blob: 5b2c059052142e8d19f477c5d42412e98e5576e8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
|
BUGS:
-----
* fix "to <ifname>" bug on FreeBSD 2.2.8
fastroute works
===============================================================================
GENERAL:
--------
* support redirection like "rdr tun0 0/32 port 80 ..."
* use fr_tcpstate() with NAT code for increased NAT usage security or even
fr_checkstate() - suspect this is not possible.
* add another alias for <thishost> for interfaces <thisif>? as well as
all IP#'s associated with the box <myaddrs>?
time permitting:
* load balancing across interfaces
* record buffering for TCP/UDP
* modular application proxying
-done
* allow multiple ip addresses in a source route list for ipsend
* port IP Filter to Linux
Not in this century.
* document bimap
* document NAT rule order processing
* add more docs
in progress
3.4:
XDDD. I agree. Bandwidth Shapping and QoS (Quality of Service, AKA
traffic priorization) should be *TOP* in the TO DO list.
* Bandwidth limiting!!!
maybe for solaris, otherwise "ALTQ"
* More examples
* More documentation
* Load balancing features added to the NAT code, so that I can have
something coming in for 20.20.20.20:80 and it gets shuffled around between
internal addresses 10.10.10.1:8000 and 10.10.10.2:8000. or whatever.
- done, stage 1 (round robin/split)
The one thing that Cisco's PIX has on IPF that I can see is that
rewrites the sequence numbers with semi-random ones.
- done
I would also love to see a more extensive NAT. It can choose to do
rdr and map based on saddr, daddr, sport and dport. (Does the kernel
module already have functionality for that and it just needs support in
the userland ipnat?)
-sort of done
* intrusion detection
detection of port scans
detection of multiple connection attempts
* support for multiple log files
i.e. all connections to ftp and telnet logged to
a seperate log file
* multiple levels of log severity with E-mail notification
of intrusion alerts or other high priority errors
* poison pill facility
after detection of a port scan, start sending back
large packets of garbage or other packets to
otherwise confuse the intruder (ping of death?)
IPv6:
-----
* NAT is yet not available, either as a null proxy or address translation
BSD:
* "to <if>" and "to <if>:<ip>" are not supported, but "fastroute" is.
Solaris:
* "to <if>:<ip>" is not supported, but "fastroute" is and "to <if>" are.
Tru64:
------
* IPv6 checksum calculation for RST's and ICMP packets is not done (there
are routines in the Tru64 kernel to do this but what is the interface?)
does bimap allow equal sized subnets?
make return-icmp 'intelligent' if no type is given about what type to use?
reply-to - enforce packets to pass through interfaces in particular
combinations - opposite to "to", set reverse path interface
|
