RE: latest firewall tools for linux

["Oxenreider, Jeff" <jox () safelite com>]

Correct me if I'm wrong, but I believe the newer Linux kernels have support
for "Stateful Inspection".  Isn't that the same thing that you're talking
about here?



Jeffrey A. Oxenreider
Network Security Analyst
Safelite Glass Corp



-----Original Message-----
From: Roelof JT Jonkman [mailto:rjonkman () ittc ukans edu]
Sent: Tuesday, May 16, 2000 4:36 PM
To: Mark Drummond
Cc: firewall-wizards () nfr net
Subject: Re: [fw-wiz] latest firewall tools for linux 


Hello,

Just for clarification I guess, but OpenBSD uses Darren Reed's Ipfilter
package
which maintains tcp state, and therefore allows you to deny certain things 
pending on the state of the tcp connection. Whereas stock linux with
ipchains
is a packetfilter, and it doesn't quite allow you to deny exactly
everything.
So in some ways the statement 'openbsd ... happier' may fly in this case, 
although it should probably be 'ipfilter .. happier' ;-)

roel
PS. I recently switched from a bridging/hacked linux firewall to an almost
stock
    openbsd box with the same functionality + some.