Hi all,
I have a firewall running using IP filter version 3.4.30 on a
Solaris sparc box running Solaris version 9.
When I use a rule like
rdr <interface> from <IP address 1> to any -> 0 port 0
the "0 port 0" is to say don't touch the packets (more or less like
a quick in ipf), but I see a lot of packets which hit the rule and are shown
in list of active sessions. How far does this affect the performance of
ipnat?
Here's the machine network configuration:
# ifconfig -a
lo0: flags=1000849<UP,LOOPBACK,RUNNING,MULTICAST,IPv4> mtu 8232
index 1
inet 127.0.0.1 netmask ff000000
hme0: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500
index 2
inet 203.197.143.79 netmask ffffffe0 broadcast
203.197.143.255
ether 8:0:20:f8:fc:2b
hme1: flags=1000843<UP,BROADCAST,RUNNING,MULTICAST,IPv4> mtu 1500
index 3
inet 192.168.2.200 netmask ffffff00 broadcast 192.168.2.255
ether 8:0:20:b7:7c:76
Here's the ipnat rules and the corresponding list of active
sessions. I have highlighted the active sessions caused by the rule.
There are also a lot or rules that redirect traffic between the
internal interface like the one's highlighted in the list of active sessions
below. These contribute for most of the active sessions.
# ipnat -l
List of active MAP/Redirect filters:
rdr hme1 0.0.0.0/0 port 53 -> 172.18.0.1 port 53 udp
map hme0 from any to any port = 53 -> 203.197.143.79/32 portmap udp
auto
map hme0 192.168.2.0/24 -> 0.0.0.0/32 proxy port ike ipsec/udp
rdr hme1 from any to 192.168.2.200/32 -> 0.0.0.0 port 0 tcp
rdr hme1 0.0.0.0/0 port 443 -> 192.168.2.200 port 3129 tcp
map hme0 192.168.2.30/32 -> 203.197.143.79/32
rdr hme1 from 192.168.2.30/32 to any -> 0.0.0.0 port 0 tcp
rdr hme1 0.0.0.0/0 port 80 -> 192.168.2.200 port 3128 tcp
rdr hme1 0.0.0.0/0 port 443 -> 192.168.2.200 port 3128 tcp
rdr hme1 0.0.0.0/0 port 8080 -> 192.168.2.200 port 3128 tcp
rdr hme1 0.0.0.0/0 port 3128 -> 192.168.2.200 port 3128 tcp
List of active sessions:
MAP 192.168.2.30 1183 <- -> 203.197.143.79 1183
[209.202.220.97 80]
RDR 209.202.220.97 80 <- -> 209.202.220.97 80 [192.168.2.30
1183]
MAP 192.168.2.30 1182 <- -> 203.197.143.79 1182
[209.202.220.97 80]
RDR 209.202.220.97 80 <- -> 209.202.220.97 80 [192.168.2.30
1182]
MAP 192.168.2.30 1181 <- -> 203.197.143.79 1181 [165.21.82.167
80]
RDR 165.21.82.167 80 <- -> 165.21.82.167 80 [192.168.2.30
1181]
MAP 192.168.2.30 1180 <- -> 203.197.143.79 1180 [172.18.0.1
53]
RDR 172.18.0.1 53 <- -> 172.18.0.1 53 [192.168.2.30
1180]
MAP 203.197.143.79 35169 <- -> 203.197.143.79 36193 [172.18.0.1
53]
MAP 192.168.2.30 1179 <- -> 203.197.143.79 1179 [165.21.82.166
80]
RDR 165.21.82.166 80 <- -> 165.21.82.166 80 [192.168.2.30
1179]
MAP 192.168.2.30 1178 <- -> 203.197.143.79 1178 [172.18.0.1
53]
RDR 172.18.0.1 53 <- -> 172.18.0.1 53 [192.168.2.30
1178]
RDR 192.168.2.200 3128 <- -> 209.202.220.28 80 [192.168.2.30
1171]
MAP 203.197.143.79 35167 <- -> 203.197.143.79 36191 [172.18.0.1
53]
RDR 192.168.2.200 80 <- -> 192.168.2.200 80 [192.168.2.30
1163]
RDR 192.168.2.200 80 <- -> 192.168.2.200 80 [192.168.2.30
1162]
Any suggestions to avoid this overhead?
Regards,
sathvanth
Sathvanth.
iLabs Ltd.
85,Kutchery Road. Millennium Center
Mylapore, Chennai 600 004
Email: [EMAIL PROTECTED]
TalkToMe: 24616768, Extn: 311
