Re: [fw-wiz] Rationale for BSD (I)PF rule order?

From: Henning Brauer (hostmaster_at_bsws.de)
Date: 05/09/03

  • Next message: Javier Sanchez: "Re: [fw-wiz] Free Firewalls? Thoughts..."
    To: firewall-wizards@honor.icsalabs.com
    Date: Fri, 9 May 2003 01:10:17 +0200
    

    On Thu, May 08, 2003 at 01:37:54PM -0400, Barney Wolff wrote:
    > On Thu, May 08, 2003 at 02:59:39PM +0200, Volker Tanger wrote:
    > >
    > > I was not able to find a rationale for the BSD type of packet filter
    > > application. Where most FW/ACL implementations follow "first match", BSD
    > > usually takes "last match" (if you don't use the "quick" method).
    > >
    > > Is there a reason why that was decided this way? Especially as I
    > > currently cannot see advantages for this behaviour, only performance
    > > disadvantages. Can someone enlighten me here?
    >
    > I can't supply a rationale for last-match, but note that ipfw is first
    > match, not last.

    actually, it's a matter of taste. you can play some games with lasty
    match that are close to impossible, but I'd rather see it this way: pf
    supports both ways, 1st match and last match ;-)

    -- 
    Henning Brauer, BS Web Services, http://bsws.de
    hb@bsws.de - henning@openbsd.org
    Unix is very simple, but it takes a genius to understand the simplicity.
    (Dennis Ritchie)
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    

  • Next message: Javier Sanchez: "Re: [fw-wiz] Free Firewalls? Thoughts..."

    Relevant Pages

    • Re: Genealogical Momentum
      ... >> difference between logic and reason. ... It is logically valid to reverse ... this is all mathematics can do. ... In the sciences this rationale ...
      (sci.bio.evolution)
    • Re: Chris
      ... Having or exercising the ability to reason. ... You might be more successful in persuading someone to agree with your political positions if you posited the *rationale" for your position instead of insisting that democrats and liberals are irrational. ...
      (rec.outdoors.rv-travel)
    • Re: Genealogical Momentum
      ... difference between logic and reason. ... It is logically valid to reverse ... The mathematics of Hamilton's Rule requires a rationale ...
      (sci.bio.evolution)
    • Re: Scottish Catholic priests letter condemns gay marriage
      ... rational reason. ... I ma saying that there are no rational grounds for making the change and that requiring a rational argument for opposing it is ridiculous partly for that reason and partly because the whole issue is not one of rationale. ... as "stating a contrary opinion to gay rights". ...
      (uk.religion.christian)
    • Re: 407 Why will there be more women in Hell than men? 407
      ... Prophet Muhammad -- any report that is in harmony of the rationale of ... Also, when the Quran is read, rationality must be employed completely. ... So yes, some verses make plain universal principles, some verses are ... If only we had listened or used reason, ...
      (soc.religion.islam)