Optimizing ipfw?

Victor Gamov vit at otcnet.ru
Sat Nov 23 16:47:09 UTC 2019

Hi Tim

You need to use table like this:

table srcIP create type addr
table srcIP add IP1/32
table srcIP add IP2/32
table srcIP add IP3/24

add 1500 deny ip from table(srcIP) to any in recv NIC

In a more complex case you can add tablearg and jump to rule marked by 

The main idea is to check as low rules as possible while packet 
processed by ipfw.

On 23/11/2019 19:21, Tim Daneliuk wrote:
> I have a boundary/gateway FreeBSD 11 machine running mostly as a NATing
> firewall.  The machine is very lightly loaded and has no memory pressure
> to speak of.
> Recently, I tried going from about 2800 ipfw rules to over 34,000 to block
> a number of nations completely.   This works, but is just DESTROYS my
> network throughput - It reduces it from around 175Mb/sec to 20 Mb/sec.
> Cables, switches, NICs etc. have been removed as suspects and falling back
> to either an open firewall or reduced ruleset firewall restores performance.
> So... is this a machine sizing problem - would a faster CPU help (this is
> an older 3.2Ghz quad core i5) or is it just the nature of a software
> firewall and I am exceeding its reasonable throughput?
> i.e., Is there ipfw tuning to be done or have I just hit the limits
>        of the model and need to consider a hardware firewall?
> P.S.  The rules in question are thousands of statements like:
>         ipfw  add deny all from some-IP-or-CIDR-block to any via NIC

Victor Gamov

More information about the freebsd-questions mailing list