Tag Info

Hot answers tagged


AFAIK, pf does not have the flexibility and modules available in iptables. iptables comes with really large number of modules that provide more match options and others that provide more targets. You can even develop your own module. This page provides some explanation regarding iptables development if you are interested.


No, there isn't. You know that it's trivial for people to change their MAC addresses, correct? Additionally, the instant a packet passes through a later 3 routing device, the Mac address information of the source machine is lost. So even if you did want to do something like this, it would only ever work for clients that are on the same L2 LAN as your ...


From the OpenBSD 5.3 upgrade guide: pfctl(8) will abort and fail to load the rule set if the 'frags' limit in pf.conf is higher than the kern.maxclusters sysctl This is to guard against allowing a system to run out of mbuf clusters. If it is not set, the new default is 25% of kern.maxclusters. If you increase kern.maxclusters, you will also raise the ...


Officially you can't mix them. Unofficially various incantations and sacrifices might lead to a working, though precarious, configuration. In any case it's simply not recommended. Also, why not just use one or the other? I assume you're wanting dummynet to do some per-endpoint bandwidth limiting, if not PF might be all you need. Similarly, IPFW can do ...

Only top voted, non community-wiki answers of a minimum length are eligible