Benchmark

Benchmark

[Alejandro Flores]

	Hello there,

	Well, I've been teaching netfilter/iptables for a while, and always
there's someone asking about performance. Normally, they use other kind
of firewall, like cisco pix or checkpoint. Is there any benchmark out
there?
	Another point is, how much user-chains can degrade the performance?
IMHO, user chains are simple the best to help you organize and separate
rules in groups. But, how can I measure if it's degrading the
performance?

Thanks!
Alejandro

Ps. Sorry my poor english!

Re: Benchmark

[Michael Gale]

Hello,

	Well I am not expert but I think that user chains could improve performance. If you had in total 1000 rules and no user
chains, a packet may have to go through 999 rules to find a match or no match. If you broke up your 1000 rules into 25
different user chains a packet would at most have to be matched against 24 user chains and then only be checked against
required chains and not other rules.

Michael.


On Tue, 13 Jul 2004 18:04:43 -0300
Alejandro Flores <alejandro.flores@triforsec.com.br> wrote:

> 	Hello there,
> 
> 	Well, I've been teaching netfilter/iptables for a while, and always
> there's someone asking about performance. Normally, they use other kind
> of firewall, like cisco pix or checkpoint. Is there any benchmark out
> there?
> 	Another point is, how much user-chains can degrade the performance?
> IMHO, user chains are simple the best to help you organize and separate
> rules in groups. But, how can I measure if it's degrading the
> performance?
> 
> Thanks!
> Alejandro
> 
> Ps. Sorry my poor english!
> 
> 
> 
> 
> 


-- 
Michael Gale
Network Administrator
Utilitran Corporation

Re: Benchmark

[Alejandro Flores]

	Hello Michael,

	Agreed. If well designed, it will improve performance. But, what is the
cost to send a packet to another chain? And if you have something like:
	iptables -A INPUT -i eth0 -p tcp -j C1
	iptables -A C1 -p tcp --dport 22 -j C1_SSH
	iptables -A C1_SSH -s 192.168.0.2/32 -j ACCEPT
	iptables -A C1_SSH -s 192.168.0.7/32 -j ACCEPT
	iptables -A C1_SSH -s 192.168.0.23/32 -j ACCEPT

	When the packet arrives, and it's from 192.168.0.7, it will be handled
by INPUT, then C1 and finally C1_SSH at the second rule. What I'm trying
to discover is, what is the cost to send the packet from one chain to
another. It's more easy to configure and maintain your rules with
user-chains, but how much it will cost in performance, if instead of the
above example, I use the following rules:

iptables -A INPUT -i eth0 -p tcp --dport 22 -s 192.168.0.2/32 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 22 -s 192.168.0.7/32 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 22 -s 192.168.0.23/32 -j ACCEPT


Regards!
Alejandro Flores

> Hello,
> 
> 	Well I am not expert but I think that user chains could improve performance. If you had in total 1000 rules and no user
> chains, a packet may have to go through 999 rules to find a match or no match. If you broke up your 1000 rules into 25
> different user chains a packet would at most have to be matched against 24 user chains and then only be checked against
> required chains and not other rules.
> 
> Michael.
> 
> 
> On Tue, 13 Jul 2004 18:04:43 -0300
> Alejandro Flores <alejandro.flores@triforsec.com.br> wrote:
> 
> > 	Hello there,
> > 
> > 	Well, I've been teaching netfilter/iptables for a while, and always
> > there's someone asking about performance. Normally, they use other kind
> > of firewall, like cisco pix or checkpoint. Is there any benchmark out
> > there?
> > 	Another point is, how much user-chains can degrade the performance?
> > IMHO, user chains are simple the best to help you organize and separate
> > rules in groups. But, how can I measure if it's degrading the
> > performance?
> > 
> > Thanks!
> > Alejandro
> > 
> > Ps. Sorry my poor english!
> > 
> > 
> > 
> > 
> > 
> 

Re: Benchmark

[Julian Gomez]

On Tue, Jul 13, 2004 at 06:32:52PM -0300, Alejandro Flores spoke thusly:

>Hello Michael,
>
>Agreed. If well designed, it will improve performance. But, what
>is the cost to send a packet to another chain? And if you have
>something like:

I don't have those numbers.

>When the packet arrives, and it's from 192.168.0.7, it will be handled
>by INPUT, then C1 and finally C1_SSH at the second rule. What I'm
>trying to discover is, what is the cost to send the packet from one
>chain to another. It's more easy to configure and maintain your rules
>with user-chains, but how much it will cost in performance, if instead
>of the above example, I use the following rules:

That's relative right? If you properly organise your user-chains taking
into account that more frequent traffic types are at the top - then
performance wise, you shouldn't be seeing that dramatic a hit.

On an old bastion host I used to control, I had 6,000++ rules running at
one time (_no optimisation_ at all). I didn't notice a performance hit,
except adding/deleting rules took a bit of time to fully finish; but
Harald has mentioned that problem before on the list - its due to the
way the rules are stored (circular link list?) IIRC.

For good security- your rulesets should be really small (where
possible!) otherwise it becomes a nightmare to maintain.

In regards to "rule sorting" google the firewall-wizards mailing list
archives, Paul Robertson has participated in a couple of interesting
threads on the subject.

(snip)