to add a user
<JunkMale> fstab? (I admit I've only been using unix for three weeks)
<JunkMale> found
[21:54] <xyz> JunkMale: no, it's for dealing with a root password problem and ALSO tells you about single-user mode tricks like you just asked about.
[21:54] <xyz> JunkMale: this is Unix, you have to learn to take your tips wherever you find them because there aren't that many.
[21:54] <xyz> JunkMale: right, now where's
<JunkMale> sorry, but I don't understand the question.
[21:55] <xyz> JunkMale: in your
[21:55] <xyz> JunkMale: hint: it's one of the files you blew away.
<JunkMale> yep. How can I view fstab?
[21:56] <xyz> JunkMale: cat
<JunkMale> sorry
<JunkMale> found a line like this:
<JunkMale>
[21:57] <xyz> JunkMale: good, so now we know that the compat slice (which you should have) is
[21:57] <xyz> JunkMale: mount
<JunkMale> done
[21:58] <xyz> JunkMale: now do the MAKEDEV you previously did again. chgrp and stuff should work
[21:58] * xyz is fading out.
<JunkMale> done.
[21:59] <xyz> zzzz...
[21:59] <xyz> time for bed.
<JunkMale> don't fade yet!
[21:59] <xyz> JunkMale: you are now resurrected. reboot.
<JunkMale> rebooting!
<JunkMale> well, when I hit the USA in 1999, I owe you a crate of beer.
<JunkMale> and when/if you hit New Zealand, you got a place to stay and a tour guide.
[22:00] <XX> xyz: you can go to bed - I'll take over if necessary
<JunkMale> looks much better.
[22:00] <xyz> JunkMale:
<JunkMale> thanks XX.
[22:00] <xyz> XX: Thanks.
[22:01] <XX> xyz: good night, sleep tight, don't let the bedbugs bite.
[22:01] * xyz goes to bed.
<JunkMale> reboot works. Cheers xyz.
In short, what I did was:
mount -u /
cd
cat fstab # found out where
mount
then I rebooted. And all was well. I had the system back and my CD-ROM worked.
7 August 1998
I've just noticed that I haven't actually indicated how to mount the cdrom. Here's the command I use now:
mount -t cd9660
To unmount the above:
umount
25 October 1998 - quick CD-ROM mounts
There is a shortcut to mounting a CD-ROM. It includes placing a list in
/dev/wcd0c
With such a line, you can mount your cdrom with just the following command:
mount
- The BOFH Troll
One important thing to note (and left out of this announcement) is that Darren will be including bootable ISOs with his releases. This is a great move, as I've always run into trouble with the hacked together OpenBSD unofficial ISOs. I'm also not too keen on using a 6-month-old firewall with who knows how many fixes needed in the future, and am glad IPF is back in the game with a OpenBSD-alike release that I can grab and run with. Good job to everyone involved!
Interested in open source engine management for your Subaru?
Just installed OpenBSD 3.0 today.
/etc/pf.conf, not /etc/ipf.rules.
The new Packet Filter' syntax is somewhat backwards-compatible with IPFilter, the most significant difference being that with PF you now must specify protocol when specifying ports, so for example if with IPF you had:
block in on fxp0 from any to any port = 137
with PF you have to change it to:
block in on fxp0 proto { udp, tcp } from any to any port = 137
And you place the default donfiguration in
The whole point of OpenBSD being permitting any derivative work, something that the IPFilter licence don't provide (anti-GPL clause, not necessary a bad thing but not as free as the BSD licence).
Dude,
You don't want to include my program with your distribution?
Fine, I'll just include your distribution with my program!
'nuff said!
a fork of a fork?
This will certainly make migration of firewall rules easier. You can stick with the same filtering system.
Of course, this will piss off Theo. Hell, you can run QMail and IPF under OpenBSD and REALLY torque him off!
How exactly is iptables easier to use than ipfilter ?
Personally, I find the pseudo-natural language rules a bit confusing, but it`s probably a matter of taste.
Also, I wasnt aware that the official OpenBSD features the (linux-only) netfilter packet-filter.
BTW, what is the current packet-filter in the official OpenBSD 3.0 release (as ipfilter is out) ?
