Date: Fri, 11 May 2007 14:42:37 +0300 From: "Todor Dragnev" <todor.dragnev@gmail.com> To: questions@freebsd.org, freebsd-isp@freebsd.org Subject: Large scale NAT Message-ID: <f72a639a0705110442p757b683fj545c75f4cc71155e@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Hello list,
I have about 4000 users behind NAT. I use ipnat(ipf) on single freebsd box(
v6.2) to translate RFC1918 ip addresses to real one.
In ipnat.conf I have:
---
map vlan0 10.X.0.0/16 -> a.b.c.X/32 proxy port ftp ftp/tcp
map vlan0 10.X.0.0/16 -> a.b.c.X/32 portmap tcp/udp auto
map vlan0 10.X.0.0/16 -> a.b.c.X/32
---
Where X is in range from 0 to 40.
$ "ipnat -s"
mapped in 1192241264 out 1082773308
added 58509192 expired 0
no memory 65394 bad nat 9642
inuse 212292
rules 1160
wilds 2
$ netstat -w 1
input (Total) output
packets errs bytes packets errs bytes colls
75681 0 47043801 73193 0 38853537 0
74908 0 46345012 72391 0 37946719 0
CPU: Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz (1864.81-MHz 686-class
CPU)
network cards
em0: <Intel(R) PRO/1000 Network Connection Version - 6.2.9>
sk0: <3Com Gigabit NIC (3C2000) rev. (0x1) - Marvell Semiconductor, Inc.
Yukon>
All works fine, but my CPU usage is very high and router starts to drop
packets and sometimes freeze.
I fix freezes problem with POLLING but CPU usage is still very high.
Throughput on one interface is about 200Mbit/s, but next month I will need
more speed to pass through this box and I looking for better solution
What is the throughput limit what I can expect from FreeBSD in this
situation?
Are someone in the list have experience with large NAT tables?
It is time to switch to Cisco or something similar - any suggestions ?
Thanks,
Todor Dragnev
--
There are no answers, only cross references
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?f72a639a0705110442p757b683fj545c75f4cc71155e>