From owner-freebsd-net@FreeBSD.ORG  Wed Sep 18 08:27:32 2013
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTP id EFB294D9
 for <freebsd-net@freebsd.org>; Wed, 18 Sep 2013 08:27:32 +0000 (UTC)
 (envelope-from smithi@nimnet.asn.au)
Received: from sola.nimnet.asn.au (paqi.nimnet.asn.au [115.70.110.159])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 69D9B280F
 for <freebsd-net@freebsd.org>; Wed, 18 Sep 2013 08:27:31 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by sola.nimnet.asn.au (8.14.2/8.14.2) with ESMTP id r8I875Go039058;
 Wed, 18 Sep 2013 18:07:05 +1000 (EST)
 (envelope-from smithi@nimnet.asn.au)
Date: Wed, 18 Sep 2013 18:07:05 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: h bagade <bagadeh@gmail.com>
Subject: Re: impact of disabling firewall on performance?
In-Reply-To: <CAARSjE07M92tFmQkXPbN4_5b_eXseiYekZHkL=0b6UOK-qtixA@mail.gmail.com>
Message-ID: <20130918175406.B1460@sola.nimnet.asn.au>
References: <CAARSjE07M92tFmQkXPbN4_5b_eXseiYekZHkL=0b6UOK-qtixA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Cc: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org>
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Sep 2013 08:27:33 -0000

On Wed, 18 Sep 2013 12:00:30 +0430, h bagade wrote:
 > Hi all,
 > 
 > I've heard that disabling firewall with commands or setting related sysctl
 > parameter wouldn't increase performance and still firewalls participate in
 > forwarding process. The only way to reach a better performance is making
 > firewall modules to being loaded dynamically and thereafter unloading
 > firewall modules!

Where exactly did you hear that?

 > I want to know is it right? and if so, why it should be like this?

The difference between not invoking a firewall at all and invoking one 
with a single 'pass all' rule would be fairly difficult to measure per 
packet.  If your firewall is a bottleneck you likely have larger issues.

cheers, Ian