From owner-freebsd-questions@FreeBSD.ORG Mon Mar 17 10:37:38 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 3EC051065676 for ; Mon, 17 Mar 2008 10:37:38 +0000 (UTC) (envelope-from cyberleo@cyberleo.net) Received: from pizzabox.cyberleo.net (alpha.cyberleo.net [198.145.45.10]) by mx1.freebsd.org (Postfix) with ESMTP id E3CD68FC2C for ; Mon, 17 Mar 2008 10:37:37 +0000 (UTC) (envelope-from cyberleo@cyberleo.net) Received: (qmail 17222 invoked from network); 17 Mar 2008 10:10:56 -0000 Received: from adsl-75-3-128-68.dsl.chcgil.sbcglobal.net (HELO ?172.16.44.14?) (cyberleo@cyberleo.net@75.3.128.68) by alpha.cyberleo.net with ESMTPA; 17 Mar 2008 10:10:56 -0000 Message-ID: <47DE43A8.4020909@cyberleo.net> Date: Mon, 17 Mar 2008 05:10:48 -0500 From: CyberLeo Kitsana User-Agent: Thunderbird 2.0.0.12 (X11/20080309) MIME-Version: 1.0 To: Wojciech Puchar , Ian Smith , Razmig K , Dan Nelson , freebsd-questions@freebsd.org References: <20080316163701.B14645@wojtek.tensor.gdynia.pl> <20080316160317.GA35937@owl.midgard.homeip.net> In-Reply-To: <20080316160317.GA35937@owl.midgard.homeip.net> X-Enigmail-Version: 0.95.6 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Cc: Subject: Re: IPFW with user-ppp's NAT X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Mar 2008 10:37:38 -0000 Erik Trulsson wrote: > On Sun, Mar 16, 2008 at 04:37:18PM +0100, Wojciech Puchar wrote: >>> Frankly I'm a bit surprised that this hasn't been more widely heralded, >>> as userland natd is often given as a reason to prefer other firewalls, >> what's wrong in userland natd? > > Performance. With userland natd, every packet that passes through natd > must pass from kernel to userland (causing one context switch) and back > again (causing another context switch). This will be slower and use more > CPU than doing it all inside the kernel, without any context switches. Online reconfiguration. Userland natd requires a restart (and a loss of all nat state information) when you want to change forwarded ports and such, whereas the in-kernel NAT engines (in ipf and pf, at least) support reconfiguration without flushing state. To a large extent, at least. -- Fuzzy love, -CyberLeo Technical Administrator CyberLeo.Net Webhosting http://www.CyberLeo.Net Furry Peace! - http://wwww.fur.com/peace/