My preferred firewall these days, for general use, is pf. I seem to recall someone who has used it in high-load scenarios that it can kinda choke at high loads, though I don't recall whether that was due to pf itself or the fact he was running it on OpenBSD. Until now, this has not been a concern for me.
I may be getting involved in a commercial project in the near future that could very well involve handling very large numbers of connections dealing with potentially high bandwidth demands, however. The circumstances would require some QOS, and I'm thinking of using pf/ALTQ for this project, but I don't want to discover after we're well underway that large numbers of connections would cause problems. Should I consider ipfw or ipfilter instead, or are my concerns with relation to pf's ability to handle extremely high loads of legitimate traffic unfounded? -- Chad Perrin [ content licensed PDL: http://pdl.apotheon.org ] H. L. Mencken: "Democracy is the theory that the common people know what they want and deserve to get it good and hard."
Description: PGP signature