From owner-freebsd-performance@FreeBSD.ORG Wed May 28 16:41:07 2003 Return-Path: Delivered-To: freebsd-performance@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2143D37B401 for ; Wed, 28 May 2003 16:41:07 -0700 (PDT) Received: from mail.cs.ait.ac.th (mail.cs.ait.ac.th [192.41.170.16]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7A53E43F3F for ; Wed, 28 May 2003 16:41:05 -0700 (PDT) (envelope-from on@cs.ait.ac.th) Received: from banyan.cs.ait.ac.th (on@banyan.cs.ait.ac.th [192.41.170.5]) by mail.cs.ait.ac.th (8.12.3/8.9.3) with ESMTP id h4SNf1H5068194; Thu, 29 May 2003 06:41:02 +0700 (ICT) Received: (from on@localhost) by banyan.cs.ait.ac.th (8.8.5/8.8.5) id GAA07972; Thu, 29 May 2003 06:42:39 +0700 (ICT) Date: Thu, 29 May 2003 06:42:39 +0700 (ICT) Message-Id: <200305282342.GAA07972@banyan.cs.ait.ac.th> X-Authentication-Warning: banyan.cs.ait.ac.th: on set sender to on@banyan.cs.ait.ac.th using -f From: Olivier Nicole To: meconlen@obfuscated.net In-reply-to: <3ED52FFF.3060903@obfuscated.net> (message from Michael Conlen on Wed, 28 May 2003 17:54:07 -0400) References: <3ED52FFF.3060903@obfuscated.net> X-Virus-Scanned: by amavisd-milter (http://amavis.org/) cc: freebsd-performance@freebsd.org Subject: Re: High performance IDS/Firewall X-BeenThere: freebsd-performance@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Performance/tuning List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 May 2003 23:41:07 -0000 Hi Michael, > I'm considering setting up a FreeBSD firewall/IDS system to handle > 60-80Mbit/sec of traffic. The box would have three adapters, two of them > bridging and one for access. I will place the IDS on the outside bridge > interface and apply IPFW rules on the system as needed. My concern is > what the failure order is if the system is under heavy load. I am working on the same sort of problem. I had that box, with 3 ethernet adapters that I used as a router for ages. Now that I have a real router, I thought I could use it as a firewall. I am not at the snort stage yet. Bridging works fine, but it seems that statefull rules needs a high end machine, even with a low traffic (I beleive I don't go beyond 5Mbps brusts). A couple of tricks when configuring your firewall: - incoming filter rules must be attached to the outside interface, while outgoing rules are attached to the inside interface (despite they are bridged, rules on the outside inteface would not catch outgoing packets, or rather, rules on the inside interface would catch them first, so if the inside interface has a deny all...) - while bridge(4) says that non IP packets are transmitted without filtering, it seems that ARP packets are passed through the firewall. I have no answer about the default fail safe, but I will certainly install a cron script that will reset the machine whenever it find it cannot communicate anymore. Bests Olivier