WAN Load balancing - Firewall Disabled

Zeds

I am running pfSense as a routing only platform - To clarify I have enabled "Disable all packet filtering" under the System->Advanced->Firewall & NAT section of the config.

I created a gateway group with multiple gateways, all on the same tier, but load balancing does not seem to occur. Failover seems to work fine.

I read through the documentation and I think its saying that load balancing is a function of the firewall engine.

I'm looking for verification of that and to understand if that is the case, is there is any way to do gateway load balancing with the firewall disabled.

jimp

Policy routing, load balancing, etc all require pf. You can't do those with pf disabled.

Zeds

I did some testing and can get a little over 9gbps through it with pf disabled (on a 10gbps links).

If I enable pf and add bidirectional any/any allow rules, what kind of overhead should I expect to see?

Also, with enabling pf, which settings and features would I want to disable to make it the least firewally?

I like the idea of some of these features, but want it to feel more like a router than a firewall.

johnpoz

@Zeds said in WAN Load balancing - Firewall Disabled:

but want it to feel more like a router than a firewall.

Kind of what TNSR is for - high speed routing..

jimp

The overhead could be significant but it entirely depends on your hardware so there isn't any hard and fast set of rules/percentages to estimate it.

As for what you would need to add or disable, just add rules to pass anything you need in and out, and make sure you disable outbound NAT. Otherwise things should be just about the same whether or not pf is enabled or disabled.

Zeds

Just to close the loop on this - I re-enabled pf with any/any inbound and outbound with NAT disabled and have not found any resulting issues.

From a performance perspective, I saw about a 50% performance hit in throughput. Luckily, I'm running this instance as a VM so by adding a second core to this instance, I'm back to near wire speed with pf running.

ESXi 7 on AMD Ryzen 5 3600 CPU if anyone is interested.

Thanks for the replies on this.