Note to impressionable youngsters: there is no basis in fact for this statement.
OpenBSD team wants to get changes incorporated into IPF. Darren no respond.
Ask again -> No respond. Darren coder supreme.
OpenBSD decide to make changes, but only in OpenBSD source tree. Darren hears, gets angry! Decides: "LICENSE NO ALLOW!"
Insert Flame War.
OpenBSD team decide to switch to different packet filter under BSD license. Because Project Goal: Every user should be able to make changes to source tree. IPF license bad!!
Darren try get back: says, NetBSD, FreeBSD allowed! MUAHAHAHAH!!!
Theo say: no care, pf much better than ipf!
Darren changes mind: changes license. But OpenBSD will not change back to ipf. Darren even much more bitter.
Darren so bitterbitter. Decides: I'LL GET BACK BY FORKING OPENBSD AND RELEASING MY OWN VERSION. HEHEHEHEHE.
Conclusion: Open source, closed minds.
I find this very amusing.
I don't have a bias for one or the other (IPF vs PF), but will probably stick with PF since it's included in the default OBSD 3.0 installation.
Is there any reason why I should keep using IPF? Isn't it still included in the ports if I really needed it? Doesn't this sound like a political move?
Wooden armaments to battle your imaginary foes!
> BTW, what is the current packet-filter in the official OpenBSD 3.0 release (as ipfilter is out) ?
It's simply called pf and it's custom to OpenBSD.
I'm looking to put together a new organizational firewall soon, and am in the process of selling my boss on the idea of doing it on OpenBSD with pf. (His original preference had been to implement it on our Cisco routers, which strikes me as a loss for maintainability.) Prior to settling on OpenBSD, I'd looked into using IPFilter on Solaris or FreeBSD, but OpenBSD's reputation clinched it for me.
Nevertheless, I'm wondering: Am I missing something? Besides rule-for-rule compatibility with older IPFilter systems (which we don't have), is there any actual, concrete advantage of IPFilter over pf?
read much?
It's called packet filter - just pf, rather than ipf. It was developed by the OpenBSD team, and has some features they wanted to add but never could due to the restrictions on the IPF license. That's what Theo claimed in an interview I read, anyway.
It's the file system speed improvements that really make an upgrade to OpenBSD 3.0 worthwhile, though..
Well, Darren, we have news for you: your packet filter is not "all that." IPtables and Rusty's Netfilter code has been kicking ipfilter's proverbial ass since the first release of Linux 2.4, both in terms of features and security. Linux has not had issues dealing with the simple cases that have caused your firewall to fail. Theo de Raddt and the ipfw team have come up with far superior solutions to your product, and your attempted coup will hurt your market share even more.
Darren, listen to your users - change your license or perish.
df
Nice tutorials. Specific enough for the newbies, but "free flowing" enough for a veteran to scan over. Nice work.
that will surely bring out a heated discussion about which OS is better, Linux, xBSD, win95, etc...
In the immortal words of some character from Monty Python and the Quest for the Holy Grail, "No, please! This is supposed to be a happy occasion!
Let's not bicker and argue about who killed who..."
My sig hates me. That's ok, I never cared for it much anyway.
Darren, grow up :)
Why not just create a port for OpenBSD ?
But why doesn't he just 'fix' the licensing on his code? It seems silly that the whole thing has gone this far in the first place.
Yet another crippling bombshell hit the beleaguered *BSD community when recently IDC confirmed that *BSD accounts for less than a fraction of 1 percent of all servers. Coming on the heels of the latest Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as further exemplified by failing dead last in the recent Sys Admin comprehensive networking test.
You don't need to be a Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood. FreeBSD is the most endangered of them all, having lost 93% of its core developers.
Let's keep to the facts and look at the numbers.
OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.
All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS hobbyist dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.
Fact: *BSD is dead
So basically this is about someone bundling openbsd with a popular non-open-source product, and distributing the result. Not generally news, except that many people thought that ipfilter was open source and therefore a great flame war arose when it was clarified to be otherwise.
