Chad Perrin wrote:
My preferred firewall these days, for general use, is pf.  I seem to
recall someone who has used it in high-load scenarios that it can kinda
choke at high loads, though I don't recall whether that was due to pf
itself or the fact he was running it on OpenBSD.  Until now, this has not
been a concern for me.

I may be getting involved in a commercial project in the near future that
could very well involve handling very large numbers of connections
dealing with potentially high bandwidth demands, however.  The
circumstances would require some QOS, and I'm thinking of using pf/ALTQ
for this project, but I don't want to discover after we're well underway
that large numbers of connections would cause problems.  Should I
consider ipfw or ipfilter instead, or are my concerns with relation to
pf's ability to handle extremely high loads of legitimate traffic

pf will perform very well.  I don't know if anyone has benchmarked it
against ipfw, but I suspect that any difference in performance is pretty
minimal.  If you're just doing packet filtering and using a fairly run of
the mill modern machine, you should be able to keep up with Gb wire speed
without problems.

If performance is a limiting factor, then review your rule sets carefully:
arranging things so that the most popular traffic types are handled as early as possible, knowing when to use tables vs. use address-list macros and judicious use of quick rules can make quite a difference.

Also, /stateful/ rules are generally faster than stateless once you've got
beyond the initial packet that establishes the state.  Looking stuff up
in the state table is quicker and takes place earlier in the processing sequence than traversing the rulesets.

High load may or may not be a problem depending on your traffic patterns.
I've seen pf firewalls suffer by running out of state-table space in
situations where there are a lot of fairly short-lived but low volume
network connections. The default is 10,000 states. If your firewall machine is dedicated to running pf and it has hundreds of MB if not GB of RAM, then upping the size of some of those parameters by an order of magnitude is feasible, and works well.

On the whole I'd go with pf every time simply based on how much more
manageable it is compared to ipfw -- you have to try, hard, to lock
yourself out when reloading a new pf ruleset.



Dr Matthew J Seaman MA, D.Phil.                   7 Priory Courtyard
                                                 Flat 3
PGP:     Ramsgate
                                                 Kent, CT11 9PW

Attachment: signature.asc
Description: OpenPGP digital signature

Reply via email to