Hello, We have high speed applications that open up hundreads of threads per computer very fast then close then open again. At one time, we can have about 15000 tcp connections going through the firewall at once. We've recently been adding more application servers but we're noticing that the bandwidth usage isn't going up intune with the number of computers, it's actually staying around the same. We know this shouldn't be the case so am wondering if 15000+ connections is too much for a RH Linux+netfilter configuration using no stateful inspection just basic FORWARD'ing rules to block all traffic from those machines except one port coming in. Our firewall rules: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Lokkit-0-50-INPUT - [0:0] -A INPUT -j RH-Lokkit-0-50-INPUT -A RH-Lokkit-0-50-INPUT -i eth0 -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 65456 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -i lo -j ACCEPT -A FORWARD -d 192.168.168.0/27 -p udp -m udp --sport 53 -j ACCEPT -A FORWARD -d 192.168.168.0/27 -p udp -m udp --dport 53 -j ACCEPT -A FORWARD -d 192.168.168.0/27 -p tcp -m tcp --syn -j DROP -A FORWARD -d 192.168.168.0/27 -p udp -j DROP -A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --sport 53 -d 0/0 -j ACCEPT -A RH-Lokkit-0-50-INPUT -p udp -m udp -s 0/0 --dport 53 -d 0/0 -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --dport 80 --syn -j ACCEPT -A RH-Lokkit-0-50-INPUT -p tcp -m tcp --syn -j REJECT -A RH-Lokkit-0-50-INPUT -p udp -m udp -j REJECT COMMIT WE basically just allow nothing in to the subnet but everything out.. Our router is a P1.7ghz Celeron w/ 512mb ram and IDE disks and 2 3com NIC nic cards.. Is this insufficient? Our b/w usage is a mere 2.5mbits, but we have about 8mbits available, and when it goes up, we seem to add more incoming bandwidth as outgoing, it looks as though the errors or timeouts are increasing. Any ideas? Do I have to increase a limit in anyway? Thx
