Date: Sun, 21 Oct 2012 17:06:46 -0700 From: Julian Elischer <julian@freebsd.org> To: "Andrey V. Elsukov" <ae@freebsd.org> Cc: ipfw@freebsd.org, net@freebsd.org Subject: Re: [RFC] Enabling IPFIREWALL_FORWARD in run-time Message-ID: <50848E16.6060008@freebsd.org> In-Reply-To: <508138A4.5030901@FreeBSD.org> References: <508138A4.5030901@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On 10/19/12 4:25 AM, Andrey V. Elsukov wrote: > Hi All, > > Many years ago i have already proposed this feature, but at that time > several people were against, because as they said, it could affect > performance. Now, when we have high speed network adapters, SMP kernel > and network stack, several locks acquired in the path of each packet, > and i have an ability to test this in the lab. > > So, i prepared the patch, that removes IPFIREWALL_FORWARD option from > the kernel and makes this functionality always build-in, but it is > turned off by default and can be enabled via the sysctl(8) variable > net.pfil.forward=1. > > http://people.freebsd.org/~ae/pfil_forward.diff > > Also we have done some tests with the ixia traffic generator connected > via 10G network adapter. Tests have show that there is no visible > difference, and there is no visible performance degradation. > > Any objections? > The number of times I've been brought to a running production system and asked "can you do (mumble) to solve problem 'X' ?", and my answer has been "well we'll have to recompile a kernel to get IPFIREWALL_FORWARD, but then, yes" to be met by "oh but we can't shutdown until XXX days from now due to uptime constraints and rules." is more than I can remember. (mostly back in Vicor days) but in fact, right now I have a system where I want to do this but the original source tree it was built from has been lost so I need to actually rebuild the entire system just to get it. (It's an embedded system) so yes please!
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?50848E16.6060008>