Packet Filtering

[Robert Swindells <rjs%fdy2.co.uk@localhost>]

What is the recommended way of doing packet filtering in
NetBSD-current ?

I have tried IPF, PF and NPF, and can't get any of them to work
properly.

I just want to run NAT on IPv4 and to block everything except a small
list of ports from outside on both IPv4 and IPv6, I can't believe this
is all that unusual.

I have native IPv6, so both protocols are using the same external
interface if that makes a difference.

IPF seemed to work ok until the update to 5.1.1. After this I was
unable to get IPv6 to work while still blocking most IPv4 ports.

PF allows traffic from outside to connect to sshd, even though I have
not opened up that port. It also randomly hangs up connections and
generates "in_cksum: out of data" errors on the firewall machine,
Google seems to cause this the most often.

NPF generates a core dump if I run "npfctl show" and locks up
completely afterwards.

Robert Swindells