Re: One for the Security Guru's

[Stephen Frost]

--eSbLxR/uY7u5MyMV
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Stephen Satchell ([e-mail]) wrote:
> I've also been experimenting with the traffic limiting capabilities, as o=
ne=20
> co-locate provider offers discounts for guaranteed lower bandwidth=20
> utilization, so by limiting the bandwidth using IPTABLES I should be able=
=20
> to cut my co-lo costs to 1/3 of what they would be with "unlimited"=20
> bandwidth.

http://www.lartc.org ; When talking about traffic shaping with Linux
you're really talking about tc from the iproute2 package.  I'd recommend
you check out that URL if you havn't already and that you strongly
consider using HTB for your traffic shaping needs, it's alot easier to
use and makes alot more sense than CBQ.

> I've worked with the PIX, and I don't see what I'm missing in features=20
> between the PIX and Linux/IPTABLES.  I'm sure there is something.  Please=
=20
> amplify on your comments.

Eh, it depends on how you look at it, but...  The cisco includes support
for checking out high-level protocols, such as HTTP.  Basically you can
set things up inside the PIX based on what URL is being requested and
such.  That's why the PIX is more than just a packet filter.  Personally
I still characterize my Linux box running iptables as a firewall.  If
you want to do the same kind of thing the PIX is doing on port 80 you'd
need to run squid or something similar to it and set it up as a reverse
proxy with associated access rules and whatnot.  Things like deny
anything with cmd.exe in it, etc.

	Stephen

--eSbLxR/uY7u5MyMV
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (GNU/Linux)

iD8DBQE9uUtrrzgMPqB3kigRAsFcAKCANdPOD4v+erBzLiCN3NuGU8HZvQCdH7oA
DTEdJJwPbDgiAuPiIpZPm8E=
=iWGW
-----END PGP SIGNATURE-----

--eSbLxR/uY7u5MyMV--