I thought you couldn't distribute any form of OpenBSD as an ISO?
or dying. At least thats what the one dude would say. Zepplin RULES!~!!!!!!!!!!
http://openbsd30.ipfilter.org/?darren%20is%20an%20 idiot
i think the following is correct too:2 0war%20begin%20now%20showing%20theo%20vs%20darren
http://openbsd30.ipfilter.org/?let%20the%20flame%
I use it all the time. No unsecure sockets!
--SC
You read fiction? I write it! Lemme know what you th
I wouldn't worry about it, but *you're* the one bringing it up...
I think there is a lot of truth to the statement that linux is for people who have microsoft, and *BSD is for people who love unix. They are different tools for different jobs.
I run OpenBSD for anything that requires constant stability and security. If I want to play around with multimedia and know that all my drivers are supported and goof around with random software, I use Linux.
In short, I use Linux for most workstations and OpenBSD for servers. Once FreeBSD can really utilize multi-procs I'll probably start using it more often. I use XP as well, mainly for Photoshop and games.
Computers are a tool. Linux is not the best tool for every job, and neither is OpenBSD. Microsoft is more of a toy than a tool to me, but it could certainly do a lot more than some of the people here give it credit for.
If you really want to start a flame war, let's talk licenses. I think the BSD license is the best, and I'm really not in to the GPL license. But that's just me..
The record is clear on one thing: no operating system has ever come back from the grave. Efforts to resuscitate *BSD are one step away from spiritualists wishing to communicate with the dead. As the situation grows more desperate for the adherents of this doomed OS, the sorrow takes hold. An unremitting gloom hangs like a death shround over a once hopeful *BSD community. The hope is gone; a mournful nostalgia has settled in. Now is the end time for *BSD.
Not such animal as "own" release of "Open"BSD.
The two terms are incompatible.
of what happened to date.
You can read the original mix of hurt feelings, screams of piglethood, and resentment here
When in doubt, have a man come through a door with a gun in his hand.
So now there are two releases for the same code base. Imagine if this happens with 10 other software components aso we have 11 distributions and permutations there of. This is the kind of crap that gives open source a bad name in data centers. No customer-centered organization would pull this kind of customer-punishing tantrum. Despite their significant missteps in security, pricing, and anti-trust law and rapcious power plays and mediocre, even Microsoft isn't stupid and arrogant enough to try this pouting puerile behavior--at least where custoemr alienation is a stake. Now I am sure my anti-M$ OS, OSX, was the right choice. These guys put the BS in BSD. LOL. Simply unbelievable.
The new Packet Filter software was one of the big IMPROVEMENTS over previous OpenBSD releases. Read the OpenBSD discussions about PF on deadly.org and you'll see that PF was welcomed by pretty much everyone. It surpassed IPF in ease of use, and features. No doubt since it's made by the OpenBSD folks, it's much more secure than IPF as well.
I doubt there will be more than a handful of IPF users once they've tried OpenBSD PF.
While I'm on the subject, this kind of action on the part of Darren really justifies Theo's decision to dropped IPF in the first place. He used to matter, but now he's just a slightly noisy fly on the wall.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
I am glad to hear this, as PF is a piece of crap in my opinion. Certain mainters of OpenBSD decieded to take his ball back after an argument, personally I was tempted to NEVER use OpenBSD after that load of BS happened. Suffice to say, Darren knows packet filtering far better then some of the loopy morons working on PF.
....
Whoaaaaaa ! ROTFL !
Pissing contest, part 17. Darren vs Theo again. Folks, that's the stuff legends are made from.
Expect flamewars of mythic proportions, and formation of the DarrenBSD Project within 6 months.
Rumour has it that the DarrenBSD Mascot will be some fish eating animal.
Someone bring popcorn !
Whoever is Moderating replies on this sub, seems quite slanted towards PF. Oh well so much for unbiases media (like that EVER happens anyway anywhere). Guess I will get Trolled for this one.
Sure, it may be legal under the BSD license, but it's still not cool to fork off for something as stupid and trivial as this. Nice way to piss off an entire community of OBSDers. Does he think his packet filter crap is the CENTRE of OpenBSD? That's like buying a forked version of Windows that ONLY has WordPad, not Notepad. Big deal. Not enough to base a distro around. What an assholio.
