FreeBSD for ALG?

S

szocske

Hi there!

I am looking for a platform to implement an externally controlled firewall.
The resulting firewall is to block all packets, except for the dynamically configured "pinholes" (or flows, or connections, ...) identified by incoming interface, source and destination IP addresses and TCP ports. It then replaces both IP addresses and ports as configured, and sends the packet out on the configured port. (please note there is no correlation between addresses and interfaces...)

The number of flows (thousands) and the packets per second (~10^5) load are not extraordinary high, but there are dozens of reconfigurations each second (adding and dropping flows).

We currently do this with linux, manipulating the conntrack table directly. It works great - on a single core. We are evaluating alternatives that could scale further on SMP systems.

Is FreeBSD for me? If yes, which firewall option do I use, and how do I access the NAT flow cache, preferably from user space?


Any advice appreciated.

Szocske
 
Is there any firewall option for Linux/BSD which is capable of running on multiple cores, today? I played with FreeBSD in combination with pf some months ago and got no more than 130.000pps because pf can't use more than one core...

cheers,
honk
 
Nothing in Linux that I know of (and would suit our needs.)
That's why I am asking here about FreeBSD :-)
 
you should check out pfsense.com
Click to expand...
which has pf under the hood and therefore runs not on more than one core today

@szocske: I'm interested what you going to achieve. Why do you need "...dozens of reconfigurations each second ..."? Loadbalancing? Censoring the internet? ;) If you need not more than 10^5 pps, you might go with pf on current hardware, but I'm not aware about the impact of the dynamic reconfiguration. Do you need redundancy also?
 
which has pf under the hood and therefore runs not on more than one core today
Click to expand...

i know, pretty obvious in the title ey? "pfsense". i was merely trying to state that it's a good firewall that is very capable except that it only runs on single core.
 
@szocske: I'm interested what you going to achieve. Why do you need "...dozens of reconfigurations each second ..."? Loadbalancing? Censoring the internet? ;) If you need not more than 10^5 pps, you might go with pf on current hardware, but I'm not aware about the impact of the dynamic reconfiguration. Do you need redundancy also?
Click to expand...

Thank you all for the attention.

I assure you I do not intend to use FreeBSD for sinister causes :-)

Sorry I can't be too specific, but imagine a central server orchestrating multimedia communication between peers.
To make this application work between otherwise isolated corporate networks, the central server opens pinholes on the firewalls.

From what I have read about PF so far, I need an interface similar to "tables" to something like the "state tables" of NAT. (which I can only query as far as I know.)

And I can't expect too much performance gain from multiple cores.
 
I've never used PF like this before, so I'm not sure if this suits your needs. Try using pfctl() to alter PF on the fly. Use persistent tables to modify IPs and anchors to load and unload rules.
 
You must log in or register to reply here.
Back
Top