Whole document tree


www.fifi.org
    Documentation
        Manpages
        GNU Info
        Debian document tree
        Whole document tree
    Trigance web page
    Public services
    User info
    Mailing lists
    Secure server
    Multilingual usage
 

Copyright (C) 2000-2012
Philippe Troin
<webmaster@fifi.org>.

Validate HTML
Validate CSS

    

Whole document tree

Why do the new 2.1.x and 2.2.x kernels use IPCHAINS instead of IPFWADM?
Linux IP Masquerade HOWTO
PrevChapter 7. Frequently Asked QuestionsNext

7.37. Why do the new 2.1.x and 2.2.x kernels use IPCHAINS instead of IPFWADM?

IPCHAINS supports the following features that IPFWADM doesn't:

  • "Quality of Service" (QoS support)

  • A TREE style chains system vs. LINEAR system like IPFWADM (Eg. this allows something like "if it is ppp0, jump to this chain (which contains its own difference set of rules)"

  • IPCHAINS is more flexible with configuration. For example, it has the "replace" command (in addition to "insert" and "add"). You can also negate rules (e.g. "discard any outbound packets that don't come from my registered IP" so that you aren't the source of spoofed attacks).

  • IPCHAINS can filter any IP protocol explicitly, not just TCP, UDP, ICMP

PrevHomeNext
( IPROUTE2 ) - I need different internal MASQed networks to exit on different external IP addressesUpI've just upgraded to the 2.2.x kernels, why isn't IP Masquerade working?