How many firewall rules are too many?

Installing and Using OpenWrt Network and Wireless Configuration
1

I have effectively no knowledge of how OpenWrt's firewall works internally. I have to assume that there is a performance impact for larger rulesets but I have no idea how severe it might be, or how one would accurately benchmark it.

Is this impact significant in practice? How many "traffic rules" might start to be too many? Should I be more concerned with keeping the number absolutely minimized, even if that means being less specific, or can I be comfortably detailed with my rules and not really worry about it?

2

Trial and error?

Too many variables to compute. What is complex, what is many, what's the host performance - what kills the wrt-54gl wouldn't even register on a gl-mt6000.

1 Like
3

initial packet filter can pass enormous amount of rules. Something like 100-10000 iifname or 50-5000 dscp set will make a measurable millisecond. Other expressions are by magnitude faster
more important is main flow "established accept" that should not do unnecessary inspections in other hooks. eg snat dnat not guarded by eg ct status dnat,assured return
Example

"Visual" trace

one bad pattern comes off miniupnpd

inverting slh-s claim - you need a very weak router cpu to measure, like ath79 or mt7628 7620

1 Like
4

Yes netfilter shows afaik no difference with 100 or 10k rules.
Some handlers are more expensive then others but presentations at the net plumber conference showed no major impacts. Iirc you can even handle upto 100k of Rules and with proper hardware you can even offload most of rules...

With x86 you can easily handle 10, 40 or even 100gbit/s with like mellanox connect x.
And with OpenWrt Linux Kernel and beefy hardware and can easily handle moderate small to mid size business Datacenter need if you really want to.

1 Like
5

Or, to approach it from another angle, what is the purpose of a firewall? To keep stuff in or keep stuff out? If it's to keep stuff out then why would you need vast numbers of firewall rules? Rework your network design.
If it's an industrial/commercial large scale network and uses professional equipment then all bets are off.

6

That approach misses the point of the question, I think, which boils down to "what is the definition of a vast number" with respect to firewall rules in OpenWrt.

I didn't know if I should expect a problematic number to be on the order of 20 or 200 or 2000.

But based on the answers from @brada4 and @_bernd, it seems safe to say that hundreds of rules are likely fine even on a low-end device, and thousands+ for more performant hardware.

That's far enough above my needs to be classified as "not significant".

7

No idea what approach you aretalking about. Default ruleset has measurably heavy per-packet rule?

8

This article covers benchmarks against number of rules.
Practically speaking you won’t hit these numbers (in my opinion).

These benchmarks were likely performed on faster hardware than most routers (barring x86).

I’m sure there are combinations of rules that break this pattern, but this gives you the general gist.

3 Likes
9

I was referring to @greybeard's post that I replied to. Your post earlier was exactly the kind of answer I was looking for.

1 Like
10

You tapped on mine, no worries.

11

You can answer on a post OR the whole thread.

With default forum settings a user gets notified on a direct reply or if the users name is mentioned in the post.

Like @brada4 is now :wink: :clinking_beer_mugs:

12

I'm quoting all three of the most helpful answers to mark as the solution for this thread. Thanks to everyone who got involved, I appreciate the insights.

1 Like