On 18.03.2020 9:17, Kristof Provost wrote: >> Which firewall gives better performance, IPFW's In-Kernel NAT or PF NAT? I >> am dealing with 1000s of concurrent connections but browsing-level-bandwidth >> at once with Tor. >> > I’d expect both ipfw and pf to happily saturate gigabit links with NAT, even > on quite modest hardware. > Are you sure the NAT code is the bottleneck? ipfw nat is very slow, really. There are many reasons, and one of them (easy fixable, but you need patch sources and rebuild kernel/module) is that `libalias` uses only 4096 buckets in state hashtable by default. So it could saturate 1GBps link if you have 10 TCP connections, but it could not saturate 100Mbit if your have, say, 100K UDP streams.
I don't know about pf nat. -- // Lev Serebryakov
signature.asc
Description: OpenPGP digital signature
