On Oct 23, 2010, at 12:33 PM, Jean-Francois wrote:

quoted text
> Le Wednesday 22 September 2010 21:29:31, Rikky Taylor a icrit :
>> I was after some general advice. I need to setup a routing firewall with 3
>> interfaces, moderate traffic and a fair amount of NAT'ing in the rules.
>>
>> Given identical modern server hardware would I expect a performance
>> difference between an OpenBSD/PF setup and a Linux/IPTables one?
>>
>> Rikky
>
> Hello,
>
> The question mentioned before is right, a little more description is
helping
quoted text
> regarding your infrastructure.
>
> I'm loving OpenBSD as firewall, it performs well enough and is secure by
> default, so if you get rules right, you have very quickly something very
good
quoted text
> for an affordable effort.
>
> Most importantly, you have a very well documented firewall through man
pages
quoted text
> and faq, therefore a very small probability of human error, the ever
> persisting root of imperfection if I could say.

I agree with all of that.

Who cares how fast your firewall is if it's compromised?  This is not to say
PF/OpenBSD is slow, but my point is who wants a Ferrari that blows up
unexpectedly when you can have a perfectly reasonable car that never blows
up?

Security has many facets, but the two I deem most important are: How safe is
something from external control and how likely am I to fuck it up allowing
someone to take advantage of my system?  I can't do much about the former,
except to trust people who are smarter than me and have more experience than
I, and the latter I can only select that which I believe I won't fuck up.

The difference between PF maintenance and IPTables maintenance, in my
experience, is significant.  PF can seem a little harder at first, because it
requires a little bit of thought (at least that's how I felt grokking the new
PF match rules.  In the beginning of my PF experience, it was trivial to move
from ipf to pf.).  But once you get it, it's a richer toolset of options.
IPTables is just a freakin' huge, long blithering list of chained crap.  It
drives me nuts messing with consumer firewalls that run IPTables.  Writing PF
rules is like telling someone "go to the store and get milk", and you might
have to explain that once.  Writing IPTables rules is like telling someone
"stand up".  Then "Walk to door".  Then "Open door".  Keep going until you get
to "put milk in fridge".  Oh, you might need to explain how to walk, too.

Sean