Subject: Re: IPF 4.1.20
To: None <firstname.lastname@example.org>
From: Miles Nordin <carton@Ivy.NET>
Date: 05/08/2007 21:43:00
Content-Type: text/plain; charset=US-ASCII
>>>>> "hf" == Hauke Fath <hauke@Espresso.Rhein-Neckar.DE> writes:
hf> (a) pf keeps state per-interface
set state-policy if-bound
set state-policy floating
in the options section controls whether or not packets will match
state that was created on interfaces other than the one on which
they're being sent/received.
hf> You could probably work around that by extensive
hf> use of macros, but I find that inflates the namespace and
hf> rather obscures the rule base.
I find it doesn't. All pf.conf's make extensive use of macros and
syntactic sugar, and it's tremendously more readable and less
mistake-prone. seriously. I have a couple hundred rules and like
thirty HFSC queues. The macros are good.
hf> (b), my current ruleset relies heavily on (per-interface)
hf> groups, for structuring the ruleset more than performance, and
hf> pf does not support groups.
yeah, I felt there were missing verbs, like 'block commit' meaning,
``if the packet is marked for blocking at this point in marching
through the ruleset, block it right now as if 'block quick'. If the
packet's marked for passing, proceed on through the ruleset.'' and
then a 'pass commit' to go with it.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (NetBSD)
-----END PGP SIGNATURE-----