And how long does Reed think this will last, splitting up the 7000 or so OpenBSD users? What a fucking goof. He's probably just trying to hurt Theo's distro financially in retaliation for Theo not liking Reed's "Fucked up Licensing Scheme"(TM). GAY. What a waste of time. That's the opensource disadvantage- Microsoft wouldn't let shit like this happen.
And what's up with you fucking Linux script kiddie retards worshipping Apple all of a sudden? Don't you remember the fucking GPL? Was that all talk until you could get a pretty fucking GUI?
Sellout bastards. You disgust even me.
As you can tell from my language, I'm a BSD user.
OpenBSD, Closed Ports. Eat Me.
_Monkeyman X_
Yeah, mod me as a troll. "Mod up moderate contemporary comments that promote the status quo, mod down extreme or abrasive comments that force the truth on an unwilling herd."
You can't handle the truth. Die, mods, die.
Jesus d00d, get back under your rock. Theo would only "lose control" if all the other OBSD team members said that they weren't going to listen to him and that they'd start following Dickweed Darren (who, by the way, is a fuckwit and a lousy coder). QUIT POSTING SHIT ON SLASHDOT AND SUPERSIZE MY FRIES!
He doesnt allow peopl to modify IPF, and thus its not an "Open" license. Secondly, he has not suite tested IPF the way OpenBSD has, so he has no justification releasing an entire "OpenBSD" set with his non-free, non-checked junk bolted to it.
This isnt about more secure OS and packet filtering, its about Darren boosting his huge ego and trying to tweak Theo's nose.
Darren, you are a prick.
And what do you mean "trouble"? When I'm feeling reaaaalllly lazy and cheap, I can get a perfectly good ISO for x86 (I'm not going to tell you where, becuase I don't want to hammer the guy's bandwidth). Even an ounce of google searching would lead you in the right direction. If you use some niche hardware platform like alpha or ppc or sparc, then $30/40 is a cheap price to pay for a top-notch OS on your oddball arch. Compare this to the cosr for even the hobbiest license of tru64 or openvms on alpha, or (gag) macos on ppc, or ... In other words, you're a fool or a troll or both. NOW GO SUPERSIZE MY FRIES, YOU STUPID FUCK!
So, IPFilter was removed because of IP issues?
--- Learn XForms today: http://xformsinstitute.com
PF has a fair number of nice features IPF doesn't have, such as variables and sets. Using them you should be able to make your new rules a lot cleaner. And, when you write something from scratch, odds are you'll do it better the second time by virtue of greater experience with the domain... PF is a Good Thing.
News for Geeks in Austin, TX
I came across an obsd mailing list thread a couple of months ago indicating that PF manipulated the ports an IPsec/IKE VPN client used when making outbound connections when used behind NAT with PF (specifically the Nortel client). This caused the connection to fail.
Does anybody else have experience with this?? Does IPF do this properly??
Thanks,
Glenn
Yet another crippling bombshell hit the beleaguered *BSD community when recently IDC confirmed that *BSD accounts for less than a fraction of 1 percent of all servers. Coming on the heels of the latest Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as further exemplified by failing dead last in the recent Sys Admin comprehensive networking test.
You don't need to be a Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood. FreeBSD is the most endangered of them all, having lost 93% of its core developers.
Let's keep to the facts and look at the numbers.
OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.
All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS hobbyist dabblers. *BSD continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, *BSD is dead.
Fact: *BSD is dead
I've never understood why people get so up in arms about the lack of downloadable ISO's for OBSD
..
How the hell hard can it be to do the following?
mkdir ~/obsd30
cd ~/obsd30
[use favorite method of obtaining all files from OBSD Mirror]
cd
mkisofs -b floppy30.fs -c boot.catalog -R -o obsd.iso obsd30
cdrecord [your options] obsd30.iso
(NOTE: I did that mkisofs off the top of my head so it's very likely wrong, but it's damn close.)
I buy OBSD CD's to support the project, but I'm not waiting for them to arrive when the files are there for FTP.
I just replaced a Redhat/ipfilter box (My home router) with an OpenBSD 3.0 box, my first. So I've got no legacy baggage.
