I'm wondering if references referring to pf
in FreeBSD are applicable to ipfw
in Mac OS X Snow Leopard? I'd like to know to see if it's worthwhile to consult books on pf
for use with Mac OS.
1 Answer
ipfw is like as ipfw on freebsd. :)
ipfw and pf are totally different packet filtering systems. ipfw is the old BSD (Internet Protocol Firewall), and pf (packet filter) comes from the OpenBSD.
pf is much much more powerful as ipfw. In fact, pf
is much more powerful as anything other. Here is too much differences, but the main "philosophical one" is:
- In IPFW, the first rule in a ruleset what matches a packet "wins" - and next rulesets are not evaluated
- In the PF the packet is matched with all rules and the last rule that matches the packet "wins".
You should consult books, manuals about the "ipfw", not pf.
Btw, here are two nice free applications: NoobProof and WaterRoof - both are helpers for the OSX's ipfw. http://www.hanynet.com/noobproof/
-
-
PF is an totally different subsystem. PF has integrated NAT, QoS and much more. With ipfw for these must install additional packages, what isn't a big deal, but it is always good, having all packet-things on one consistent place. PF rulesets are shorter and more powerful. PF is generally faster than IPFW. Here are zilion small things what causes than using PF is more pleasant as IPFW. (e.g. pfsync with witch you can sync multiple firewalls an much more.) But don't understand me wrong: IPFW is an excellent packet filter. Simply, the PF is in another league. (Stačí? :-) - no chars left).– clt60Jun 9, 2011 at 11:57
-
1Díky :-) I was mostly curious about difference of "first rule wins" vs "last rule wins". I read your answer as if this was big difference, but I didn't understand why it would be. Now I see you prefer PF due to other things, not just rule evaluation. Thanks. Jun 9, 2011 at 12:34
-
Ahh, understand. That has advantage too. Imagine: in PF the default state is "deny everything". So, you're secure. And you with the next rules step-by-step allowing passing some packets. In contrast in IPFW, the default state is open and the "deny everything is usually the last rule". It is ok too, but it is easier make a mistake and a bit harder to configure.– clt60Jun 9, 2011 at 13:29
-
@Peter - Thanks for your detailed replies! Is it possible to run pf on Mac OS X 10.6.7 ? Jun 10, 2011 at 13:36