Cedric Blancher wrote:
Le mardi 21 juin 2005 à 17:36 +0800, Feizhou a écrit :
netfilter's conntrack module sucks in performance and at the same time
is not fully stateful.
The last serious paper I could read about performances comparison was
published on pf website long ago and desmonstrated a clear advantage for
Netfilter against pf or ipf.
http://www.benzedrine.cx/pf-paper.html
Yes...when NOT doing stateful. I have no arguments for netfilter's
filtering performance. Filtering barely adds overhead for my boxes.
Loading the conntrack module however had some painful effects...
However, at this time, Netfilter was indeed not fully stateful. But it's
no longer the case as Netfilter now implements TCP window tracking in
stock kernels.
Ah, sorry, I knew that this was brought up some time ago but I did not
the end result. I take back my not fully stateful statement.
If you know good comparisons published, I wuold be happy to read them.
I will try a Linux based bridge setup in place of our OpenBSD firewall
now that we can get some equivalency in function. Or just go stateless.
Any suggestions on what kernel version to use? A Fedora errata in case I
install Fedora Core 3/4? Or a stock Linux kernel?
