Hacker News Reader

As a general rule it’s a mistake to put a stateful firewall in front of a DNS server (at least for UDP). Sadly it’s one of those nuggets of operational knowledge that keeps being rediscovered the hard way.

View on HN

pf is on by default in OpenBSD, which is definitely the wrong thing to do on simple servers. I typically disable it and bring the system down to minimal services instead.

OTOH, pf can handle very large state tables with ease. I also use a cluster of pf boxes to front-end a network with 20000+ users and it rides around 500000 to 800000 states every day.

Let’s say, for example, you make the mistake of putting a stateful firewall between your users and your recursive DNS servers. As a rough guide, you can expect about 0.1 DNS query per second per user, so about 2000 qps for your site (average, peaks will be higher). Firewalls often rely on a timeout for expiring UDP state, let’s say, 5 minutes or 300 seconds. In this example, the firewall will be keeping 600 000 useless states.

i just checked my main user-facing dns servers, and indeed i disabled pf on them

on my big-boi pf NAT cluster, i keep the udp timeout relatively low to deal with state table congestion:

set limit { states 1000000, src-nodes 100000 } set state-defaults pflow, sloppy set state-policy floating set timeout src.track 240 set timeout udp.multiple 120

Reply on news.ycombinator.com