Slashdot Mirror
New PF on FreeBSD snapshot available
Dan writes "Pyun YongHyeon and Max Laier announce a new release of PF for FreeBSD, which is available for download. Since the first release of PF at the end of March 2003, PF has undergone several major updates such as -current and ALTQ support. They have also removed bugs in IPv6, module handling and table support code and believe the current version 0.61 is very close to production use."
PF is short for 'packet filter', and it's the native firewall code for OpenBSD. Here's the man page for the config file.
;-)
PF is fairly new compared to IPFW and IPFilter, but it has reapidly been gaining advanced features and capabilities. Porting it to other operating systems is a good thing IMO - the more competition in this field, the better
"The purpose of argument is to change the nature of truth." -- Bene Gesserit Precept
It might be helpful to provide rudimentary information like this in the slashdot articles.
Actually, this is nothing like in Linux. In Linux-land, each new kernel brought out a brand-new, almost compeltely incompatible packet filter. ipfwadm, ipchains, iptables. The syntax changed. The features changed. There was no way to use the old filter. There were wrapper scripts to try and simulate this, but they are crud. Heck, the packet filters themselves are crud.
In FreeBSD, there's IPFW *or* IPFilter *or* Packet Filter. IPFW has been around a long time, and the syntax has changed very little. New features have been added, though, but all the old features still work. Same with IPF. Nobody is forced to switch from IPFW to IPF or PF. They can continue to use IPFW.
It's much nicer to be able to continue to use the same packet filter across minor *and* major versions of an OS. It's also nice to have a choice of two or three packet filters.
I'll definitely stick to BSD for packet filtering. Linux is nothing more than a toy.
FreeBSD, up to now, has had two different firewalling methods. First off, there is the natively developed ipfw tool, which recently got a renovation and is now ipfw2 in -CURRENT. The alternative to ipfw is Darren Reed's ipfilter, also known as just ipf. Both ipfw and ipfilter share similar capabilities, and it is generally user preference as to which one is used in FreeBSD.
Now, it seems somebody has made the effort to port yet another firewalling mechanism to FreeBSD, this time pf. The features it claims to have over ipfw are:
Presumably, some of these are rather desirable features. However, it is beyond me why FreeBSD needs yet another way to do firewalling when the interfaces and systems we have now already work well. It is my opinion that instead of porting something proprietary to OpenBSD like pf, time should have been spent either patching these features into ipfilter or ipfw to add functionality to an already accepted and loved firewalling mechanism. There is no reason FreeBSD needs to dig a deeper firewalling grave for itself like OpenBSD has done.
Beware, Nugget is watching... See?
every post in this thread (except this one) explains what it is
/. whiners ;)
who needs google when we've got
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
What's your beef with Linux's filters? I've found iptables to be really nice -- much better than ipchains (never used ipfwadm).
I just installed NetBSD for the first time (on VMWare on my Redhat box), so I guess I'll get a chance to see first-hand the *BSD side of packet filtering. Maybe I'll have a different opinion of iptabels in a couple of months.
Method of processing duck feet
Agreed. PF adds some very nice features that neither IPFW nor IPF have, and having ONE config file makes it simpler to manage. Anyone complaining that FreeBSD shouldn't have additional packet filters besides the defacto IPFW and the venerable IPF is doing the BSD community a disservice. If you don't want to use PF, don't use it; no need to complain. Freedom of choice is good.
Those that have used all three packet filters know that PF is where it's at. Looking forward to seeing it added to the ports tree very soon. If you're installing a new system or have a test node handy, do yourself a favor and give PF a try. You'll be pleasantly surprised.
As far as competition goes, as of now there is none. PF continues to improve drastically, while IPFW and IPF remain stale and stagnant (regarding new capabilities).
Therefore:
You have no argument, as all major operating systems support backwards compatibility in one form or another. Programmers don't just break interfaces at their whim (unless they submit Linux patches). In fact, I would go as far to say that FreeBSD is more backwards compatible than many other operating systems: FreeBSD can run Linux executables.
"The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
I never started this as a war between Linux and FreeBSD. I can see you are strongly biased one way. But my point is FreeBSD and Linux combined make for 6 different packet filtering tools. This does not help network administrators. The reason why
Of you still have a lot against Linux, well just take FreeBSD then. I hope we can use pf 7 years from now.
