Slashdot Mirror
New PF on FreeBSD snapshot available
Dan writes "Pyun YongHyeon and Max Laier announce a new release of PF for FreeBSD, which is available for download. Since the first release of PF at the end of March 2003, PF has undergone several major updates such as -current and ALTQ support. They have also removed bugs in IPv6, module handling and table support code and believe the current version 0.61 is very close to production use."
What is PF? The eniter announcement refers only to PF, and doesn't give any info about the goals, purpose, or full name of PF.
It might be helpful to provide rudimentary information like this in the slashdot articles.
Actually, this is nothing like in Linux. In Linux-land, each new kernel brought out a brand-new, almost compeltely incompatible packet filter. ipfwadm, ipchains, iptables. The syntax changed. The features changed. There was no way to use the old filter. There were wrapper scripts to try and simulate this, but they are crud. Heck, the packet filters themselves are crud.
In FreeBSD, there's IPFW *or* IPFilter *or* Packet Filter. IPFW has been around a long time, and the syntax has changed very little. New features have been added, though, but all the old features still work. Same with IPF. Nobody is forced to switch from IPFW to IPF or PF. They can continue to use IPFW.
It's much nicer to be able to continue to use the same packet filter across minor *and* major versions of an OS. It's also nice to have a choice of two or three packet filters.
I'll definitely stick to BSD for packet filtering. Linux is nothing more than a toy.
No shit. Screw me for not knowing what PF is, but it's just common sense to provide some length of explaination of your subject. I'm scared to click on any of the links for fear that the posted text is just a copy/paste from another source.
Futile, really, to see this complaint come up so many times and realise that the editors really don't give a shit, or at least don't care to offer a rebutle. I realize it's not the most professional approach to post stories relating to how badly they post stories. But I'm guessing their image isn't helped by all of these legitimized complaints. How much longer can they take themselves seriously?
The same can be stated in financial terms. Yes, as "editors" you're all mostly very lame (except that last book review was excellent!), but I do still come here on a semi-daily basis to dig through the threads. However, Moz/Phirebird/foo are set to block images from this server. Our university proxy has even been set to do the same. I'm even starting to get a bad taste in my mouth for people who advertise here.
The biggest trolls here are the editors.
I'm against picketing, but I don't know how to show it.
FreeBSD, up to now, has had two different firewalling methods. First off, there is the natively developed ipfw tool, which recently got a renovation and is now ipfw2 in -CURRENT. The alternative to ipfw is Darren Reed's ipfilter, also known as just ipf. Both ipfw and ipfilter share similar capabilities, and it is generally user preference as to which one is used in FreeBSD.
Now, it seems somebody has made the effort to port yet another firewalling mechanism to FreeBSD, this time pf. The features it claims to have over ipfw are:
Presumably, some of these are rather desirable features. However, it is beyond me why FreeBSD needs yet another way to do firewalling when the interfaces and systems we have now already work well. It is my opinion that instead of porting something proprietary to OpenBSD like pf, time should have been spent either patching these features into ipfilter or ipfw to add functionality to an already accepted and loved firewalling mechanism. There is no reason FreeBSD needs to dig a deeper firewalling grave for itself like OpenBSD has done.
Beware, Nugget is watching... See?
every post in this thread (except this one) explains what it is
/. whiners ;)
who needs google when we've got
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
What's your beef with Linux's filters? I've found iptables to be really nice -- much better than ipchains (never used ipfwadm).
I just installed NetBSD for the first time (on VMWare on my Redhat box), so I guess I'll get a chance to see first-hand the *BSD side of packet filtering. Maybe I'll have a different opinion of iptabels in a couple of months.
Method of processing duck feet
Gee, I knew there was a reason I should have taken Prescience 101. Then I could read Slashdot posts before they're written!!
compeltely incompatible packet filter
In FreeBSD, there's IPFW *or* IPFilter *or* Packet Filter
In Linux, each program is backwards compatible with the previous major kernels. You can run ipchains and it's modules on linux 2.4, even though 2.4 uses iptables and so forth.
Can you run freebsd 3.x software on freebsd 4.x?
