Re: A Router

["curby ." <curby.public@gmail.com>]

On 9/27/05, Omar <alienonearth@spymac.com> wrote:
> Hi All,
>   Can one debian router handle the routing and NAT of around 100-120 users,
> who are on 6 seperate networks?  Thanks

I agree with Mariusz, it's mostly a question of implementation.  For a
reasonably complex network, you can guess expected traffic profiles
and design the firewall so the average number of rules traversed by
packets is minimized.  For example, some people will separate UDP and
TCP rules into separate custom chains, so that UDP traffic doesn't
have to traverse TCP rules that will never match, etc.

As for hardware, I can't remember the formula for converting tracked
sessions to Megabytes of memory necessary... you can probably find
that on sites like netfilter.org.  The netfilter mailing lists also
have some threads talking about high-traffic firewalling with
netfilter... like saturating Gig or 10Gig pipes.  My organization's
network sees several terabytes of traffic a day, has over 10k users,
and successfully uses iptables to filter and monitor traffic.