Don't bother with IPF, it's pretty much deprecated in FreeBSD 6, there's little (if any) development on it in FreeBSD 7, and I doubt it will remain in the tree beyond FreeBSD 8. It doesn't fit into the PFIL framework, and the locking doesn't fit into the SMPng framework. It also doesn't work correctly on SMP systems.
Pretty much everyone who used IPF has switched to PF.
You also shouldn't have 2 separate packet filters in your kernel simultaneously unless you REALLY know what you are doing.
|