IPFW In-Kernel NAT vs PF NAT Performance

[Lev Serebryakov]

On 18.03.2020 9:17, Kristof Provost wrote:

>> Which firewall gives better performance, IPFW's In-Kernel NAT or PF NAT? I am dealing with 1000s of concurrent connections but browsing-level-bandwidth at once with Tor.
>>
> I’d expect both ipfw and pf to happily saturate gigabit links with NAT, even on quite modest hardware.
> Are you sure the NAT code is the bottleneck?
 ipfw nat is very slow, really. There are many reasons, and one of them
(easy fixable, but you need patch sources and rebuild kernel/module) is
that `libalias` uses only 4096 buckets in state hashtable by default. So
it could saturate 1GBps link if you have 10 TCP connections, but it
could not saturate 100Mbit if your have, say, 100K UDP streams.

 I don't know about pf nat.

-- 
// Lev Serebryakov

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freebsd.org/pipermail/freebsd-net/attachments/20200318/515ae529/attachment.sig>