"Give orange me give eat orange me eat orange give me eat orange give me you." -Nim Chimpsky
PF means more choice and its not like it takes that much more space in the distribution
Also means I will have to port my "ROQ" script to it as well so people can easily set it up on FreeBSD 5.1 go to http://www.roq.com/bsd/ and you will see what I mean
The reason why :q! command in vi still works is because it was standardized in UNIX a long time ago and never changed.
:)) on your computer along with vi does not change :q!. This is the same.
Having Emacs (yuck!
For Linux, it was closer to going from vi to ee to emacs for the base editor.
The syntax for ipchains / iptables is just horrible. It doesn't read anything close to English. The nice thing about IPFW / IPF / PF is that you can read a rule and udnerstand exactly what it is designed to do. I have yet to be find someone who can look at a NAT rule in IPTables and tell me exactly what it does without resorting to scrounging through manuals.
The beauty of IPFW (or IPF or PF) is that the syntax hasn't changed all that much, even though new features have been added. The syntax for the Linux packet filter has changed 3 times in 3 releases.
The other horrible thing about Linux packet filtering is that it only *just* got NAT figured out. Only took them 3 releases (and how many years??) to get that one. IPFW / IPF / PF have had that for several years now.
I administer 12 FreeBSD IPFW firewalls, and 11 Linux IPChains firewalls. Can't wait until the summer when I can move those Linux boxes to FreeBSD with either IPFW or IPF. One less headache to worry about.
Actually, your analogy is off.
If Linux-land, the analogy is: 2.0 had vi and all was well. 2.2 removed vi and added emacs. 2.4 removed emacs and added pico. Three kernel releases, three new editors to learn. Sure, each editor includes a very rudimentary command emulator for the previous editors, but nobody can use them for real work.
In BSD-land, the analogy is: vi was added. A few releases later, emacs was added as an option. A few releases later, pico was added as an option. Users have the choice of using any of the three editors, as they please.
Notice the difference??
There are 4 packet filters to choose from: IPFW, IPF, PF, and whichever filter your Linux kernel uses. At least in BSD-land, you don't have to throw away your prior knowledge when a new OS release is made.
I could say the same thing for perl, but I'd have a hard time coming down as hard on it as you have on iptables. However, it's all I've ever known in the world of filtering (except for Cisco's and AIX's filter rules). I guess syntax is a matter of taste and what we're comfortable with.
The other horrible thing about Linux packet filtering is that it only *just* got NAT figured out. Only took them 3 releases (and how many years??) to get that one. IPFW / IPF / PF have had that for several years now.
Ah, now a technical reason. Didn't ipchains have NAT, or is masqerading a totally different conecpt? I used to have multiple clients routing via an ipchains box when I had broadband.
Since you've obviously run both side by side, can you comment on the speed of both? There's measurable overhead when enabling iptables (crude tests on low-end hadware, but I was able to clock a difference in load). Is the same true for the *BSDs?
Method of processing duck feet
IPChains had masquerading, where all outgoing packets were given a single source IP, thus allowing for a LAN of computers to appear as one. However, it didn't do NAT in that you couldn't have multiple external IPs for that same LAN, and you couldn't NAT incoming traffic to create a DMZ with each computer having it's own (or sharing a couple) or public IP addresses. There were a few other NAT situations that couldn't be done using Linux packet filters.
IPTables was the first to support NAT, incoming, outgoing, and all combinations. However, the syntax for it is horrible (IMO).
As for speed, IPFilter and PF are the speed champs when NAT and/or stateful filtering is used. All packet filtering for these is done in-kernel and is optimised out the yin-yang. IPFW is just as fast as these two for simple packet filtering, but is a little slower when stateful filtering is enabled. And, because the natd daemon works in userland, enabling NAT really slows things down, due all the context switching and copying of data from kernel to userland. However, IPFW/NATd is plenty fast enough for most situation (small to medium LANs numbering into the hundreds). For enterprise-wide filtering (thousands of clients) you definitely want to use IPF or PF.
Personally, I just don't like the syntax of IPChains and IPTables. I also don't like the lack of features, or the fact that everything changes with each new kernel release.