Yes. You can even remove that support if you don't want a bloated kernel. You can 3.x software on 5.0x as well.
Therefore:
You have no argument, as all major operating systems support backwards compatibility in one form or another. Programmers don't just break interfaces at their whim (unless they submit Linux patches). In fact, I would go as far to say that FreeBSD is more backwards compatible than many other operating systems: FreeBSD can run Linux executables.
"The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
I never started this as a war between Linux and FreeBSD. I can see you are strongly biased one way. But my point is FreeBSD and Linux combined make for 6 different packet filtering tools. This does not help network administrators. The reason why
Of you still have a lot against Linux, well just take FreeBSD then. I hope we can use pf 7 years from now.
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
PF means more choice and its not like it takes that much more space in the distribution
Also means I will have to port my "ROQ" script to it as well so people can easily set it up on FreeBSD 5.1 go to http://www.roq.com/bsd/ and you will see what I mean
The reason why :q! command in vi still works is because it was standardized in UNIX a long time ago and never changed.
:)) on your computer along with vi does not change :q!. This is the same.
Having Emacs (yuck!
For Linux, it was closer to going from vi to ee to emacs for the base editor.
The syntax for ipchains / iptables is just horrible. It doesn't read anything close to English. The nice thing about IPFW / IPF / PF is that you can read a rule and udnerstand exactly what it is designed to do. I have yet to be find someone who can look at a NAT rule in IPTables and tell me exactly what it does without resorting to scrounging through manuals.
The beauty of IPFW (or IPF or PF) is that the syntax hasn't changed all that much, even though new features have been added. The syntax for the Linux packet filter has changed 3 times in 3 releases.
The other horrible thing about Linux packet filtering is that it only *just* got NAT figured out. Only took them 3 releases (and how many years??) to get that one. IPFW / IPF / PF have had that for several years now.
I administer 12 FreeBSD IPFW firewalls, and 11 Linux IPChains firewalls. Can't wait until the summer when I can move those Linux boxes to FreeBSD with either IPFW or IPF. One less headache to worry about.
Actually, your analogy is off.
If Linux-land, the analogy is: 2.0 had vi and all was well. 2.2 removed vi and added emacs. 2.4 removed emacs and added pico. Three kernel releases, three new editors to learn. Sure, each editor includes a very rudimentary command emulator for the previous editors, but nobody can use them for real work.
In BSD-land, the analogy is: vi was added. A few releases later, emacs was added as an option. A few releases later, pico was added as an option. Users have the choice of using any of the three editors, as they please.
Notice the difference??
There are 4 packet filters to choose from: IPFW, IPF, PF, and whichever filter your Linux kernel uses. At least in BSD-land, you don't have to throw away your prior knowledge when a new OS release is made.
I could say the same thing for perl, but I'd have a hard time coming down as hard on it as you have on iptables. However, it's all I've ever known in the world of filtering (except for Cisco's and AIX's filter rules). I guess syntax is a matter of taste and what we're comfortable with.
The other horrible thing about Linux packet filtering is that it only *just* got NAT figured out. Only took them 3 releases (and how many years??) to get that one. IPFW / IPF / PF have had that for several years now.
Ah, now a technical reason. Didn't ipchains have NAT, or is masqerading a totally different conecpt? I used to have multiple clients routing via an ipchains box when I had broadband.
Since you've obviously run both side by side, can you comment on the speed of both? There's measurable overhead when enabling iptables (crude tests on low-end hadware, but I was able to clock a difference in load). Is the same true for the *BSDs?
Method of processing duck feet
(not OP)
I could say the same thing for perl, but I'd have a hard time coming down as hard on it as you have on iptables.
Perl does many things, scripting languages with similar power have similar learning curves.
iptables does few, all of which can be done with pf with much less effort.
From an9420@anon.penet.fi Sat Oct 9 13:37:06 EET 1993
this was an anonymous post, i dont even remember where i found it. it will, however, be expanded on whenever i find the time for it. in the mean time, thanks to Theoderich and too all of you, have fun.
decayed kisses,
the pink and purple
tinsel fairy of love
and necrophilia
NECROPHILIA
by Theoderich
I: Introduction
Very few text files have been written regarding the sexual tendencies and practices of necrophiliacs. While most people would prefer to believe that we do not exist we most certainly do as is obvious to anyone who visits a cemetery during our nightly rampages.
