From owner-freebsd-questions@FreeBSD.ORG Fri Jun 24 21:02:01 2005 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id E4F6C16A41C for ; Fri, 24 Jun 2005 21:02:01 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from rosebud.otenet.gr (rosebud.otenet.gr [195.170.0.94]) by mx1.FreeBSD.org (Postfix) with ESMTP id 50C5D43D1D for ; Fri, 24 Jun 2005 21:02:01 +0000 (GMT) (envelope-from keramida@ceid.upatras.gr) Received: from gothmog.gr (patr530-b172.otenet.gr [212.205.244.180]) by rosebud.otenet.gr (8.13.4/8.13.4/Debian-1) with ESMTP id j5OL1wLq004998; Sat, 25 Jun 2005 00:01:59 +0300 Received: from gothmog.gr (gothmog [127.0.0.1]) by gothmog.gr (8.13.4/8.13.4) with ESMTP id j5OL1uAG001357; Sat, 25 Jun 2005 00:01:56 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Received: (from giorgos@localhost) by gothmog.gr (8.13.4/8.13.4/Submit) id j5OL1u68001356; Sat, 25 Jun 2005 00:01:56 +0300 (EEST) (envelope-from keramida@ceid.upatras.gr) Date: Sat, 25 Jun 2005 00:01:56 +0300 From: Giorgos Keramidas To: Ean Kingston Message-ID: <20050624210156.GC1055@gothmog.gr> References: <5fd642fc05062406331e283ffe@mail.gmail.com> <200506241059.11035.ean@hedron.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200506241059.11035.ean@hedron.org> Cc: freebsd-questions@freebsd.org Subject: Re: firewall on freebsd X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jun 2005 21:02:02 -0000 On 2005-06-24 10:59, Ean Kingston wrote: > For anyone who wants to start the in-kernel vs user-land NAT argument, > I've already been through it and there are valid arguments for both > sides. So, I won't get into it again. Agreed. Most of the people who use FreeBSD in SOHO installations (small office, home office), and have far less than dozens of systems behind a NAT-ting FreeBSD system will very rarely have a chance to notice *ANY* difference between userlevel vs. in-kernel NAT. This top snapshot: http://keramida.serverhive.com/pixelshow-top.txt is from a relatively recent demo-party where ipfw/natd were used in a gateway of more than 100 systems madly downloading files from each other and from the wide Internet. Notice the 97% idle cpu percentage :-) If FreeBSD can handle NAT, packet forwarding, and general connectivity for more than 100 systems and still sit 97% of the time waiting for something interesting to happen, then I'd be surprised if SOHO users with less than 10-15 systems will notice anything :)