Question about high perfomance Linux firewall

Question about high perfomance Linux firewall

[Javier Miguel Rodríguez]

Hello

I have to built a FAST Linux firewall (12 gigabit ethernets), and I need 
your advice

My current setup is ( I can change things if needed)

Compaq Proliant DL380g4 (1 xeon 3.6 ghz, with hyperthreading, pci-x 
based, 1 gb ram)
2 broadcom gigabit ethernet cards (tg3 driver)
3 intel quad gigabit ethernet cards (e1000 driver)


I need to keep connection tracking, so nf-hipac is discarded. I will use 
almost no logging.
My ruleset will be rather short: 500-600 lines, with SNAT/DNAT in about 
5% of these rules. Only ipv4 will
be used in this firewall setup.

I expect substained rates of 300-400 megabits on EACH gigabit interface, 
with gigabit peaks. I also expect 40.000-50.000
concurrent connections (mainly http/smtp/dns traffic). I also expect 
500-600 megabits of NATed traffic (to & from  internet)


Which gigabit ethernet card is more suitable for high perfomance 
filtering? Any special advice
about linux distro/ kernel tuning?

Thank you for your support

Re: Question about high perfomance Linux firewall

[Pasi Kärkkäinen]

On Mon, Sep 05, 2005 at 08:36:23PM +0200, Javier Miguel Rodríguez wrote:
>
> ...
> 
> Which gigabit ethernet card is more suitable for high perfomance 
> filtering? Any special advice
> about linux distro/ kernel tuning?
> 

Hi!

I've been using both tg3 and e1000 cards with Linux firewalls. Both have
been doing fine.

Hopefully somebody other can reply with some benchmarked data or more
information about these cards and their features (supported in Linux).

-- Pasi Kärkkäinen
       
                                   ^
                                .     .
                                 Linux
                              /    -    \
                             Choice.of.the
                           .Next.Generation.

Re: Question about high perfomance Linux firewall

[lst_hoe01]

Zitat von Javier Miguel Rodríguez <javier.miguel@talika.eii.us.es>:

> Hello
>
> I have to built a FAST Linux firewall (12 gigabit ethernets), and I
> need your advice
>
> My current setup is ( I can change things if needed)
>
> Compaq Proliant DL380g4 (1 xeon 3.6 ghz, with hyperthreading, pci-x
> based, 1 gb ram)
> 2 broadcom gigabit ethernet cards (tg3 driver)
> 3 intel quad gigabit ethernet cards (e1000 driver)
>
>
> I need to keep connection tracking, so nf-hipac is discarded. I will
> use almost no logging.
> My ruleset will be rather short: 500-600 lines, with SNAT/DNAT in
> about 5% of these rules. Only ipv4 will
> be used in this firewall setup.
>
> I expect substained rates of 300-400 megabits on EACH gigabit
> interface, with gigabit peaks. I also expect 40.000-50.000
> concurrent connections (mainly http/smtp/dns traffic). I also expect
> 500-600 megabits of NATed traffic (to & from  internet)

Never done such a setup but i would suggest you read
http://people.netfilter.org/kadlec/nftest.pdf
and
http://www.wallfire.org/misc/netfilter_conntrack_perf.txt

Regards

Andreas

Re: Question about high perfomance Linux firewall

[Michael Bellion]

Hi,

> I need to keep connection tracking, so nf-hipac is discarded. 

nf-hipac does support connection tracking.

regards
	Michael Bellion

Re: Question about high perfomance Linux firewall

[Javier Miguel Rodríguez]

Michael Bellion wrote:

>Hi,
>
>  
>
>>I need to keep connection tracking, so nf-hipac is discarded. 
>>    
>>
>
>nf-hipac does support connection tracking.
>
>  
>

I have been reading their website ( I have NOT tested nf-hipac) and this 
paragraph made me think that does NOT support connection tracking:

"Despite its usefulness there are still situations where you want to 
avoid the overhead of connection tracking. Although only a constant 
amount of time is added to the processing time of each packet (at least 
in theory) you may need to prevent that in order to achieve maximum 
packet rates. Those kind of setups require a highly efficient stateless 
packet filter which is very robust against DoS or DDoS attacks. Again, 
nf-HiPAC fulfils this requirement to the full extent."


Thank you for your comment, I will try it ASAP


>regards
>	Michael Bellion
>  
>

Re: Question about high perfomance Linux firewall

[/dev/rob0]

On Monday 2005-September-05 13:36, Javier Miguel Rodríguez wrote:
> My ruleset will be rather short: 500-600 lines, with SNAT/DNAT in

(That doesn't seem short to me.)

> Which gigabit ethernet card is more suitable for high perfomance
> filtering?

I know and trust the Intels, but I can't say how they will compare.

> Any special advice about linux distro/ kernel tuning?

Distro: whatever you are comfortable using. Any can do it.

CPU: 64-bit processors do not have the same memory address space 
limitation as do the 32-bit CPU's.

Kernel: if a 32-bit CPU, there are simple patches available which allow 
you to specify a LOWMEM / HIGHMEM split other than the default 1G / 3G. 
For 1G physical RAM, this is preferable to activating HIGHMEM. I think 
mine is set at 1.25G / 2.75G for 1G RAM.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

RE: Question about high perfomance Linux firewall

[Derick Anderson]

 

> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org 
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of /dev/rob0
> Sent: Tuesday, September 06, 2005 12:28 PM
> To: netfilter@lists.netfilter.org
> Subject: Re: Question about high perfomance Linux firewall
> 
> On Monday 2005-September-05 13:36, Javier Miguel Rodríguez wrote:
> > My ruleset will be rather short: 500-600 lines, with SNAT/DNAT in
> 
> (That doesn't seem short to me.)
> 
> > Which gigabit ethernet card is more suitable for high perfomance 
> > filtering?
> 
> I know and trust the Intels, but I can't say how they will compare.
> 
> > Any special advice about linux distro/ kernel tuning?
> 
> Distro: whatever you are comfortable using. Any can do it.
> 
> CPU: 64-bit processors do not have the same memory address 
> space limitation as do the 32-bit CPU's.
> 
> Kernel: if a 32-bit CPU, there are simple patches available 
> which allow you to specify a LOWMEM / HIGHMEM split other 
> than the default 1G / 3G. 
> For 1G physical RAM, this is preferable to activating 
> HIGHMEM. I think mine is set at 1.25G / 2.75G for 1G RAM.
> -- 
>     mail to this address is discarded unless "/dev/rob0"
>     or "not-spam" is in Subject: header

I would add to this that AMD processors will probably offer noticeable improvements in performance as demonstrated by http://people.netfilter.org/kadlec/nftest.pdf.

Derick Anderson