Linux iptables / conntrack performance issue
- by tim
I have a test-setup in the lab with 4 machines:
2 old P4 machines (t1, t2)
1 Xeon 5420 DP 2.5 GHz 8 GB RAM (t3) Intel e1000
1 Xeon 5420 DP 2.5 GHz 8 GB RAM (t4) Intel e1000
to test linux firewall performance since we got bitten by a number of syn-flood attacks in the last months. All machines run Ubuntu 12.04 64bit. t1, t2, t3 are interconnected through an 1GB/s switch, t4 is connected to t3 via an extra interface. So t3 simulates the firewall, t4 is the target, t1,t2 play the attackers generating a packetstorm thorugh (192.168.4.199 is t4):
hping3 -I eth1 --rand-source --syn --flood 192.168.4.199 -p 80
t4 drops all incoming packets to avoid confusion with gateways, performance issues of t4 etc. I watch the packet stats in iptraf. I have configured the firewall (t3) as follows:
stock 3.2.0-31-generic #50-Ubuntu SMP kernel
rhash_entries=33554432 as kernel parameter
sysctl as follows:
net.ipv4.ip_forward = 1
net.ipv4.route.gc_elasticity = 2
net.ipv4.route.gc_timeout = 1
net.ipv4.route.gc_interval = 5
net.ipv4.route.gc_min_interval_ms = 500
net.ipv4.route.gc_thresh = 2000000
net.ipv4.route.max_size = 20000000
(I have tweaked a lot to keep t3 running when t1+t2 are sending as many packets as possible).
The result of this efforts are somewhat odd:
t1+t2 manage to send each about 200k packets/s. t4 in the best case sees aroung 200k in total so half of the packets are lost.
t3 is nearly unusable on console though packets are flowing through it (high numbers of soft-irqs)
the route cache garbage collector is no way near to being predictable and in the default setting overwhelmed by very few packets/s (<50k packets/s)
activating stateful iptables rules makes the packet rate arriving on t4 drop to around 100k packets/s, efectively losing more than 75% of the packets
And this - here is my main concern - with two old P4 machines sending as many packets as they can - which means nearly everyone on the net should be capable of this.
So here goes my question: Did I overlook some importand point in the config or in my test setup? Are there any alternatives for building firewall system especially on smp systems?
