Optimizing ipfw?

[Michael Sierchio]

Don't use specific rules per CIDR block, use tables.  You can efficiently
handle hundreds of thousands of CIDR blocks and IPv6 prefixes in a single
table, or multiple tables.  You can assign the argument based on country
code or some such. You can add and delete CIDR blocks, and even swap tables
so you can do it atomically.



On Sat, Nov 23, 2019 at 8:23 AM Tim Daneliuk <tundra at tundraware.com> wrote:

> I have a boundary/gateway FreeBSD 11 machine running mostly as a NATing
> firewall.  The machine is very lightly loaded and has no memory pressure
> to speak of.
>
> Recently, I tried going from about 2800 ipfw rules to over 34,000 to block
> a number of nations completely.   This works, but is just DESTROYS my
> network throughput - It reduces it from around 175Mb/sec to 20 Mb/sec.
>
> Cables, switches, NICs etc. have been removed as suspects and falling back
> to either an open firewall or reduced ruleset firewall restores
> performance.
>
> So... is this a machine sizing problem - would a faster CPU help (this is
> an older 3.2Ghz quad core i5) or is it just the nature of a software
> firewall and I am exceeding its reasonable throughput?
>
> i.e., Is there ipfw tuning to be done or have I just hit the limits
>       of the model and need to consider a hardware firewall?
>
> P.S.  The rules in question are thousands of statements like:
>
>        ipfw  add deny all from some-IP-or-CIDR-block to any via NIC
>
>
> _______________________________________________
> freebsd-questions at freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "
> freebsd-questions-unsubscribe at freebsd.org"
>


-- 

"Well," Brahmā said, "even after ten thousand explanations, a fool is no
wiser, but an intelligent person requires only two thousand five hundred."

- The Mahābhārata