[rescue] RFA: firewall

[Jonathan C. Patschke]

On Thu, 6 Jan 2005, Phil Stracchino wrote:

> The hardware: Ultra5, USIIi/333, 256M, 9.1G, three 10/100 interfaces

This is what I'm upgrading to at home, but with less memory.

For reference, my current firewall/NAT/gateway is a SPARCclassic with
24MB of memory and an BigMac Ethernet card.  It works.  For talking to
the outside world via cable-modem, it's plenty fast enough--just don't
try to log in with ssh v2. :)

> - OpenBSD and PF?

I use OpenBSD.  If you're going to use OpenBSD, consider getting another
fxp card for your third interface.  The OpenBSD driver for hme does not
perform well under a load.  I can get -maybe- 15Mb/s on a 100Mb/s link
(yes, my speed/duplex agree on both ends and my cable is good).  With an
fxp in the same machine, I get about 80Mb/s.

Obviously if you're using this for an uplink to a WAN that's slower than
10baseT, this is not a problem.

> What's your recommendations, and why?

I like OpenBSD.  It's a small distribution.  The attitudes of the team,
though abrasive at times, are very security-conscious.  pf is very easy
to understand, even as your configuration grows in complexity.

Also, a nice thing about OpenBSD is that it's been doing IPsec forever,
so if you need a tunnel later, the software's all right there, and it's
well-integrated into the OS instead of being an afterthought, and it's
not a complete PITA like FreeSWAN.

You can't knock the ports, either.  Installing something like squid from
the ports Just Works, and is a nice addition to a gateway/firewall.  I
should point out that my SPARCclassic is doing this, as well.  It's
unhappy, and it swaps a lot, but it's plenty usable.  OpenBSD has a
very slim footprint for being such a featureful operating system.

-- 
Jonathan Patschke ) "I've built my whole system with [-fomit-frame-pointer]
Elgin, TX        (  cause it was recommended...as I don't care if a program
USA               ) crashes, not interested in finding out why."
                  (                    --Tim, Another Satisfied Gentoo User