Daniel Walker wrote:
IPTABLES allows for string matching. IPFW does not. I'll
have to fire up my Ubuntu to do this.
This has been brought up before on this list. IPFW does not intend on
ever supporting string matching as a standard feature. The developers
feel that this kind of expensive operation does not belong in the kernel
with IPFW.
This does not mean that this functionality is impossible to do with
IPFW/freebsd.
AFAIK String match deny processing should be done using divert(4)
sockets like natd. You use IPFW to divert outgoing DNS requests to your
natd-like (userland) process. This process determines whether or not it
contains your string and blocks the request/response if it does.
Unfortunately I'm not aware of a userland app that does this today.
-Corey Smith
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
