How many states can pf sanely handle

Hi,

I have a dns server that receives a fair amount of traffic. I was
implementing a pf based firewall on it and ran into a few issues. Basically
there is a ridiculously high number of states generated. I just wondered
what are the upper limits of what pf can handle, and what the memory
requirements are?

to get an idea of the traffic levels (this is about 30% of peak time)

# pfctl -z ; sleep 60 ; pfctl -sr -v

pass in quick on bce0 proto udp from <dns> to any port = domain no state
[ Evaluations: 284852 Packets: 209701 Bytes: 13789905 States:
0 ]
[ Inserted: uid 0 pid 95645 ]
pass out quick on bce0 proto udp from any port = domain to <dns> no state
[ Evaluations: 309780 Packets: 207705 Bytes: 56264916 States:
0 ]
[ Inserted: uid 0 pid 95645 ]
pass out quick on bce0 proto udp from any to any port = domain no state
[ Evaluations: 50734 Packets: 50734 Bytes: 3933868 States:
0 ]
[ Inserted: uid 0 pid 95645 ]
pass in quick on bce0 proto udp from any port = domain to any no state
[ Evaluations: 51290 Packets: 48056 Bytes: 9106259 States:
0 ]
[ Inserted: uid 0 pid 95645 ]

These rules aren't exactly ideal but they do stop an insane amount of states
being generated, as every dns request generates one inbound rule, then
potentially multiple outbound ones depending on whether you get a cache hit.
_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Event ID: 5504
    ... User Datagram Protocol, Src Port: 1273, Dst Port: domain ... Authority RRs: 0 ... and if its an issue with the Windows DNS ... > assuming (none of us have asked your config yet) that you have all your ...
    (microsoft.public.win2000.dns)
  • RE: strange traffic on UDP port 53
    ... Replies to DNS queries should be coming FROM port 53, ... > found a similar problem with packets being stopped by our firewall. ... The destination IP is our mail server (not ...
    (Incidents)
  • Re: Have to go to web site twice before it comes up
    ... I've ruled out Internet Explorer. ... Telnet does the same thing. ... it's not limited to port 80. ... running on top of it that will have to be re-set up (e.g. DNS, DHCP, AD, ...
    (microsoft.public.win2000.networking)
  • Re: Deny MX queries for dynamic IP pools
    ... As a solution the routing team was thinking to block port 25 for outgoing as ... Luckily we have two set of DNS server farms; one that is serving static IP ... DNS port forwarded queries are going to external servers. ...
    (comp.protocols.dns.bind)
  • Re: network traffic etherealed, need your help on the records (LONG)
    ... I try telnet myIP 80 to test whether my ISP blocking port 80? ... >To see if your hostname resolves from gethostbyname (instead of just DNS) ... Should I do something here for the apache server? ...
    (comp.os.linux.networking)