Florin Andrei wrote:
So here's the thing I'm trying to solve.

Gigabit network.
Dual homed firewall, doing 1:1 NAT for a bunch of web servers. Some protocols are allowed inbound to the servers (the external, NATed addresses).
Firewall is running CentOS 5 (kernel 2.6.18)

I run pktgen on a test machine to generate a whole lot of small UDP packets with random source addresses. I send the packets to the firewall, to one of the 1:1 NATed addresses, to a port that's blocked by the firewall. Meanwhile, I'm downloading a 2GB file from a web server through the firewall, in a while [ 1 ] loop, to monitor the functioning of the firewall.

When I start the UDP flood, the current download is able to finish up, but a new one won't start. The firewall has one of the cores pegged at 100% CPU usage, with a lot of interrupts being generated all the time. I assume there's something related to conntrack, that's why I want to test stateless rules. I assume the firewall has much less work to do if it's doing everything stateless, at least at the NAT level.


Its not really related to the amount of work, conntrack has a fixed
limit of connections it will track, if you flood it with connections
it will stop accepting new ones at some point (you should see a message
about that in the ringbuffer). So as long as you have conntrack loaded
the problem will likely persist. But as I wrote, previously, 2.6.23 has
a change in the eviction algorithm that should make it behave much
better in the scenario you describe. It would be interesting if you
could test that. Alternatively you could of course just increase the
maximum number of conntracks.

Is it going to be possible to combine stateless 1:1 NAT with stateful filtering?


Yes, but that probably won't solve your problem.

By the way:
OpenBSD 4.1 as a firewall fails even worse in this test case (it freezes instantly).
OpenBSD 4.2 works fine under the UDP flood, as if nothing happened.


And Linux 2.6.23? :)

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to