tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: NPF and PF

On Thu, Dec 17, 2020 at 03:53:33PM +0000, Robert Swindells wrote:
> Manuel Bouyer <> wrote:
> >On Wed, Dec 16, 2020 at 05:45:36PM +0000, Robert Swindells wrote:
> >> 
> >> Manuel Bouyer <> wrote:
> >> >On Wed, Dec 16, 2020 at 04:07:54PM +0100, Hauke Fath wrote:
> >> >> [...]
> >> >> IMHO, the NetBSD packet filter supports SOHO installations at best; 
> >> >> anything else is misleading.
> >> >
> >> >Even at home, I stay with ipf for multihomed routers.
> >> >npf just lacks the features I use (as I already explained several times).
> >> 
> >> Prompted by today's thread I looked back at recent firewall discussions.
> >> 
> >> I don't see enough of a description of what you want to do to be able
> >> to work on fixing your problem.
> >
> >My first mail on this topic was 26 Oct 2012 on tech-net@
> >I then did send a more complete example 21 Aug 2018, as a followup to a
> >mail from you on developers@ (you were in Cc).
> >I dind't get any follow up.
> By "what you want to do" I guess I'm really looking for an even higher
> level description of where you want firewall operations to get done.

first filter input packets based on source address
(default: block all).
Then, if not blocked above, filter based on destination address
(default: block all too)

> Are you trying to isolate Xen VMs from each other or just protect them
> from the outside ?

both. But I have similar configs on routers, this is not specific to Xen

> You write that you have BRIDGE_IPF enabled, presumably you add some
> interfaces to a bridge, knowing which ones would be a help in
> understanding your configuration.

the domU's interface (from the dom0 view) are bridged with real
interfaces (or vlan(4) in my case). But really, it doesn't matter.
On my routers I have a similar setup and no bridge involved.
The problem is really to have a packet go through several rulesets,
where a ruleset could decide to block the packet, or let it pass to
the next one.

Manuel Bouyer <>
     NetBSD: 26 ans d'experience feront toujours la difference

Home | Main Index | Thread Index | Old Index