21–30 of 43 posts
Earlier quoted context omitted.
Those are some new and very very shallow books. There better one's from 90" and 80".
care to name a few such good oldies?
This one is my favorite.
What's everyone's experience with modern PF in production? Also, not to start a holy war, but what people think about modern PF vs nftables? I've only ever used nftables (and only in fairly simple scenarios) but I've always been curious about the PF side of the world.
It's slower than nftables.
Earlier quoted context omitted.
It's slower than nftables.
Not to ask anyone for free work but any write-up on this, I'd love to read.
I'd love something similarly scoped centered around nftables. Does anyone have a suggestion? I see No Starch has a Linux Firewall book, but it's from 2008 and is thus iptables-based.
Lot of admiration for no starch - your books are great !
Per Dr. Marshall Kirk McKusick (as announced in one of the recent BSD conferences), No Starch Press will be publishing the third edition of the Design and Implementation of the FreeBSD Operating System book sometime later this year.
Lot of admiration for no starch - your books are great !
I buy ebooks straight from publishers like Nostarch and Leanpub. (In fact, I have an older edition of this book). There are a few books that are sold directly by the authors too. All of them DRM-free. I actively avoid publishers and sellers who don't respect me as a consumer/reader. People need to start demanding better deals, or else we'll end up with monopolies that won't think twice about deleting books in your cu…
What's everyone's experience with modern PF in production? Also, not to start a holy war, but what people think about modern PF vs nftables? I've only ever used nftables (and only in fairly simple scenarios) but I've always been curious about the PF side of the world.
I tail the pflog0 interface in a tmux session so I can keep an eye on pass/block, and also keep a handy function in my .profile to make it easy to edit the ruleset and reload:
function pfedit {
vi /etc/pf.conf && \
pfctl -f /etc/pf.conf && \
{ c=`pfctl -s rules | wc -l | tr -d ' '`; printf 'loaded %s rules\n' "$c"; }
}
It's a great book, I used to have some edition of it and it helped me a lot professionally with setting up firewalls, load balancing, traffic shaping and more. I also had a book on Designing FreeBSD rootkits that was very educational. Unfortunately I've given away all my books for more minimalistic living where I am instead dependent on digital information. Not sure how to feel about it.
What's everyone's experience with modern PF in production? Also, not to start a holy war, but what people think about modern PF vs nftables? I've only ever used nftables (and only in fairly simple scenarios) but I've always been curious about the PF side of the world.
This is one thing M$ gets right, in business environments you don’t do that. I wouldn’t use pf for anything outside a home lab.
What's everyone's experience with modern PF in production? Also, not to start a holy war, but what people think about modern PF vs nftables? I've only ever used nftables (and only in fairly simple scenarios) but I've always been curious about the PF side of the world.
pf rules work a little backwards compared to iptables. A packet traverses the entire ruleset and the last rule to match wins. You can short-circuit this with a "quick" directive. It takes a bit of getting used to coming from iptables.
The logging on pf doesn't integrate with syslog automatically like iptables does. You're expected to set up a logging system for your particular use case. There are several ways to do it, and for production you'd be doing it regardless, but for honelab setups it's an extra thing you need to worry about.
I prefer pf, but I don't recommend it to people new to firewalls.