Re: Firewalls - Ease of Use and Maintenance?

[Nick Hilliard <nick () foobar org>]

On 09/11/2011 12:22, Richard Kulawiec wrote:
> You will find it very difficult to beat pf on OpenBSD for efficiency,
> features, flexibility, robustness, and security.  Maintenance is very
> easy: edit a configuration file, reload, done.

There are several areas where pf falls down.  One is auto-synchronisation
from primary to backup firewall (not really a pf problem, but it's
important for production firewall systems).  Another is ipv6 fragments,
although this was mostly fixed in a commit on 20110329 (released in 5.0),
which unfortunately has not yet made its way to freebsd yet.  A third is
openbsd's poor ethernet hardware interrupt handling.  Again, this has
improved recently, but it's still lags seriously behind linux / freebsd.

Having said that, it's still my least disfavoured stateful packet filtering
system.

Nick