Re: NPF tuning

[Mindaugas Rasiukevicius <rmind%netbsd.org@localhost>]

Hauke Fath <hauke%Espresso.Rhein-Neckar.DE@localhost> wrote:
> On Sun, 15 Jan 2017 23:19:34 +0100, Manuel Bouyer wrote:
> > 240 is still not that much. I used to have more than 2000 rules with
> > ipf (before we replaced this box with a cisco).
> 
> It is even worse because npf has many restrictions compared to {i,}pf 
> that lead to rule duplication.
> 

You can always fall back to pcap-filter in NPF, e.g.:

	pass in final pcap-filter "tcp and src 10.0.0.1"

This gives you tcpdump syntax.  Also, use tables whenever possible.

-- 
Mindaugas