Re: ipnet/ipf performance

[Bob Beck <beck@bofh.ucs.ualberta.ca>]

>Does anyone have experience with the performance degradation induced by
>ipnat and ipf?  I'm looking at installing a firewall that'll be doing basic
>ipnat (2-6 rules) and a reasonable amount of ipf (30-40 rules) with a peak
>of 10Mb/s, ~8Mb/s sustained.  What sort of [x86] hardware would this
>require?  What about 9 Mb/s peak, 6Mb/s sustained?  Any help/hardware
>recommendations is greatly appreciated.

   Techically, yes. 
   
   practically, No, 

   I run a firewall with several VPN nodes connected via 100MB full
duplex net. I see little practical performance degredation with much
more complex filter rules than yours for unencrypted traffic. It also
runs IPSEC with several peers and I get 15-20 Mb/s through the
encrypted tunnel. Hardware (at each end of the tunnel) is Pentium II
400, Intel 10/100 Pro (fxp) ethernet cards.  You shouldn't need too
much jam to sustain 10mb/s unencrypted and just filtering.

	    -Bob