It's very close to set-it-and-forget-it. A buddy of mine is an overworked (and underpaid) sysadmin for a small ISP, and commented the other day that the OpenBS

It's very close to set-it-and-forget-it. A buddy of mine is an overworked (and underpaid) sysadmin for a small ISP, and commented the other day that the OpenBSD firewall that I built for them 7 years ago (!) is still humming along nicely, they're still using and tuning its rulesets, and it wasn't vulnerable to shellshock. (This isn't to say that not updating a firewall for 7 years is good practice, obviously. I shouldn't have to say that, but HN.)