Dual-homed firewall, web server on the private network, firewall is
doing 1:1 NAT for the web server to the public interface of the
firewall. em0 is the public interface, em1 is the private one.
In the exact same setup (same hardware even) I am comparing Linux and
OpenBSD for a firewall. Installed Linux on a hard-disc, OpenBSD on
another disc, and I'm just swapping discs while I'm testing.
All firewall rules are written as stateless as possible - I don't need
stateful filtering, the setup is very simple (allow HTTP inbound, allow
a few ICMP types, and that's it).
With Linux, I achieve gigabit transfer speeds through the firewall
(saturating the network ports), but the firewall refuses to let any new
connection through when I flood it with a bunch of small UDP packets
with random source addresses.
I expected OpenBSD 4.1 to do better. But the thing is, even without the
UDP flood, the OpenBSD firewall is very slow. I am downloading a huge
file through it, via HTTP, and all I get is 4 Mbyte / sec. With Linux I
get 112 Mbyte / sec.
Something's wrong. Or I'm doing something wrong.
The hardware is AMD64, Tyan Transport, 2 CPUs 2 cores each. I am using
the SMP kernel. The network card is Intel Pro/1000 PCI Express 4x dual
gigabit port, it carries both em0 and em1.
=========================
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33192
groups: lo
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x8
fxp0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:e0:81:4a:0a:7f
media: Ethernet autoselect (none)
status: no carrier
bge0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:e0:81:4a:0a:a8
media: Ethernet autoselect (none)
status: no carrier
bge1: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:e0:81:4a:0a:a9
media: Ethernet autoselect (none)
status: no carrier
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:15:17:37:e9:fa
groups: egress
media: Ethernet autoselect (1000baseT full-duplex)
status: active
inet 10.123.0.10 netmask 0xffffff00 broadcast 10.123.0.255
inet6 fe80::215:17ff:fe37:e9fa%em0 prefixlen 64 scopeid 0x4
inet 10.123.0.253 netmask 0xffffffff broadcast 10.123.0.253
em1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
lladdr 00:15:17:37:e9:fb
media: Ethernet autoselect (1000baseT full-duplex)
status: active
inet 10.123.1.10 netmask 0xffffff00 broadcast 10.123.1.255
inet6 fe80::215:17ff:fe37:e9fb%em1 prefixlen 64 scopeid 0x5
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33192
enc0: flags=0<> mtu 1536
==================================
TRANSLATION RULES:
binat on em0 inet from 10.123.1.253 to any -> 10.123.0.253
FILTER RULES:
pass quick on em1 all no state
pass in quick on em0 inet proto tcp from any to 10.123.1.253 port = www
no state
pass in quick on em0 inet proto icmp from any to 10.123.1.253 icmp-type
echoreq no state
pass in quick on em0 inet proto icmp from any to 10.123.1.253 icmp-type
echorep no state
pass in quick on em0 inet proto icmp from any to 10.123.1.253 icmp-type
unreach no state
pass in quick on em0 inet proto icmp from any to 10.123.1.253 icmp-type
paramprob no state
pass in quick on em0 inet proto icmp from any to 10.123.1.253 icmp-type
trace no state
pass in quick on em0 inet proto icmp from any to 10.123.1.253 icmp-type
timex no state
pass in quick on em0 inet from any to 10.123.0.10 no state
block drop in quick all
pass out all no state
No queue in use
STATES:
all tcp 10.123.1.253:80 <- 10.123.0.253:80 <- 10.123.0.251:47108
ESTABLISHED:ESTABLISHED
INFO:
Status: Enabled for 0 days 00:09:49 Debug: Urgent
State Table Total Rate
current entries 1
searches 3809717 6468.1/s
inserts 6 0.0/s
removals 5 0.0/s
Counters
match 1812847 3077.8/s
bad-offset 0 0.0/s
fragment 0 0.0/s
short 0 0.0/s
normalize 0 0.0/s
memory 0 0.0/s
bad-timestamp 0 0.0/s
congestion 116169 197.2/s
ip-option 0 0.0/s
proto-cksum 0 0.0/s
state-mismatch 0 0.0/s
state-insert 0 0.0/s
state-limit 0 0.0/s
src-limit 0 0.0/s
synproxy 0 0.0/s
TIMEOUTS:
tcp.first 30s
tcp.opening 5s
tcp.established 18000s
tcp.closing 60s
tcp.finwait 30s
tcp.closed 30s
tcp.tsdiff 10s
udp.first 60s
udp.single 30s
udp.multiple 60s
icmp.first 20s
icmp.error 10s
other.first 60s
other.single 30s
other.multiple 60s
frag 30s
interval 10s
adaptive.start 6000 states
adaptive.end 12000 states
src.track 0s
LIMITS:
states hard limit 10000
src-nodes hard limit 10000
frags hard limit 5000
tables hard limit 1000
table-entries hard limit 100000
OS FINGERPRINTS:
696 fingerprints loaded
--
Florin Andrei
http://florin.myip.org/
