Date: Sat, 21 Oct 2006 08:29:25 -0500 From: Chris Bowman <chrishome@austin.rr.com> To: Brett Glass <brett@lariat.net> Cc: net@freebsd.org Subject: Re: Avoiding natd overhead Message-ID: <453A20B5.9010108@austin.rr.com> In-Reply-To: <200610210648.AAA01737@lariat.net> References: <200610210648.AAA01737@lariat.net>
next in thread | previous in thread | raw e-mail | index | archive | help
I see this question come up now and then on the lists, so, I'll share what I've learned about natd and performance! First, if your running natd on a processor which supports more functions than just a standard 386, ie a Pentium, Athlon, etc. Then I've found compiling natd with make flags for that processor, and with O3 optimizations will make your jaw drop in comparison to the default installed version of natd. You can find if you have the sources downloaded for FreeBSD the natd source in /usr/src/sbin/natd , just recompile natd itself, or when you re-build world for your system, make sure you have make flags set in make.conf so everything will rebuild with optimized flags, however I don't recomend O3 at all for a build world, will almost definately break something, for natd itself, it works fine. That's about it! Very simple, but I think it's often overlooked, and of course there are a few variables with NAT and performance, number of hosts, number of connections each host is using simulataneously (Torrents *cough). You don't want to overload NATd itself, 65535 TCP, UDP ports, keep that in mind. If your doing nat for a large number of hosts, break down your ip range into sections and run natd multiple times to help balance the load. Thanks! Chris Bowman Brett Glass wrote: > I'm working with a FreeBSD-based router that's using IPFW for policy > routing, traffic shaping, and transparent proxying and natd for > network address translation. IPFW does these things pretty well (in > fact, I don't know if another firewall, like pf, could even do some of > these things I'm doing with IPFW), but natd is by far the most > CPU-intensive process on the system and is causing it to crumple like > a wet towel under heavy loads. How can I replace just the > functionality of natd without moving to an entirely new firewall? Can > I still select which packets are routed to the NAT engine, and when > this occurs during the processing of the packet? > > --Brett Glass > > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?453A20B5.9010108>