On 5/23/14, 3:04 AM, Dr Josef Karthauser wrote:
> On 23 May 2014, at 10:00, G. Paul Ziemba <pz-freebsd-stable@ziemba.us> wrote:
>
>> Lucius.Rizzo@The.ie (Lucius Rizzo) writes:
>>
>>> Ultimately, outside configuration differences all firewalls are essentially
>>> serve the same purpose but I wonder what is your favorite and why? If
>>> you were to run FreeBSD in production, which of the three would you
>>> choose? IPFilter, PF or IPFW?
>> I switched to pf about seven months ago as I began to need to
>> manage bandwidth for specific classes of traffic (for example,
>> prevent outbound mailing list email from saturating the link
>> and reserve some bandwidth for interactive use).
>>
>> The syntax is very close and the NAT configuration is simpler in pf.
> Does the pfsync handle NAT tables.
> Could I use it to build a resilient carrier grade NAT solution?
>
Yes, pfsync includes NAT. While we don't use NAT in the freebsd.org
cluster, we do use it on certain ipv6+rfc1918 machines and it does
handle failover / recovery transparently. We use it with carp.
Be aware that things can get a little twitchy if your switches have an
extended link-up periods. Our Juniper EX switches and ethernet
interfaces have a significant delay between 'ifconfig up' and link
established. This required some tweaks on the freebsd.org cluster but
nothing unmanageable. We probably should boot them into a hold-down
state while things stabilize and but we've taken the quick way out
rather than doing it the ideal way.
-Peter
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"