Re: OpenBSD Firewalls

["S9" <km@themcminns.com>]

> my rules are becoming very complex and I am afraid
> of start making mistakes because of the complexity
> of my rules.

how complex? Even in large deployment scenarios,
I've found ways to keep firewalls manageable
one way or another by using preset interface
security levels (a Cisco PIXish notion). Implementing
it in pf is just a matter of default block statements.
Basic idea being that the interfaces with the highest
security levels by default have complete access
to lower security interfaces (such as a dmz),
but the dmz has zero access directly to the higher
security interface.

IMO, its too much of a security hole to have a
gui to manage your pf.conf.


-Karsten