Re: Why not have firewall rules by default?

On Wed, 23 Jan 2008, Rolf Kutz wrote:
> On 23/01/08 08:29 -0700, Michael Loftis wrote:
>> It's better to leave the service disabled, or even better, completely
>> uninstalled from a security standpoint, and from a DoS standpoint as
>> well. The Linux kernel isn't very efficient at processing firewall
>> rules. Newer
>
> I thought it was very efficient in doing so. YMMV.

Quite the contrary. It is *dog* *slow* for non-trivial firewalls. You have to use a number of tricks to optimize the rule walk (many tables, hashing, etc), and anything that reduces the number of rules (like IPSet) is a major performance bonus.

Or you can rip the standard netfilter firewall out, and install a high-performance one (such as HiPAC), but those are mostly unmaintained these days, and have a lot less features than the standard one.

You need to be doing some *heavy* firewalling (many rules) for any of that to really matter, and on very fast links (gigabit) because nobody will notice the firewall's speed on something as a 10Mbit/s link...

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh


-- 
To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org