FreeBSD - Good firewall?

[VisionIT]

I've just finished downloading the new FreeBSD release from the trusty linuxiso.org... and wondered if anyone had used a strong firewall with it?

Any ideas?

Ta.

[parksie]

*whispers OpenBSD down your ear*

[VisionIT]

Could you repeat that... I didn't quite catch it!

Why OpenBSD? Why is it better?

[parksie]

Single-file config for all the packet filtering, and scrubbing/seq rewriting to guard against attacks aimed at internal machines, which I've not seen in any other filter yet (some of the hardware ones might have it, though, but you're looking at PIX-level stuff).

And the fact that it's bloody easy to use, I mean:

external = "rl1"
services = "{ http, ftp, ident, 12345 }"
# Allow incoming services
pass in quick on $external inet proto tcp from any to any port $services flags S/SA keep state

# normal traffic
pass out quick on $external from any to any flags S/SA keep state

# finish block
block in log quick

...and so on The new version in 3.4 can do passive fingerprinting (i.e. see what OS is connecting to you), and there's been queueing/priority support in since 3.3).

[VisionIT]

Sweeeet!

It's just basic scripting really, judging by that!

Thanx Parksie! * I wondered where you'de gone to! *