Performance Evaluation of netfilter: A Study on the Performance Loss When Using netfilter as a Firewall

TL;DR

This paper experimentally evaluates the throughput performance of Linux's netfilter firewall under various conditions, revealing small throughput losses related to rule count and address family, with insights into client handling techniques.

Contribution

It provides comprehensive experimental data on netfilter performance across multiple configurations, highlighting factors affecting throughput loss and comparing client connection handling methods.

Findings

Throughput loss is nearly linear with rule table size.

IPv4 and IPv6 address families impact throughput differently.

Client handling techniques like threads and epoll() show performance variations.

Abstract

Since GNU/Linux became a popular operating system on computer network routers, its packet routing mechanisms attracted more interest. This does not only concern 'big' Linux servers acting as a router but more and more small and medium network access devices, such as DSL or cable access devices. Although there are a lot of documents dealing with high performance routing with GNU/Linux, only a few offer experimental results to prove the given advices. This study evaluates the throughput performance of Linux' routing subsystem netfilter under various conditions like different data transport protocols in combination with different IP address families and transmission strategies. Those conditions were evaluated with two different types of netfilter rules for a high number in the rule tables. In addition to this, our experiments allowed us to evaluate two prominent client connection handling techniques (threads and the epoll() facility). The evaluation of the 1.260 different combinations of our test parameters shows a nearly linear but small throughput loss with the number of rules which is independant from the transport protocol and framesize. However, this evaluation identifies another issue concerning the throughput loss when it comes to the address family, i.e. IPv4 and IPv6.