Re: Avoiding natd overhead

В сб, 21/10/2006 в 00:47 -0600, Brett Glass пишет:
I'm working with a FreeBSD-based router that's using IPFW for
policy routing, traffic shaping, and transparent proxying and natd
for network address translation. IPFW does these things pretty well
(in fact, I don't know if another firewall, like pf, could even do
some of these things I'm doing with IPFW), but natd is by far the
most CPU-intensive process on the system and is causing it to
crumple like a wet towel under heavy loads. How can I replace just
the functionality of natd without moving to an entirely new
firewall? Can I still select which packets are routed to the NAT
engine, and when this occurs during the processing of the packet?

Problem is in location of natd functionality.
So, every packet which goes through nat should jump from kernel to
user-space and back. It is really takes a lot of resources.

Solutions:
1. use PF for nat - it does aliasing in kernel space
2. use in-kernel libalias implementation
(I guess man-page for ng_nat(4) will help)


--Brett Glass

_______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"
--
Vladimir B. Grebenschikov
vova@xxxxxxx
_______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Firewall rules
    ... Are you sure this is not just a quirk of IPFW? ... unless you do some gymnastics with skipto rule so ... NAT and keep-state doesn't go to getter because NAT changes the ip ... allow changed traffic afther its bin passed though natd. ...
    (freebsd-questions)
  • Re: Web Server not allowing external visitors
    ... | use NATD function of firewall. ... I did all this and lost all access to the internet from the other LAN ... As the Web Server at the moment then is on my FreeBSD machine I do not need ...
    (freebsd-questions)
  • Routing path of jail
    ... I have been trying to use a jail to achieve this. ... Lynx returns the public IP bound to the first address, and my IPFW ... Now using NATD, I have been able to forward ... computers inside the firewall to one of the other public IP addresses, ...
    (freebsd-net)
  • Re: confusion configuring NAT
    ... NAT support was added to ipfw with the 7.0 release. ... run natd if you're using ipfw nat. ... Network Technical Lead ...
    (freebsd-questions)
  • Re: Avoiding natd overhead
    ... In that situation I have used IPFW for filtering and IPF for doing NAT. ... policy routing, traffic shaping, and transparent proxying and natd ... Can I still select which packets are routed to the NAT ...
    (freebsd-net)