Mention that PF is the preferred choice for a firewall, add link to PF Users Guide...

diff --git a/docs/newhandbook/Security/index.mdwn b/docs/newhandbook/Security/index.mdwn
index 3b702a7..1260e2a 100644 (file)
--- a/docs/newhandbook/Security/index.mdwn
+++ b/docs/newhandbook/Security/index.mdwn
@@ -1,4 +1,3 @@
-
 # Security 
 ***Much of this chapter has been taken from the security(7) manual page by Matthew Dillon. ***
 
@@ -666,7 +665,7 @@ As a side note, the S/Key and OPIE prompts have a useful feature (not shown here
 
 
 
-At this point you need to generate your one-time password to answer this login prompt. This must be done on a trusted system that you can run `key` or `opiekey` on. (There are versions of these for DOS, Windows® and Mac OS® as well.) They need both the iteration count and the seed as command line options. You can cut-and-paste these right from the login prompt on the machine that you are logging in to.
+At this point you need to generate your one-time password to answer this login prompt. This must be done on a trusted system that you can run `key` or `opiekey` on. (There are versions of these for DOS, Windows® and Mac OS® as well.) They need both the iteration count and the seed as command line options. You can cut-and-paste these right from the login prompt on the machine that you are logging in to.
 
 
 
@@ -935,8 +934,13 @@ Proxy servers are normally more secure than normal servers, and often have a wid
 Proxy servers often have ways of restricting access further, so that only certain hosts can gain access to the servers. Most will also allow the administrator to specify which users can talk to which destination machines. Again, what facilities are available depends largely on what proxy software you choose.
 
 
+### Firewall options in DragonFlyBSD
+
+DragonFlyBSD inherited the IPFW firewall (versions 1 and 2) when it forked from FreeBSD. Pretty soon after though, we imported the new pf packet filter that the OpenBSD developers created from scratch. It is a cleaner code base and is now the recommended solution for firewalling DragonFly. Keep in mind that the PF version in DragonFly is not in sync with OpenBSD's PF code. We have not yet incorporated the improvements made in PF over the last few years, but we have some improvements of our own. IPFW is still and will remain supported for the forseeable future; it has some features not yet available in PF.
+
+A copy of the OpenBSD PF user's guide corresponding to the version of PF in DragonFly can be found in [[PFUsersGuide]].
 
-### What Does IPFW Allow Me to Do? 
+#### What Does IPFW Allow Me to Do? 
 
 
 
@@ -952,7 +956,7 @@ As a result of the way that IPFW is designed, you can use IPFW on non-router mac
 
 
 
-### Enabling IPFW on DragonFly 
+#### Enabling IPFW on DragonFly 
 
 
 
@@ -982,7 +986,7 @@ Where 4500 is the chain entry you wish to continue logging.`options IPFIREWALL_D
 
 
 
-### Configuring IPFW 
+#### Configuring IPFW 
 
 
 
@@ -994,7 +998,7 @@ There are currently four different command categories used by the utility: addit
 
 
 
-#### Altering the IPFW Rules 
+##### Altering the IPFW Rules 
 
 
 
@@ -1138,7 +1142,7 @@ frag:: Matches if the packet is not the first fragment of the datagram.in:: Matc
 
 
 
-#### Listing the IPFW Rules 
+##### Listing the IPFW Rules 
 
 
 
@@ -1158,7 +1162,7 @@ There are seven valid flags when using this form of the command:
 
 
 
-#### Flushing the IPFW Rules 
+##### Flushing the IPFW Rules 
 
 
 
@@ -1174,7 +1178,7 @@ This causes all entries in the firewall chain to be removed except the fixed def
 
 
 
-#### Clearing the IPFW Packet Counters 
+##### Clearing the IPFW Packet Counters 
 
 
 
@@ -1190,7 +1194,7 @@ When used without an `***index***` argument, all packet counters are cleared. If
 
 
 
-### Example Commands for  **ipfw**  
+#### Example Commands for  **ipfw**  
 
 
 
@@ -1266,10 +1270,7 @@ You can also see the last time a chain entry was matched with:
 
 
 
-### Building a Packet Filtering Firewall 
-
-<!-- XXX: AFAIK pf is vastly superior to ipfw, so this should be focused on pf, not ipfw -->
-
+#### Building a Packet Filtering Firewall 
 
  **Note:** The following suggestions are just that: suggestions. The requirements of each firewall are different and we cannot tell you how to build a firewall to meet your particular requirements.
 
@@ -1313,7 +1314,7 @@ As stated above, these are only ***guidelines***. You will have to decide what f
 
 
 
-### IPFW Overhead and Optimization 
+#### IPFW Overhead and Optimization 
 
 
 
@@ -1357,11 +1358,11 @@ The non-matching source IP address for the above rule causes these rules to be s
 
 
 
-The per-packet processing overhead in the former case was approximately 2.703 ms/packet, or roughly 2.7 microseconds per rule. Thus the theoretical packet processing limit with these rules is around 370 packets per second. Assuming 10 Mbps Ethernet and a ~1500 byte packet size, we would only be able to achieve 55.5% bandwidth utilization.
+The per-packet processing overhead in the former case was approximately 2.703 ms/packet, or roughly 2.7 microseconds per rule. Thus the theoretical packet processing limit with these rules is around 370 packets per second. Assuming 10 Mbps Ethernet and a ~1500 byte packet size, we would only be able to achieve 55.5% bandwidth utilization.
 
 
 
-For the latter case each packet was processed in approximately 1.172 ms, or roughly 1.2 microseconds per rule. The theoretical packet processing limit here would be about 853 packets per second, which could consume 10 Mbps Ethernet bandwidth.
+For the latter case each packet was processed in approximately 1.172 ms, or roughly 1.2 microseconds per rule. The theoretical packet processing limit here would be about 853 packets per second, which could consume 10 Mbps Ethernet bandwidth.
 
 
 
@@ -1429,7 +1430,7 @@ Creating a VPN between two networks, separated by the Internet, using DragonFly
 
 
 
-This section will guide you through the process of setting up IPsec, and to use it in an environment which consists of DragonFly and  **Microsoft® Windows® 2000/XP**  machines, to make them communicate securely. In order to set up IPsec, it is necessary that you are familiar with the concepts of building a custom kernel (see [kernelconfig.html Chapter 9]).
+This section will guide you through the process of setting up IPsec, and to use it in an environment which consists of DragonFly and  **Microsoft® Windows® 2000/XP**  machines, to make them communicate securely. In order to set up IPsec, it is necessary that you are familiar with the concepts of building a custom kernel (see [kernelconfig.html Chapter 9]).