<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 13/06/2011, at 1:03 AM, Paul Fox wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>thanks everyone. okay, i'm somewhat reassured that firehol hasn't<br>become irrelevant, and private mail from phil whineray regarding his<br>ipv6 mods tells me that there's at least some continued interest in<br>maintaining it.<br><br>andrew wrote:<br><blockquote type="cite">Advanced Policy Firewall<br></blockquote><blockquote type="cite">(<a href="http://www.rfxn.com/projects/advanced-policy-firewall/">http://www.rfxn.com/projects/advanced-policy-firewall/</a>) seems to<br></blockquote><blockquote type="cite">be similar to firehol. I've looked at it but haven't tried it out<br></blockquote><blockquote type="cite">since firehol still meets my needs.<br></blockquote><br>thanks -- somehow that hadn't turned up in my searches. no ipv6 support<br>(promised "soon" about 7 months ago) though.<br><br><blockquote type="cite"><br></blockquote><blockquote type="cite">fwbuilder is, in my mind, quite different and not nearly as useful, since it<br></blockquote><blockquote type="cite">can't be scripted. It's fundamentally a GUI tool, and I find that the GUI<br></blockquote><blockquote type="cite">actually obscures the high-level view that I want of my firewall. A<br></blockquote><blockquote type="cite">firehol+bash script is clearer and more flexible.<br></blockquote><br>when i first started using fwbuilder, i actually found the gui/drag-n-drop<br>model to be quite nice. but as time goes on, i think i agree with you.<br><br>anyway, i'll stick with firehol for the time being.<br><br>as i mentioned, i have changes to firehol which let it build a script<br>on one machine which will run on another -- in my case the target is<br>openwrt. (i'd rather not install bash on my embedded router.) i have<br>those patches in my own git tree, and they're not really ready for<br>public consumption. i think i should probably start over using phil's<br>ipv6 tree as a basis before trying to clean them up.<br><br>oh -- as for the get-iana.sh thing -- i also have changes (based on<br>an XML extractor script written in shell) which update get-iana.sh to<br>use the new IANA file. the output, after run through "aggregate",<br>is:<br> RESERVED_IPS="0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 224.0.0.0/3"<br></div></blockquote><div><br></div>you have left out 192.168.0.0/16 and <meta charset="utf-8"><span class="Apple-style-span" style="font-family: sans-serif; font-size: 13px; border-collapse: collapse; line-height: 19px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; ">172.16.0.0/12</span></div><div><font class="Apple-style-span" face="sans-serif" size="3"><span class="Apple-style-span" style="border-collapse: collapse; font-size: 13px; line-height: 19px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px;"><br></span></font></div><div><font class="Apple-style-span" face="sans-serif" size="3"><span class="Apple-style-span" style="border-collapse: collapse; font-size: 13px; line-height: 19px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px;"><a href="http://en.wikipedia.org/wiki/Private_network">http://en.wikipedia.org/wiki/Private_network</a></span></font></div><div><font class="Apple-style-span" face="sans-serif" size="3"><span class="Apple-style-span" style="border-collapse: collapse; font-size: 13px; line-height: 19px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px;"><br></span></font></div><div><font class="Apple-style-span" face="sans-serif" size="3"><span class="Apple-style-span" style="border-collapse: collapse; font-size: 13px; line-height: 19px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px;"><a href="http://en.wikipedia.org/wiki/Private_network"></a>there's also some in 169.254</span></font></div><div><font class="Apple-style-span" face="sans-serif" size="3"><span class="Apple-style-span" style="border-collapse: collapse; font-size: 13px; line-height: 19px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px;"><br></span></font><blockquote type="cite"><div>do other people agree? given this, as others have said, i don't think<br>the get-iana mechanism is really worth maintaining anymore.<br><br>paul<br>=---------------------<br> paul fox, <a href="mailto:pgf@foxharp.boston.ma.us">pgf@foxharp.boston.ma.us</a> (arlington, ma, where it's 48.9 degrees)<br><br>------------------------------------------------------------------------------<br>EditLive Enterprise is the world's most technically advanced content<br>authoring tool. Experience the power of Track Changes, Inline Image<br>Editing and ensure content is compliant with Accessibility Checking.<br><a href="http://p.sf.net/sfu/ephox-dev2dev">http://p.sf.net/sfu/ephox-dev2dev</a><br>_______________________________________________<br>Firehol-support mailing list<br>Firehol-support@lists.sourceforge.net<br>https://lists.sourceforge.net/lists/listinfo/firehol-support<br></div></blockquote></div><br></body></html>