Re: Future of pf / firewall in FreeBSD ? - does it have one ?

I would like to see an updated version of pf. I realize its a big job to
port it though


On 17 July 2014 00:12, Kristian K. Nielsen <freebsd_at_com.jkkn.dk> wrote:

> Hi all,
>
> I have been encouraged by people on the pf-mailinglist to move this
> discussion to the current mailinglist since this may be an area in the OS
> where FreeBSD need to focus on next.
>
> First of all I am a happy user of the pf-firewall module and have been for
> years and think it is really great - the trouble is that lately (since
> 2008) its getting a bit dusty.
>
> The last few years it seem that pf in FreeBSD got a long way away from pf
> in OpenBSD where it originated
> - also looking at the ipfilter (ipf) and ipfw - they both to me do not
> seem to be as complete as pf.
>
> So I am curious if any on the mailing could elaborate about what the
> future of pf in FreeBSD is or should be.
>
> a) First of all - are any actively developing pf in FreeBSD?
>
> b) We are a major release away from OpenBSD (5.6 coming soon) - is
> following OpenBSD's pf the past? - should it be?
>
> c) We never got the new syntax from OpenBSD 4.7's pf - at the time a long
> discussion on the pf-mailing list flamed the new syntax saying it would
> cause FreeBSD administrators too much headache. Today on the list it seems
> everyone wants it - so would we rather stay on a dead branch than keep up
> with the main stream?
>
> d) Anyone working on bringing FreeBSD up to pf 5.6? - seem dead on the
> pf-list.
>
> e) OpenBSD is retiring ALTQ entirely - any thoughts on that?
> http://undeadly.org/cgi?action=article&sid=20140419151959
>
> f) IPv6 support?- it seem to be more and more challenged in the current
> version of pf in FreeBSD and I am (as well as others) introducing more and
> more IPv6 in networks.
> E.x. Bugs #179392, #172648, #130381, #127920 and more seriously #124933,
> which is the bug on not handling IPv6 fragments which have been open since
> 2008 and where the workaround is necessity to leave an completely open hole
> in your firewall ruleset to allow all fragments. According to comment in
> the bug, this have been long gone in OpenBSD.
>
> g) Performance, can we live with pf-performance that compared to OpenBSD
> is slower by a factor of 3 or 4, even after the multi-core support in
> FreeBSD 10?
> (Henning Brauer noted that in this talk at http://tech.yandex.ru/events/
> yagosti/ruBSD/talks/1488/ (at 33:18 and 36:53)) - credit/Jim Thompson
>
> h) Bringing back patches from pfSense?
>
> And my most important question:
>
> * Should this or could this be a project for the foundation to either do a
> summer project or funded project to bring this part of the OS up to date?
>
>
> Hope to heard from you all,
>
> Best regards,
>
> Kristian Kræmmer Nielsen,
> Odense, Denmark
>
> _______________________________________________
> freebsd-questions_at_freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions-
> unsubscribe_at_freebsd.org"
>