Community discussions

MikroTik App
 
gabrieled209
just joined
Topic Author
Posts: 11
Joined: Thu Apr 18, 2013 6:26 pm

Order of firewall match criteria processing in a rule / performance

Thu Jul 01, 2021 6:23 pm

Hi. I recently saw this on a forum:
source: viewtopic.php?t=49106
/ip firewall mangle
add protocol=tcp dst-port=80 src-address=1.1.1.0/24 out-interface=WAN chain=forward action=mark-packet new-packet-mark=test
add protocol=tcp src-port=80 dst-address=1.1.1.0/24 in-interface=WAN chain=forward action=mark-packet new-packet-mark=test

That would mark all packet that are HTTP traffic between hosts on the 1.1.1.0/24 network and web servers with the packet mark 'test'. However, for each and every single packet you would have to do a lot of work. Is this packet TCP? Yes. Is it going to destination port 80? Yes. Is the source address within 1.1.1.0/24? Yes. Is it going out the WAN interface? No. Oh. OK. Is it a TCP packet? Yes. Is it sourced from port 80? Yes. And so on. Every packet that is traffic to a webserver would require four comparisons, every packet that is traffic from a webserver would require 8 comparions, and every packet that doesn't fit either would also require 8 comparisons, plus whatever happens afterward.
Seeing that each match criteria in a rule is a process... is there an order for each match criteria? for example: if the first thing to compare is "mark-connection", then the rest of the match criteria that the rule has, I do not care for the packages that do not comply with this mark-connection... it is right?
Last edited by gabrieled209 on Thu Jul 01, 2021 8:37 pm, edited 1 time in total.
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 11982
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: Order of firewall match criteria processing in a rule / performance

Thu Jul 01, 2021 6:41 pm

>>>and every packet that doesn't fit either would also require 8 comparisons<<<
NO, with first "fail" the packet continue

>>>is there an order for each match criteria<<<
The order is useless.

Just order on the top the highest rule used, if do not have the flag passtrough.

Who is online

Users browsing this forum: No registered users and 65 guests