Linux firewall hardware specs

Linux firewall hardware specs

[Grant Moby]

Hi folks
 
I need to setup a NetFilter/Linux firewall at my
company, but I'm not sure what spec hardware box I
need.
 
There are about 100 users surfing the web, sending and
receiving email over a 256k line, a couple of subnets,
a DMZ, etc.
 
I know it's always difficult to spec things like this,
but if anyone has an idea, I'd appreciate some input.
Otherwise, any feedback like "I run 500 users through
a PIII with 128M RAM and the box is bearly keeping up"
would be appreciated.
 
Grant


__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

RE: Linux firewall hardware specs

[Aldo S. Lagana]

Back in the day...

I'd run a 486 for our 100 user T1 line company.
Filtering packets is easy
Any newer machine such as you spec'd will be just fine

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Grant Moby
Sent: Friday, September 05, 2003 8:11 AM
To: netfilter@lists.netfilter.org


Hi folks
 
I need to setup a NetFilter/Linux firewall at my
company, but I'm not sure what spec hardware box I
need.
 
There are about 100 users surfing the web, sending and
receiving email over a 256k line, a couple of subnets,
a DMZ, etc.
 
I know it's always difficult to spec things like this,
but if anyone has an idea, I'd appreciate some input.
Otherwise, any feedback like "I run 500 users through
a PIII with 128M RAM and the box is bearly keeping up"
would be appreciated.
 
Grant


__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

Re: Linux firewall hardware specs

[Gavin Hamill]

On Friday 05 September 2003 13:10, Grant Moby wrote:
> There are about 100 users surfing the web, sending and
> receiving email over a 256k line, a couple of subnets,
> a DMZ, etc.

Okies, we're running a fully stateful netfilter firewall on an old P233 with a 
2Mbps leased line, 10 very busy servers, another 50 desktop machines, and the 
loadaverage is typically about 0.01.

With 'fprobe' running for more accurate 'NetFlow' traffic reporting, the 
loadavg rises to 0.10, typically.

Even adding snort to the equation, the load settles at only 0.60 :)

I don't know how much extra load would be added by using cheap network cards, 
but we have a pair of Intel 10/100s in the firewall, and the box has been 
running flawlessly for months...

Cheers,
Gavin.

Re: Linux firewall hardware specs

[Julian Gomez]

On Fri, Sep 05, 2003 at 05:10:50AM -0700, Grant Moby spoke thusly:

>I need to setup a NetFilter/Linux firewall at my company, but I'm not sure
>what spec hardware box I need.
> 
>There are about 100 users surfing the web, sending and receiving email
>over a 256k line, a couple of subnets, a DMZ, etc.

OK. 256k line will be easily handled by a 486/Pentium 100Mhz host. How many
subnets and what is their interconnectivity ? Very high traffic Mbits/s ?

How many connections per second are initiated (to keep up with conntrack) ?
Short / long lived ?

The only way to be sure is to benchmark it in your own network, that said
-- I'll be surprised is a PII 266Mhz, 128Mb of RAM won't be able to handle
your setup. Unless you've got funky going-ons in your network :-)

(snip remaining)