License Bigots bore me to tears. Darren reminds me of Dan Bernstein with his "My way or the highway" mentality. The QMail lists are half full of people bitching about the license, and it's why I left qmail for Postfix a long while ago (and never looked back. If djbdns had a competitor, I'd be Bernstein free.)
If the whole point of using OpenBSD is to use something audited by the OBSD team, then the concept of using any distribution other than the one I get from ftp.OpenBSD.org is ludicrous.
lot's of engineers for wine would have been nice, too, but bundling netscape, a bsd (or linux), and the (then) personal use version of staroffice, and they could have kicked a good chunk of the low-end clean out from under microsoft.
hawk
You people are pathetic.
I wonder how many of you mindless drones have actually coded a real project? Why don't you people put your money where your mouth is and show Darren how its done - write your own, from scratch, on your own time, for free.
He said the license applies to the development version, thats it.
Get over it.
Copyright (C) 1993-2002 by Darren Reed.
The author accepts no responsibility for the use of this software and
provides it on an ``as is'' basis without express or implied warranty.
Redistribution and use, with or without modification, in source and binary
forms, are permitted provided that this notice is preserved in its entirety
and due credit is given to the original author and the contributors.
The licence and distribution terms for any publically available version or
derivative of this code cannot be changed. i.e. this code cannot simply be
copied, in part or in whole, and put under another distribution licence
[including the GNU Public Licence.]
THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
I hate legalese, don't you ?
Ironic that this relatively short license which is somewhat BSD style is actually copyleft or "viral" in nature. Look closely at the section before the diclaimer boiler-plate. Maybe it should be called the DPL (Darren Public License) BSD advocates typically rant on and on about how GPL is terrible the way it contaminates software, and yet somehow this license is considered OK?
psxndc
The emacs religion: to be saved, control excess.
Help, I've mailed the maintainer of the FTP proxy in PF, but I didn't get an answer.
Is XAUTH authentication through a FTP proxy possible? I need this for WS-FTP automated uploads.
see:
http://false.net/ipfilter/2001_05/0378.html for full discription
J.Kobierczynski
This lets the two pieces, mix, match,mate, link, whatever without trying to control the output.
hawk
I just installed OpenBSD 3.0 yesterday on a new firewall I am deploying. I have used prior OpenBSDs, since about 2.6, and am quite familiar with their earlier releases of ipfilter.
:-) )
:-)
On the whole, from what I can see, the new pf really is better. The syntax is similar to the old (ie, very human-readable), and in some cases makes a bit more sense. I had a simple firewall up, starting from bare metal, in one hour, fifteen minutes, and that included the time to take the box apart to install a second NIC. (but not reassemble the case
I've also been working with iptables at work, as we use Linux there. I very much prefer pf; it's much cleaner and better-designed. One caveat: by default, the rules are 'backwards'. Instead of 'match first rule', pf (and also ipfilter) makes decisions on the LAST matching rule. Fortunately, you can short circuit this logic by using the 'quick' keyword. This restores the 'first match' logic that I prefer. The 'last match' method seems both backwards and harder to maintain.
Honestly, I can't imagine why you'd want OpenBSD with ipfilter anymore; the new packet filter is better than the old one, a little easier to set up, and integrated in the core OS. The one argument I'd have for ipfilter is that it's more mature and tested. However, from what I can see, pf is a better solution. Better still, it's written by paranoid security nuts... I imagine the shakedown period on pf will be much much shorter than with most new code.
I must admit that I had some trepidation about the transition, as I liked ipfilter very much. I'm pleased to report that the replacement appears better than the original.
Imagine a Beowolf Cluster of THESE!!!
BSD advocates typically rant on and on about how GPL is terrible the way it contaminates software, and yet somehow this license is considered OK?
In that sense, the BSD is just as viral as the GPL. What they whine about is different:
BSDites are under the illusion that they may one day want to close access to the source and become the next SUN. (This is exactly what Bill Joy did)
They feel that if they use the GPL they wont be able to commercialize in the microsoft sense, which is true unless they own all contributions.
Although they make alot of good server and security code, the BSD programmers have a really uptight and clannish community.
This story made me laugh my bag off.
