re: firewall high-load performance

Matthew Seaman wrote:
pf will perform very well. I don't know if anyone has benchmarked it
against ipfw, but I suspect that any difference in performance is pretty
minimal. If you're just doing packet filtering and using a fairly run of
the mill modern machine, you should be able to keep up with Gb wire speed
without problems.

Actually, I tracked down the guy who had originally given a poor review
of pf performance, and it turns out that the missing part of his review
was related to use of dummynet for bandwidth management. Since I'm not
planning to use dummynet for bandwidth management, that's not really a
factor we need to consider. It looks like, at this point, pf is a good
choice.



If performance is a limiting factor, then review your rule sets
carefully:
arranging things so that the most popular traffic types are handled as
early as possible, knowing when to use tables vs. use address-list macros
and judicious use of quick rules can make quite a difference.

Also, /stateful/ rules are generally faster than stateless once you've
got
beyond the initial packet that establishes the state. Looking stuff up
in the state table is quicker and takes place earlier in the processing
sequence than traversing the rulesets.

High load may or may not be a problem depending on your traffic patterns.
I've seen pf firewalls suffer by running out of state-table space in
situations where there are a lot of fairly short-lived but low volume
network connections. The default is 10,000 states. If your firewall
machine is dedicated to running pf and it has hundreds of MB if not GB
of
RAM, then upping the size of some of those parameters by an order of
magnitude is feasible, and works well.

Thanks for the further elaboration. I'll keep all this in mind as I
investigate the suitability of pf for this project.



On the whole I'd go with pf every time simply based on how much more
manageable it is compared to ipfw -- you have to try, hard, to lock
yourself out when reloading a new pf ruleset.

Just one more reason pf is my favorite firewall.

Thanks for the informative reply.

By the way, apologies if this doesn't thread properly. I never got any
messages from this thread in my inbox, and had to copy everything from
the archive:

http://lists.freebsd.org/pipermail/freebsd-questions/2008-June/176542.html

For some reason, mutt doesn't seem to want me to alter headers to make it
thread properly, and keeps throwing away my edits.

--
Chad Perrin [ content licensed PDL: http://pdl.apotheon.org ]
Dr. Ron Paul: "Liberty has meaning only if we still believe in it when
terrible things happen and a false government security blanket beckons."

Attachment: pgpdDbK6ukFFT.pgp
Description: PGP signature

Relevant Pages

  • Re: RFC: my firewall ruleset(s)
    ... IPFW numbers rules that increment by 1. ... > The reasoning behind this is so I have a single firewall script for all ... Depending on the rc.conf entries on that server, the firewall ...
    (freebsd-questions)
  • Re: suggestions on router w/firewall
    ... of using NAT, even with SPI, as a firewall method. ... describe standard NAT as a firewall service. ... That sentence refers to four concepts: NAT, router, simple packet filtering, ... created port table to packet header info, and NAT does change the packet. ...
    (comp.security.firewalls)
  • RE: [Full-Disclosure] ISS Security Brief: "MS Blast" MSRPC DCOM Worm Propagation (fwd)
    ... Once you turn on the packet filtering, you either allow all, or deny all ... XP's "firewall" has several pre-defined higher layer protocols that ... #Full-Disclosure - We believe in it. ... in error, please contact us immediately at 816.421.6611, and delete the communication from any computer or network system. ...
    (Full-Disclosure)
  • RE: What exactly is ipfilter?
    ... FBSD comes with two firewall applications built into the base ... IPFW and IPFILTER. ...
    (freebsd-questions)
  • [HOWTO] IPFW: Vector-Based Modularity
    ... Complex Firewall ... For this purpose the local host should be considered an interface of its own in the form of the IPFW alias, ... The IPFW ruleset begins with a series of skipto rules directing matching traffic to a rule module. ... 00400 set 0 deny ip from any to any ...
    (freebsd-questions)