Necrophiliacs prefer to go about their business alone; sharing is not a part of this alternative lifestyle as the corpse usually wears out fairly quickly. This is not to say that the occasional orgy involving four or five necrophiliacs and about a dozen or so corpses does not occur, but it is very rare. In this file I will describe common (and some uncommon) techniques which necrophiliacs use to gain satisfaction from their stiff partners. Hopefully these vivid descriptions will encourage you to go out to your local cemetery and to join our ranks!
II: Finding a partner
Finding a partner for your necrophiliac activities is definitely the hardest part. You not only have to gain access to the corpse but you also have to find one which suits your tastes. Granted, some
necrophiliacs would screw roadkill if given the chance but most of us are more discriminating. Your chances depend upon where you pick up your date. If you have access to a morgue it would definitely be your best bet as the corpses there are usually the freshest and have not yet been treated for burial. They may be a bit chilly because they've been lying in the meat locker for days but that really shouldn't make a big difference to the determined necrophiliac. Cemeteries are a bit harder to deal with as finding a screwable corpse is harder to do.However, if you know how to interpret signs this shouldn't be a problem.
If a grave consists of a mound of fresh dirt and is covered with flowers,chances are that the stiff hasn't been laying here for too long. Rotting flowers on the mound usually hint to the state of the corpse as well.
Some people are exclusively into 'porking the bone', i.e. sex with skeletons. In this case you can dig up almost any grave and hope that the inhabitant hasn't yet disintegrated into dust. Try to scope out a fairly secluded cemetery for your passions unless you like a sense of danger to go along with the sex. Having anyone catch you in the act is NOT fun, and if you're picked up by a cop chances are that you won't be able to screw anything but Bubba behind bars for the next few decades.
People are generally not understanding of the necrophiliac lifestyle, so it will probably be a long time before we can come out of the closet.
III: Preparation
Depending upon where you are at this point you'll have either a little or a lot of work to do. The person in the morgue will obviously have to do little more than to open the locker, pull the corpse out and bang away. If you're one of the cemetery people you'll have more work to do. An experienced necrophiliac is always equipped with the bare essentials: a shovel, vaseline and a box of rubbers. Why the shovel is needed should be obvious, but if the ground is hard then you might need more equipment to dig up your date. Vaseline is used to loosen the corpse up a bit. This makes it less likely for a body part to break off while
you're having fun and it also prevents your mantool from becoming too irritated while screwing the dried out pussy. The BOX of condoms is used to play it safe; no necrophiliac should be without it. You never know which STDs your partner had during his/her lifetime, and believe me, it doesn't get any better after the person dies. You can put on more than one rubber for extra protection if it is warranted, but screwing a corpse without
IPChains had masquerading, where all outgoing packets were given a single source IP, thus allowing for a LAN of computers to appear as one. However, it didn't do NAT in that you couldn't have multiple external IPs for that same LAN, and you couldn't NAT incoming traffic to create a DMZ with each computer having it's own (or sharing a couple) or public IP addresses. There were a few other NAT situations that couldn't be done using Linux packet filters.
IPTables was the first to support NAT, incoming, outgoing, and all combinations. However, the syntax for it is horrible (IMO).
As for speed, IPFilter and PF are the speed champs when NAT and/or stateful filtering is used. All packet filtering for these is done in-kernel and is optimised out the yin-yang. IPFW is just as fast as these two for simple packet filtering, but is a little slower when stateful filtering is enabled. And, because the natd daemon works in userland, enabling NAT really slows things down, due all the context switching and copying of data from kernel to userland. However, IPFW/NATd is plenty fast enough for most situation (small to medium LANs numbering into the hundreds). For enterprise-wide filtering (thousands of clients) you definitely want to use IPF or PF.
Personally, I just don't like the syntax of IPChains and IPTables. I also don't like the lack of features, or the fact that everything changes with each new kernel release.