NetBSD to get new firewall

[graudeejs]

http://mail-index.netbsd.org/netbsd-announce/2010/09/13/msg000110.html


^^ sounds interesting

 

[aragon]

I wonder if it brings anything ground breaking to the existing pf and ipfw world?

 

[mix_room]

* MP-safety and locklessness for scalable MP performance: no longer is
the packet filter the bottleneck in your multicore router

That is something which would be very useful.

 

[DutchDaemon]

Moved this to 'development'. Maybe we'll get some input from people working on e.g. the pf porting effort.

 

[hansivers]

The man page for npf.conf is available :

http://netbsd.gw.com/cgi-bin/man-cgi?npf.conf++NetBSD-current

Syntax appears to be similar to PF.

About the "why NPF was created" (since there is already two packet filters in NetBSD - IF filter and PF-and three packet filters in FreeBSD - IPFW, IP filter and PF), the NetBSD announcement suggests that MP support was the big thing :

NPF is unique for using a bytecode interpreter in its packet-inspection
engine, and for answering the question, "What does a packet filter
designed from the bottom up for multiprocessor systems look like?"