> Ok, you pefere simplicity, but I prefere good firewall, not only 'IN'
I have worked with PIX:es for som years now and I do not use output filters.
> If check in FreeBSD ipf(8) filter utility, you will see that include
> command like this 'block out quick on xxx from xxx to xxx' and monowall
> use this utility to set filtering..
> Why 'ipf' utility have 'out' rule? Who need this?.. Programers of 'ipf'
> was spend unnessary time for programing that. :)
I do not know how long time you have bin playing with routers and
firewalls but I have done it for 15 years.
Statefull inspection is a rather new thing and before that time you had
to use both input and output filters. Both ipf and ipfw is older than
SPI and therefore they both have input and output filter functions.
In your example I can see the point of having output filters but the
main problem is not the m0n0wall not having output filters. The problem
is that you use the Internet connected firewall as a core router in your
network. Use a router as your core and solve your inhouse problems there.