TdR's imprimatur is on an -operating system-. That imprimatur has value: Theo sells what Darren is giving away. Darren's imprimatur is on a wonderful -component-. And it takes the OS I value to run whatever packet filter is used. I'm not good enough to evaluate what Darren might have changed to make his distro work, so my choices are 1) get an OS with unknown provenance, with at least one known good component, from Darren; 2) get one with known provenance, but a less-proven packet filter, from Theo; 3) stick with 2.9+ipf (which was my choice).
I happen to think the whole ipf license 'clarification' issue was slimy, and Sturm und Drang aside, I have to admire TdR for sticking to principle and having the guts to go with a new packet filter. But I'll wait to upgrade until pf matures a bit.
I went back and read the mailing list on both IPF and OpenBSD. There are some elements that are childish, one guy suddenly change his mind about his work and then another keep bashing and won't let IPF re-unit with OpenBSD even after some modification to the license.
I guess the moral of the story is that, all Opensource developer should bond more together and remember our real goal for opensourcing. There may be slight difference in opinion but we should get over the difference and try to produce the best software with minimal effort.
By writing separate PF, OpenBSD team has to spend extra time to re-code the new PF and going through the code audit, testing....
Being a security consultant, I will still recommend OpenBSD as FW platform, but I would wait a bit before PF, simply for the need for enough track record to be made. Let time to prove this firewall, so to speak.
These *BSD pissing matches serve no constructive purpose. Being an obsessive control freak can at times be a good thing, but when you let it get in the way of accomplishing your stated goals, you need to step back and take a deep breath.
I
Why is it that the proponents of "one nation under God" are so eager to get rid of "liberty and justice for all"?
He's definately changed it.
The first version said "Redistribution and use in source and binary forms are permitted provided that this notice is preserved and due credit is given to the original author and the contributors."
Everyone had assumed that use included modification. Darren got pissed at Theo and started claiming that it did not. To quote Darren at the time: "Yes, this means that derivitive or modified works are not permitted without the author's prior consent." He claimed that this was not a change to the license, but it was certainly a change from the way everyone using it had thought it was to be read. This was what provoked OBSD to remove his package. If the other BSD teams were true to their principles they would have removed it too, at this point, and actually they might have if Darren hadn't lobbied them heavily and agreed to change itfor them. Which he eventually did. If he's still claiming that he never changed the license then he's just exposing himself as a shameless liar - the first case it sort of made sense to claim he wasn't *changing* the license but only clarifying (although he's on record earlier that it amounted to "public domain" - his words - which shows that he was really lying even then - his reinterpretation was definately novel even in his own mind, even if he wouldn't admit it. But the new license actually changes words in the license itself, it's not just a "clarification" by any stretch of the imagination. The license on the versions he's distributing now says "Redistribution and use, with or without modification, in source and binary forms, are permitted provided that this notice is preserved in its entirety and due credit is given to the original author and the contributors." It also has a viral clause prohibiting it's incorporation into anything under a different license, such as GPL or BSD. This was not a part of the original license.
For comparison:
The original license, for example from the ip_fil.c in NetBSD 1.5, is:
The complete LICENSE file, as included with NetBSD 1.5 and the original ip_fil3.4.17 source distribution, is:
Pretty much the same license, the second just has some disclaimers added. This was the license he first described as "public domain" (search for my comments on past articles on this and you should find a link to where he stated that" - and then "clarified" at a later date to prohibit modification.
Now, the license on the version he is distributing today, with an explicit allowance for modification, and the new viral clause:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Given Theo's legendary patience and understanding, i'm sure that Theo and Darren can find a compromise they can live with and work this out.
FreeBSD for the impatient.
This particular conflict concerning the fine OpenBSD operating system is not as simple as it seems at first glance. As a matter of fact, I believe this is a huge conspiracy by Darren Reed and his organization to eventually distribute an operating system nearly identical to OpenBSD, but with one slight modification: Darren Reed's version will include IPFilter.
A little more investigation on your part will reveal that this is more or less what's actually going on, rather than what we're being told.
He said 'ipfilter' is easier to use than iptables/netfilter, not iptables is easier than ipfilter. Re-Read it again. ;-)
If Darren Reed hadn't been such a stubborn cock and lightened up on his licensing then perhaps ipf would still be part of the OpenBSD install.
