4 ms·
do you have some concrete examples? i have used pf since it was turned on in openbsd (i think around 2001ish) for simple rulesets, and there were certainly som
by minusf 5y ago
do you have some concrete examples? i have used pf since it was turned on in openbsd (i think around 2001ish) for simple rulesets, and there were certainly some changes that needed config file changes but i don't remember anything hugely painful, actually the changes were for the better.
When they happened, they were always well documented in the "how to upgrade" document and blindly upgrading without reading that is not good practice in any OS, not just openbsd... Then it's just a question of automating it, and there are ways to roll back pf rules with simple scripting...
Regarding the book, they are bound to go out of date, but I think their basic premise stays useful over time: it explains the basic terminology, notions, etc and gives some ideas about how to solve problems with the syntax at the time of writing. The man page can fill in the rest (which is excellent quality).
How many linux books got out of date covering linux firewalling? what is the firewall cli/rules language du jour at the moment? There's one for every finger on my hand...
- LukeShu 5y ago> How many linux books got out of date covering linux firewalling? what is the firewall cli/rules language du jour at the moment? There's one for every finger on my hand... I'd argue that it's iptables, and has been for the last 20 years. In Linux 1.1 (1994) there was a port of FreeBSD's ipfw. ipfw was replaced by ipchains in Linux 2.2 (1999). However, ipchains was quickly replaced by iptables in Linux 2.4 (2001). And now since Linux 3.13 (2014) iptables is slowly being replaced by nftables, but most of its use is the iptables userland being ported to use the nftables kernel interface; the nftables native userland (`nft`) only just hit 1.0.0 this month. Other higher level "more user friendly" wrappers have come and gone; Ubuntu's ufw (which wraps iptables), RedHat's firewalld (which wraps nftables), and uh one for each finger of my hand. But at the end of the day, they're iptables/nftables under the hood, and when you want to configure things they way you would with pf, you skip those layers and go straight for iptables.
- tyingq 5y agoAt least they all had distinct names, so it was easier to know if some random article, book, etc, was applicable.
- LukeShu 5y agoTruth! I just love having to guess if a given page is about macOS's flavor of pf, FreeBSD's, or OpenBSD's.
- throwawayboise 5y agoIMO once you start down the ufw or firewalld path, managing iptables directly is off the table. Do one or the other if you want to stay sane.