NAT performance tweaks

[Eric Anderson]

Clement Laforet wrote:
> On Mon, 05 May 2003 09:41:38 -0500
> Eric Anderson <anderson at centtech.com> wrote:
> 
> 
>>Does anyone have any tweaks they apply to NAT firewalls that pass a
>>lot of connections through them?  Here's the ony tweak I have in place
>>already, but I'm not sure they're needed yet (or if there are any
>>tweaks needed at all):
> 
> 
> which NAT solution do you use ?

IPNAT and ipfilter..

>>sysctl kern.ipc.somaxconn=8192
> 
> 
> NAT'ing (except for natd which uses IPDIVERT (but not more than 3))
> doesn't use socket to translate packets.
> Generally, packets are tagged by firewall control software and
> translated within the IP stack (at leat in kernel land).

Oh yea, that's right.. So can you think of any kernel or other tweaks to 
be done, to ensure optimal usage of the machine in this environment? 
What about mail coming in/out of the machine? I do a fair amount of mail 
through it (out through NAT, in through Sendmail) also..

Eric


--
------------------------------------------------------------------
Eric Anderson	   Systems Administrator      Centaur Technology
Attitudes are contagious, is yours worth catching?
------------------------------------------------------------------