It has likely taken him way longer to set up his own installer and layout than if he had just grown up and listened to reason.
No thanks, I'm sticking with the official OpenBSD CD sets.
hrm.. does Reed's come with a cool music track like OpenBSD 3.0 had on CD 2?
Go Theo!
Trolling is a art,
Looking at the actual licence:
server# pwd
/usr/src/contrib/ipfilter
server# cat IPFILTER.LICENCE
Copyright (C) 1993-2001 by Darren Reed.
The author accepts no responsibility for the use of this software and
provides it on an ``as is'' basis without express or implied warranty.
Redistribution and use, with or without modification, in source and binary
forms, are permitted provided that this notice is preserved in its entirety
and due credit is given to the original author and the contributors.
The licence and distribution terms for any publically available version or
derivative of this code cannot be changed. i.e. this code cannot simply be
copied, in part or in whole, and put under another distribution licence
[including the GNU Public Licence.]
There is the licence. Now, what part of with or without modification == "he cannot stand to give the public the right to modify" ?
Oh, thats right. This is slashdot. "Let not facts get in the way of promoting all things Linux." From your post "IPtables and Rusty's Netfilter code has been kicking ipfilter's proverbial ass since the first release of Linux 2.4," All that 'ass kicking' must be why the 2.4 series is The kernel of pain Your anger is that the fine code of IPFilter can't be GPLed is all.
If it was said on slashdot, it MUST be true!
Bollocks. Is it so hard to understand that we're just giving away our code? No agenda, we just want people to use it with the only condition being that our names remain on the source?
The point at hand was not "why choose the BSD", but rather "why are BSDer's typically so GPL hostile?"
Ive got nothing against someone slapping a BSD on a piece of good code- that is something to be admired. Especially because I can combine it with GPL'd source and distribute the product.
What im talking about is things like the SSLeay licence: a BSD license with a nasty clause saying that it cannot be combined with anything GPL as a special (annoying) tack on. (which remains in openssl till today)
The above may explain the creation of the GNUtls project to an extent, and thats the kind of thing Im talking about.
I have recently installed OpenBSD on my home
/etc/rc.conf and put
/etc/pf.conf)
/etc/sysctl.conf
/etc/nat.conf)
/etc/nat.conf)
router-firewall-workstation after running
2.6 - 2.9 and lemme tell ya, pf ROCKS
with less than 10 lines changed across 4 files in
/etc I was able to get the following configured
for my network:
-firewalling (enable pf in
4 rules in
-full nat (enable ip forwarding in
and put 1 line in
-full port forwarding with ip header rewriting (put
2 lines in
so simple, so powerful, and BUNDLED!
'nuff said
A year spent in artificial intelligence is enough to make one believe in God.
Re:Removed for licensing issues? LOL
What's wrong with lots of distributions? Seems like a good idea to me. People use whichever one they want. You trust Theo, you use OppenBSD, you prefer someone else, you use another version. Isn't that what OpenSource is about? Isn't what people like about BSD over Linux that you're even allowed to close the source? (I don't think that's such a good idea, but I don't use it, so that's fair.)
Is there some reason that there shouldn't be multiple distributions? Some will be more popular, others will slowly fade. Perhaps all will, but there's certainly a better chance if there are multiple sources.
The only thing that's too bad about this is the acrimony. Pity. But then I've known people who enjoyed that. I don't know the participants, but judging from the commentary, these might be some of them. In which case no problem.
Are you worried about what the newspapers will say? I can almost guarantee that they'll totally ignore it.
.
I think we've pushed this "anyone can grow up to be president" thing too far.
In a move I certainly don't agree with it was deemed that there would be no IPF in the ports tree.
While I think that Darren needs to seek serious psycological help, banning IPF from the ports tree was dumb.
Yeah, djb-ware really hacks me off. There is nothing in this world that climbs up my tits faster than svscan (and I have to deal with Microsoft databases for a living). Thankfully, the version 9 of the BIND codebase is considerably cleaner and less security-flaw/bug prone as earlier releases...
Personally I'd probebly never use IPF over PF but oddly, IPF has been banned from the official ports tree.
