Re: Using Netfilter with high bandwidth

[Luigi Rizzo <rizzo@iet.unipi.it>]

On Mon, Sep 03, 2012 at 09:56:20AM +0200, Jesper Dangaard Brouer wrote:
> On Sat, 2012-09-01 at 00:39 +0200, Jan Engelhardt wrote:
> > On Friday 2012-08-31 21:38, Julien Vehent wrote:
...
> > > * How much traffic can we expect to route to a decently configured Firewall ?
> > > Can we target 10GBPS with good NICs/CPUs and proper kernel tuning, or is that
> > > completely out of range ?
>
> I did a lot of 10Gbit/s routing testing back in 2009:
> http://vger.kernel.org/netconf2009_slides/LinuxCon2009_JesperDangaardBrouer_final.pdf
> 
> Which showed that Intels Nehalem microarchitecture, was capable of doing
> 10Gbit bi-directional routing on Linux.  Combined with multiqueue NICs,
> where the Intel 10G NIC were the winning NIC.  (Disclaimer, this testing
> were without iptables rules)
> 

Jesper's report is extremely interesting but covers routing.
For firewalls, it might be interesting to have a look at the
netmap+ipfw integration

	http://info.iet.unipi.it/~luigi/dummynet/#8696

which i recently completed and runs on linux as well (uses a kernel
module for network I/O, and a userspace versions of ipfw and dummynet
for the firewalling, scheduling, shaping).
I measured over 6 million packets per second (Mpps) with simple
rulesets, and over 2.2 Mpps through dummynet pipes.
This is with 1 core doing the processing.

The links from there should bring you to the other relevant
pieces, but just in case

    http://info.iet.unipi.it/~luigi/netmap
	is the netmap API, drivers etc

    http://info.iet.unipi.it/~luigi/vale
	describes the VALE soft switches, useful for testing

    http://info.iet.unipi.it/~luigi/dummynet
	features of dummynet and ipfw

cheers
luigi