When should tables be used in pf.conf?

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

When should tables be used in pf.conf?

cayuga2
Hi,

        We've been using pf.conf and tables for years but have
recently embarked on a project to optimize pf.conf.

        In reading about tables it's not clear when tables are more
efficient than individual rules.  Is there a definitive point?  Is it
three entries? six entries? ten entries?

        If it's not a constant, is there a simple test that we can run
to determine if a table is more efficient than individual rules in
each case?

Thanks!
        Jeff
--

Reply | Threaded
Open this post in threaded view
|

Re: When should tables be used in pf.conf?

System Administrator-39
On 28 Mar 2015 at 8:00, Jeff wrote:

> Hi,
>
> We've been using pf.conf and tables for years but have
> recently embarked on a project to optimize pf.conf.
>
> In reading about tables it's not clear when tables are more
> efficient than individual rules.  Is there a definitive point?  Is it
> three entries? six entries? ten entries?
>
> If it's not a constant, is there a simple test that we can run
> to determine if a table is more efficient than individual rules in
> each case?
>
> Thanks!
> Jeff
> --
>
>

Aside from the documented performance advantage to using tables where
multiple hosts are involved (whatever that exact number may be), there
is a very important administrative advantage and the reason I often use
tables with as few as one or two hosts in them -- you can modify
entries in the table *without* having to reload your rule set (i.e. it
is much safer and less disruptive).

But as far as squeezing a few micro-seconds of performance (if that
much) by "optimizing" pf.conf, I would not worry about that -- the
developers are constantly improving the network stack and performance
of all of its components, including the packet filter. The primary
optimization we, the sysadmins, should focus on is manageability. All
your marginal performance gains will be lost if the resulting pf.conf
becomes unwieldy and unmanageable.