From owner-freebsd-ipfw@FreeBSD.ORG  Thu Nov  6 03:39:20 2003
Return-Path: <owner-freebsd-ipfw@FreeBSD.ORG>
Delivered-To: freebsd-ipfw@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9253E16A4CE
	for <freebsd-ipfw@freebsd.org>; Thu,  6 Nov 2003 03:39:20 -0800 (PST)
Received: from xorpc.icir.org (xorpc.icir.org [192.150.187.68])
	by mx1.FreeBSD.org (Postfix) with ESMTP id E1DF443FA3
	for <freebsd-ipfw@freebsd.org>; Thu,  6 Nov 2003 03:39:19 -0800 (PST)
	(envelope-from rizzo@xorpc.icir.org)
Received: from xorpc.icir.org (localhost [127.0.0.1])
	by xorpc.icir.org (8.12.9p1/8.12.3) with ESMTP id hA6BdJFw065757;
	Thu, 6 Nov 2003 03:39:19 -0800 (PST)
	(envelope-from rizzo@xorpc.icir.org)
Received: (from rizzo@localhost)
	by xorpc.icir.org (8.12.9p1/8.12.3/Submit) id hA6BdJBg065756;
	Thu, 6 Nov 2003 03:39:19 -0800 (PST)
	(envelope-from rizzo)
Date: Thu, 6 Nov 2003 03:39:19 -0800
From: Luigi Rizzo <rizzo@icir.org>
To: Artis Caune <ac@latnet.lv>
Message-ID: <20031106033919.A65661@xorpc.icir.org>
References: <20031106110605.E785D43FF2@mx1.FreeBSD.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <20031106110605.E785D43FF2@mx1.FreeBSD.org>;
	from ac@latnet.lv on Thu, Nov 06, 2003 at 01:04:31PM +0200
cc: freebsd-ipfw@freebsd.org
Subject: Re: loading lot of rules takes very long time
X-BeenThere: freebsd-ipfw@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: IPFW Technical Discussions <freebsd-ipfw.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-ipfw>
List-Post: <mailto:freebsd-ipfw@freebsd.org>
List-Help: <mailto:freebsd-ipfw-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw>,
	<mailto:freebsd-ipfw-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Nov 2003 11:39:20 -0000

most likely, because you are not using "-n", the printing
code will use the nameserver to try and resolve addresses, and
if halfway through you are limiting/blocking access to the
nameserver you incur in timeouts.

To tell the truth i suspect you have a quite poorly designed
ruleset if you are adding individual rules and pipes for each
client. Almost surely you should make use of masks in pipes,
and address sets in rules, to reduce the size of your ruleset
to something manageable and efficient.

	cheers
	luigi


On Thu, Nov 06, 2003 at 01:04:31PM +0200, Artis Caune wrote:
> Hello,
> 
> We have about 10000-20000 pipes for
> different subnets, and it takes very long
> time to load them - about 10-15min.
> 
> 92.8% interrupt,  0.0% idle
> 
> strange that things slow down when count
> reaches 2000-2500 rules.
> 
> is there something we can do to speed things up?
> 
> rules are added like:
>   ipfw -q add 1 pipe 1 src-ip 1.1.1.1 out via em0
>   ipfw pipe 1 config bw 30Kbytes/s queue 10
>   ...
> soo 'ipfw' is invoked '2 x client_count' !!!
> 
> maybe ipfw need feature like:
> ipfw -f /etc/rc.firewall
> 
> 
> 
> # FreeBSD-4.9, IPFW2,
> # HZ=2000, DEVICE_POLLING,
> # 1G RAM, 2.4xeon on Intel server board
> 
> 
> 
> 
> 
> .....
> Artis
> 
> 
> _______________________________________________
> freebsd-ipfw@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
> To unsubscribe, send any mail to "freebsd-ipfw-unsubscribe@freebsd.org"