Date: Sat, 23 Nov 2019 19:46:59 +0300 From: Victor Gamov <vit@otcnet.ru> To: freebsd-questions@freebsd.org Subject: Re: Optimizing ipfw? Message-ID: <dc4e4368-1963-4184-3f6c-eb106823993f@otcnet.ru> In-Reply-To: <ac88a9fd-b3e4-a7f2-6f05-bf00df8f9626@tundraware.com> References: <ac88a9fd-b3e4-a7f2-6f05-bf00df8f9626@tundraware.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Tim You need to use table like this: ===== table srcIP create type addr table srcIP add IP1/32 table srcIP add IP2/32 table srcIP add IP3/24 add 1500 deny ip from table(srcIP) to any in recv NIC ===== In a more complex case you can add tablearg and jump to rule marked by tablearg The main idea is to check as low rules as possible while packet processed by ipfw. On 23/11/2019 19:21, Tim Daneliuk wrote: > I have a boundary/gateway FreeBSD 11 machine running mostly as a NATing > firewall. The machine is very lightly loaded and has no memory pressure > to speak of. > > Recently, I tried going from about 2800 ipfw rules to over 34,000 to block > a number of nations completely. This works, but is just DESTROYS my > network throughput - It reduces it from around 175Mb/sec to 20 Mb/sec. > > Cables, switches, NICs etc. have been removed as suspects and falling back > to either an open firewall or reduced ruleset firewall restores performance. > > So... is this a machine sizing problem - would a faster CPU help (this is > an older 3.2Ghz quad core i5) or is it just the nature of a software > firewall and I am exceeding its reasonable throughput? > > i.e., Is there ipfw tuning to be done or have I just hit the limits > of the model and need to consider a hardware firewall? > > P.S. The rules in question are thousands of statements like: > > ipfw add deny all from some-IP-or-CIDR-block to any via NIC -- CU, Victor Gamov
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?dc4e4368-1963-4184-3f6c-eb106823993f>