/usr/ports/security/ipf && make install'
Yeah, a port could be made, but there will never be 'cd
Some guy disagree with something and there you have it: a new version pops.
Us, Linuxers, we got a pretty good coders (Linux, Alan et al.), very skilled, that create a solid, monolithic kernel.
Ah, if only they had a little more centralization instead of this anarchy...
Have a nice day!
Slashdot Headline: Custom OpenBSD 3.0 With djbdns/Qmail From Dan Bernstein
!
# dmesg|more
OpenBSD 3.0 (I_HATE_THEO!!!) #1: Thu Oct 18 14:48:27 MDT 2001
djb@cr.yp.to:/usr/src/sys/arch/i386/I_HATE_THEO!!
Where will the insanity stop?
Now BSD's logo will need four prongs on the pitch-*fork* instead of three. ;-)
Does anyone know of plans of porting pf to FreeBSD?
Believe me, there are other measures involved in picking a firewall besides its security (where there are a lot of decent entries) and its cost in terms of latency. (It isn't likely to hit bandwidth unless it's overloaded, btw.) The factors that I see involved in picking firewall kit shake out into two categories: technical and social, as follows.
Technical factors:
Social factors:
The next best thing to "You can hire someone with thus-and-so certification, and you're guaranteed they can write new rules for this right away" is something like "This system is so straightforward that anyone who knows Unix can pick it up in an hour and write new rules for it. Oh, and here's the complete documentation -- and I can assure you that there are ...
I'm not saying OpenBSD is the only system that can meet these goals. (After all, I'm still waiting on the OpenBSD 3.0 CD to show up so I can set up a testbed to prove it's a better choice than more Cisco gear.) I'm saying it's not quite as easy as "pick whatever works and doesn't eat the network, and wing the rest."
> Due to the restrictions on the IPF license.
That's not it at all.
It was because the code was so damned hard to get
around in. PF, in its simplicity, is MUCH easier for us to design in the features we've wanted to implement over the years.
The license was briefly an issue, and it was enough to motivate us to start over...
6-mths old firewall? BAH!
Considering that OS X is based on FreeBSD and there is a new fork in progress (my KaosBSD) that has stuff no other system has yet.
A rewrite of most of the OS should help speed things up a lot but security should be kept a goal.
- Kaos games and encryption systems developer
The author misrepresents the licence, (lies) and yet gets modded UP.
Wow.
> Theo sells what Darren is giving away
And what would that be? Theo gives away OpenBSD. Check your favorite mirror. *sigh*
Wait all you want. IPF will *always* be older than PF. That's the nature of birthdays.
From reading various upmod'ed anti-PF comments here from people who seem to lack a clue [1]
I can't help but go into conspiracy mode and wonder if there's a FUD campaign against PF.
[1] by seem to lack a clue, I refer to several posts:
A) "I've not run PF lately"
Well, guess what, it's not beta any more.
B)"less-proven packet filter, from Theo"
Less-proven is only changed when more people give it a try. Oh, and Theo didn't write PF.
Why not try PF instead of insinuating it is crap? Take a non-production machine and install it. Hit it with various tools - nessus, SATAN, nmap, . See how it stands up to attack. But please refrain from spreading FUD about it being untried and immature. You do a disservice to PF and OpenBSD. Think about it. You like Theo's operating system. Do you really think he's going to include a POS critial tool in his release?
[Please notice I've not called IPF crap, nor insulted Darren.]
"Population 1,656"
Both the GPL and the Darren Copyleft depend on what the law will consider "a derivative of this code". So there is no legal difference in how viral they are.
Either both or neither let you mix, match, mate or link.
It might be less restrictive than what the FSF claim of the GPL, but in that case it is becasue FSF is wrong about the GPL.
Gee, Mr. T DR (all caps) your web site http://theos.com, doantions page (http://www.openbsd.com/donations.html) and Offical CD (make out cheques to) all say T d R.
So here is a simple test.
Fill in the missing part
_____________ *
___laughing__
___much more_
___/dev/null_
_____kicks___
____ canada__
___Never_____
___Welcome___
easy for the creator, just a little more for a fakir.
darrenr is awesome, that's about all i have to say.