Re: One for the Security Guru's

[Stephen Frost <sfrost@snowman.net>]

[-- Attachment #1: Type: text/plain, Size: 1505 bytes --]

* Stephen Satchell (list@fluent2.pyramid.net) wrote:
> I've also been experimenting with the traffic limiting capabilities, as one 
> co-locate provider offers discounts for guaranteed lower bandwidth 
> utilization, so by limiting the bandwidth using IPTABLES I should be able 
> to cut my co-lo costs to 1/3 of what they would be with "unlimited" 
> bandwidth.

http://www.lartc.org ; When talking about traffic shaping with Linux
you're really talking about tc from the iproute2 package.  I'd recommend
you check out that URL if you havn't already and that you strongly
consider using HTB for your traffic shaping needs, it's alot easier to
use and makes alot more sense than CBQ.

> I've worked with the PIX, and I don't see what I'm missing in features 
> between the PIX and Linux/IPTABLES.  I'm sure there is something.  Please 
> amplify on your comments.

Eh, it depends on how you look at it, but...  The cisco includes support
for checking out high-level protocols, such as HTTP.  Basically you can
set things up inside the PIX based on what URL is being requested and
such.  That's why the PIX is more than just a packet filter.  Personally
I still characterize my Linux box running iptables as a firewall.  If
you want to do the same kind of thing the PIX is doing on port 80 you'd
need to run squid or something similar to it and set it up as a reverse
proxy with associated access rules and whatnot.  Things like deny
anything with cmd.exe in it, etc.

	Stephen

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]