ram and processor cycles for a firewall machine
opie at 817west.com
Fri Oct 1 15:37:13 CEST 2004
On Fri, 2004-10-01 at 02:35, Askar wrote:
> hi all,
> im in the process of changing my fw machine for that atm im simulating
> and testing. I got a very fair question
> 1) How much RAM and and processor would be best for moderate firewall box?
> Unfortunatly currently my company running the fw on a P-III 500MHz
> with 128MB of RAM.
> I am wondering if I change to default DROP things (atm its default
> ACCEPT) aren't these specification kinda makes problem?
> right now 75 users online the /proc/net/ip_conntrack shows
> egrep 'ESTABLISHED|ASSURED' /proc/net/ip_conntrack | wc -l
> cat /proc/net/ip_conntrack | wc -l
(6511 * 360) / 1024 / 1024 = 2.235 MB
even if you need 5 times that number of conntrack entries at peak
load--you still would require about 11 MB of kernel memory for conntrack
if you machine has 128 MB RAM--the automatic setting for
ip_conntrack_max should be somewhere around 8192. you could easily bump
that number up to 32768 or 65536.
keep in mind that this is *kernel* memory; and therefore, cannot be
paged. if the machine needs to do "other things" (which is not a good
idea) you may want to bump up the memory just to be safe.
> well these number would probably little higher when 120 users online.
> Is my current fw machine specs adequate for such ip_conntrack load?
i would say so. one thing that you might want to keep in mind is that
if going to a "default drop" is going to cause a huge amount of logging,
you might want to use the "-m limit" match in your "-j LOG" rules and
make the rotation of your log files more aggressive.
Jason Opperisano <opie at 817west.com>
More information about the netfilter