Summary of features:
* detailed and well commented configuration file
* granular inbound and outbound network filtering
* user id based outbound network filtering
* application based network filtering
* trust based rule files with an optional advanced syntax
* global trust system where rules can be downloaded from a central
management server
* reactive address blocking (RAB), next generation in-line intrusion
prevention
* debug mode provided for testing new features and configuration setups
* fast load feature that allows for 1000+ rules to load in under 1 second
* inbound and outbound network interfaces can be independently configured
* global tcp/udp port & icmp type filtering with multiple methods of
executing filters (drop, reject, prohibit)
* configurable policies for each ip on the system with convenience variables
to import settings
* packet flow rate limiting that prevents abuse on the most widely abused
protocol, icmp
* prerouting and postrouting rules for optimal network performance
* dshield.org block list support to ban networks exhibiting suspicious
activity
* spamhaus Don't Route Or Peer List support to ban known "hijacked zombie"
IP blocks
* any number of additional interfaces may be configured as firewalled
(untrusted) or trusted (not firewalled)
* additional firewalled interfaces can have there own unique firewall
policies applied
* intelligent route verification to prevent embarrassing configuration
errors
* advanced packet sanity checks to make sure traffic coming and going meets
the strictest of standards
* filter attacks such as fragmented UDP, port zero floods, stuffed routing,
arp poisoning and more
* configurable type of service options to dictate the priority of different
types of network traffic
* intelligent default settings to meet every day server setups
* dynamic configuration of your servers local DNS revolvers into the firewall
* optional filtering of common p2p applications
* optional filtering of private & reserved IP address space
