IPTables Performance...
A message that is not in the archive (sent off-list or not yet received): [email protected]
[Cc'ing netfilter list, since that is the right place for this kind of question]
Quoted 11 lines · Scott Switzer
My company serves thousands of small HTTP requests per second (roughly 3000 connections per second with a max of 10k request size - 50Mbps bandwidth), and we have just maxed out our Netscreen 204 (128,000 simultanious sessions). The next level of Netscreen is roughly $50K, and I received advice to use either iptables or pf rather than a proprietary firewall. Since our requirements regarding the complexity of a firewall (outside of throughput) are reletively small (no complex rule sets), I am willing to look at this option.
In short:
Can iptables manage this kind of load?
sure!
Quoted 3 lines
What are the hardware resources that are needed for this? I have a AMD 2.2Ghz Opteron with 2Gb memory which could be used for this task. It this sufficient?
I would say it's way more than sufficient ;) I've been doing firewall benchmarking at multiple gigabit speeds on dual opteron boxes ;)... with a single opteron you should be able to do at least 250.000 packets per second, even without any tuning and a very suboptimal ruleset.
Quoted 1 line
What kernel would you recommend for this?
2.6.7
Quoted 2 lines
Cheers,
Scott Switzer
Signature · 5 lines
- Harald Welte <[email protected]> http://www.netfilter.org/ ============================================================================ "Fragmentation is like classful addressing -- an interesting early architectural error that shows how much experimentation was going on while IP was being designed." -- Paul Vixie