Date: Fri, 19 Nov 2004 13:18:47 -0500 From: Chuck Swiger <cswiger@mac.com> To: Stephane Raimbault <segr@hotmail.com> Cc: net@freebsd.org Subject: Re: using natd to load balance port 80 to multiple servers Message-ID: <419E3907.8000904@mac.com> In-Reply-To: <BAY24-F203179185F6D96B66806CECCC30@phx.gbl> References: <BAY24-F203179185F6D96B66806CECCC30@phx.gbl>
next in thread | previous in thread | raw e-mail | index | archive | help
Stephane Raimbault wrote: > I finally got around to testing out FreeBSD 5.3 + pf to replace my > FreeBSD 4.9 + natd to forward port 80 to multiple backend servers. I > see a huge performance diffrence. FreeBSD 5.3 + pf runs about about < 5% > where FreeBSD 4.9 + natd was doing the same thing for around 20% cpu. > I'm very happy with the performance diffrence. OK, that's good. > During my testing, I noticed that sometimes traffic going thru pf was > locking up if I was doing too many requests from the same IP concurrently. [ ... ] > when I look at the pfctl -s state and grep for the IP address of one of > these offices or firewall, I never see it go above 250 entries. Is > there some sort of limitation or limit I'm reaching that I'm not aware > of. Is this an anamoly or a bug? I don't know enough about PF to give you advice on tuning it, but no, it is not surprising that you run into anamolies when you put a sufficiently large # of connections through NAT. Re-writing every packet and keeping all of that dynamic state is somewhat expensive in terms of latency and resources, and these expenses grow in proportion to the amount of traffic present. I will repeat my suggestion that you use a real IP on your webserver and switch from doing PF + NAT to doing PF or IPFW + bridging instead. -- -Chuck
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?419E3907.8000904>