Re: OpenBSD Firewalls

[Saad Kadhi <bsdguy@docisland.org>]

On Tue, Oct 01, 2002 at 09:44:51PM -0700, S9 wrote:
> > my rules are becoming very complex and I am afraid
> > of start making mistakes because of the complexity
> > of my rules.
> 
> how complex? Even in large deployment scenarios,
> I've found ways to keep firewalls manageable
> one way or another by using preset interface
> security levels (a Cisco PIXish notion). Implementing
> it in pf is just a matter of default block statements.
> Basic idea being that the interfaces with the highest
> security levels by default have complete access
> to lower security interfaces (such as a dmz),
> but the dmz has zero access directly to the higher
> security interface.
I'm using this same concept. And It works well.

> IMO, its too much of a security hole to have a
> gui to manage your pf.conf.
Not necessarily. The GUI or a related process can push the rules to the firewall
via a secure channel such as ssh/scp. The last time I got a look at fwbuilder,
they were advising just that.

-- 
Saad Kadhi -- [saad@docisland.org] [bsdguy@docisland.org]
[pgp keyid: 35592A6D http://pgp.mit.edu]
[pgp fingerprint: BF7D D73E 1FCF 4B4F AF63  65EB 34F1 DBBF 3559 2A6D]
---
"Si ce que tu dis n'est ni beau, ni bon, ni vrai, alors tais-toi!"
							    - Socrate