Messages in this thread | | | Date | Fri, 25 Oct 2002 09:47:23 -0400 | From | Stephen Frost <> | Subject | Re: One for the Security Guru's |
| |
* Stephen Satchell (list@fluent2.pyramid.net) wrote: > I've also been experimenting with the traffic limiting capabilities, as one > co-locate provider offers discounts for guaranteed lower bandwidth > utilization, so by limiting the bandwidth using IPTABLES I should be able > to cut my co-lo costs to 1/3 of what they would be with "unlimited" > bandwidth.
http://www.lartc.org ; When talking about traffic shaping with Linux you're really talking about tc from the iproute2 package. I'd recommend you check out that URL if you havn't already and that you strongly consider using HTB for your traffic shaping needs, it's alot easier to use and makes alot more sense than CBQ.
> I've worked with the PIX, and I don't see what I'm missing in features > between the PIX and Linux/IPTABLES. I'm sure there is something. Please > amplify on your comments.
Eh, it depends on how you look at it, but... The cisco includes support for checking out high-level protocols, such as HTTP. Basically you can set things up inside the PIX based on what URL is being requested and such. That's why the PIX is more than just a packet filter. Personally I still characterize my Linux box running iptables as a firewall. If you want to do the same kind of thing the PIX is doing on port 80 you'd need to run squid or something similar to it and set it up as a reverse proxy with associated access rules and whatnot. Things like deny anything with cmd.exe in it, etc.
Stephen [unhandled content-type:application/pgp-signature] | |