PF ruleset optimalization part: 1
This is the first installment in a series of three articles about PF. I originally wrote them as chapters for a book, but then publication was cancelled. Luckily, the rights could be salvaged, and now you get to enjoy them as undeadly.org exclusives. In celebration of the upcoming OpenBSD 4.0 release. ;)
- Firewall Ruleset Optimization o Goals o The significance of packet rate o When pf is the bottleneck o Filter statefully o The downside of stateful filtering o Ruleset evaluation o Ordering rulesets to maximize skip steps o Use tables for address lists o Use quick to abort ruleset evaluation when rules match o Anchors with conditional evaluation o Let pfctl do the work for you
- Testing Your Firewall (read)
- Firewall Management (read)
Posted by Administrator on Sunday, October 29, 2006
