That worked fine back then, but in-kernel routing/switching does not scale beyond 1-2 Mpps. Much less if you have complicated iptables rules. We're getting the

That worked fine back then, but in-kernel routing/switching does not scale beyond 1-2 Mpps. Much less if you have complicated iptables rules. We're getting there with DPDK and similar technologies, but right now, if you're running a high-bandwidth network, there's really no alternative to buying ASIC-based routing equipment from the big vendors. Even more if you're targeted by DDoS attacks, which represent the worst case: tens of gigabits of <100B packets. Source: work for a SaaS company, we tried it all