Hacker News Reader

pf is on by default in OpenBSD, which is definitely the wrong thing to do on simple servers. I typically disable it and bring the system down to minimal services instead.

OTOH, pf can handle very large state tables with ease. I also use a cluster of pf boxes to front-end a network with 20000+ users and it rides around 500000 to 800000 states every day.

View on HN

Let’s say, for example, you make the mistake of putting a stateful firewall between your users and your recursive DNS servers. As a rough guide, you can expect about 0.1 DNS query per second per user, so about 2000 qps for your site (average, peaks will be higher). Firewalls often rely on a timeout for expiring UDP state, let’s say, 5 minutes or 300 seconds. In this example, the firewall will be keeping 600 000 useless states.

i just checked my main user-facing dns servers, and indeed i disabled pf on them

on my big-boi pf NAT cluster, i keep the udp timeout relatively low to deal with state table congestion:

set limit { states 1000000, src-nodes 100000 } set state-defaults pflow, sloppy set state-policy floating set timeout src.track 240 set timeout udp.multiple 120

Reply on news.ycombinator.com