Handbook - Firewalls

[carlavilla]

Summary

Rework, changes:

• Add "Choosing a Firewall" comparison section.
• Add "Traffic Shaping with Dummynet" section, demote ALTQ to a legacy note
• Rewrite PF examples
• Add set skip on lo0, syncookies, ICMPv6/NDP guidance, etc
• Modernize interfaces, mail ports, etc
• Fix inbound ICMP/ICMPv6 to allow PMTUD and neighbor discovery
• Trim IPFILTER to pointer-level, compress FTP proxy, drop spamd/greylisting

[michaelo]

Unfortunately, there is very little I can contribute here. My knowledge in regards of all of these FWs is close to zero.

documentation/content/en/books/handbook/firewalls/_index.adoc

871

Though I am not a native speaker, shouldn't it be "which does not require a custom kernel"? Hope a native speak can clarify because the sentence reads awkwardly for me.

[philip]

This is really difficult to review. I wonder if it wants to be several smaller commits instead of one huge one.

An initial observation: do we simply want to get rid of all mentions of FTP? It looks like that's what's happening. Splitting that out into a single commit would already make the rest easier to review.

[damjan.jov_gmail.com]

documentation/content/en/books/handbook/firewalls/_index.adoc

855

You might also want to mention that ALTQ requires device driver modifications, and not all network devices work with ALTQ, while all work with dummynet. See "man 4 altq" where it gives a list of "supported devices".