Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been asked to create a high throughput router using PC / server hardware. I'm modestly familiar with pf, iptables, and tc, but I've never had such high churn and so many rules. I hope you can help me avoid stupid solutions that won't work.

My goal is to support at least 10,000 simultaneous clients, with at least 100 clients added and removed per second. Each client will have simple bidirectional routing rules with the following functionality:

  • IPv6 only
  • Forward packet (replacing source and dest addresses)
  • Record bytes received
  • Stop forwarding after a set amount of data was received

My concern is that creating and destroying 100 rulesets per second will kill performance due to some hidden mutex.

My candidate solutions are:

  • OpenBSD with pf. This is my preferred solution.
  • Debian with iptables + tc.
  • A custom kernel module. I'd prefer not to do this, but I will if I must.

Which of these solutions will scale best? What tricks should I use to get the best performance I can?

share|improve this question

While I’ve never tried doing what you are doing, the best way to do this with OpenBSD will likely be with tables as you can easy add/remove IPs from tables.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.