Chad Perrin wrote:
My preferred firewall these days, for general use, is pf. I seem to recall someone who has used it in high-load scenarios that it can kinda choke at high loads, though I don't recall whether that was due to pf itself or the fact he was running it on OpenBSD. Until now, this has not been a concern for me.I may be getting involved in a commercial project in the near future that could very well involve handling very large numbers of connections dealing with potentially high bandwidth demands, however. The circumstances would require some QOS, and I'm thinking of using pf/ALTQ for this project, but I don't want to discover after we're well underway that large numbers of connections would cause problems. Should I consider ipfw or ipfilter instead, or are my concerns with relation to pf's ability to handle extremely high loads of legitimate traffic unfounded?
pf will perform very well. I don't know if anyone has benchmarked it against ipfw, but I suspect that any difference in performance is pretty minimal. If you're just doing packet filtering and using a fairly run of the mill modern machine, you should be able to keep up with Gb wire speed without problems. If performance is a limiting factor, then review your rule sets carefully:arranging things so that the most popular traffic types are handled as early as possible, knowing when to use tables vs. use address-list macros and judicious use of quick rules can make quite a difference.
Also, /stateful/ rules are generally faster than stateless once you've got beyond the initial packet that establishes the state. Looking stuff upin the state table is quicker and takes place earlier in the processing sequence than traversing the rulesets.
High load may or may not be a problem depending on your traffic patterns. I've seen pf firewalls suffer by running out of state-table space in situations where there are a lot of fairly short-lived but low volumenetwork connections. The default is 10,000 states. If your firewall machine is dedicated to running pf and it has hundreds of MB if not GB of RAM, then upping the size of some of those parameters by an order of magnitude is feasible, and works well.
On the whole I'd go with pf every time simply based on how much more manageable it is compared to ipfw -- you have to try, hard, to lock yourself out when reloading a new pf ruleset. Cheers, Matthew -- Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard Flat 3 PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate Kent, CT11 9PW
Description: OpenPGP digital signature