4 ms·

As a general rule it’s a mistake to put a stateful firewall in front of a DNS server (at least for UDP). Sadly it’s one of those nuggets of operational knowledg

• chriscappuccio 3y ago
  pf is on by default in OpenBSD, which is definitely the wrong thing to do on simple servers. I typically disable it and bring the system down to minimal services instead. OTOH, pf can handle very large state tables with ease. I also use a cluster of pf boxes to front-end a network with 20000+ users and it rides around 500000 to 800000 states every day.
  • fanf2 3y ago
    Let’s say, for example, you make the mistake of putting a stateful firewall between your users and your recursive DNS servers. As a rough guide, you can expect about 0.1 DNS query per second per user, so about 2000 qps for your site (average, peaks will be higher). Firewalls often rely on a timeout for expiring UDP state, let’s say, 5 minutes or 300 seconds. In this example, the firewall will be keeping 600 000 useless states.
    • chriscappuccio 3y ago
      i just checked my main user-facing dns servers, and indeed i disabled pf on them on my big-boi pf NAT cluster, i keep the udp timeout relatively low to deal with state table congestion: set limit { states 1000000, src-nodes 100000 } set state-defaults pflow, sloppy set state-policy floating set timeout src.track 240 set timeout udp.multiple 120