Community discussions

MikroTik App
 
olegon
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 90
Joined: Sat Sep 09, 2017 11:15 am

Firewall rules optimizations in ROS

Tue Apr 19, 2022 7:56 pm

Is any rules checking optimization is exists in Mikrotik?
Sample:
Two interfaces 1 and 2.
Big traffic flow from 1. Small traffic flow from 2.
I need to check flow with big address list. And I know, that adresses from list can coming only from 2.
Will ROS check big traffic flow from 1 with big address list, if I'll add in_interface=2 ? Or it'll check 1+2 flow not only with list, but and with interface name?
 
Sob
Forum Guru
Forum Guru
Posts: 9120
Joined: Mon Apr 20, 2009 9:11 pm

Re: Firewall rules optimizations in ROS

Wed Apr 20, 2022 4:07 am

I'd expect that some such optimizations do exist. Some conditions are easier to evaluate than others, so it would make sense to check easy ones first.

Unfortunately, it's not the proof, it happened before that I expected something, because it made sense, and it turned out that I just was too optimistic. It may be possible to test it with different rules, if you generate some controlled level of traffic, see how's the load with only difficult conditions (for example L7 filters should be bad), then add some simple condition and see if there's any difference.

Address lists may not be too bad, they don't check addresses one by one, but they are hashed (see ipset in Linux).
 
olegon
Frequent Visitor
Frequent Visitor
Topic Author
Posts: 90
Joined: Sat Sep 09, 2017 11:15 am

Re: Firewall rules optimizations in ROS

Wed Apr 20, 2022 10:42 am

Yes, I used ipset for a long time and I understand the mechanism of its action. However, an independent search and conclusions about internal algorithms may be erroneous. I do not have a device where there would not be other rules that can lead to erroneous conclusions.
It's not just the adress lists (it's the sample). If you understand the order and weight of options, you can add generally insignificant options to check that would facilitate the rules load in general, and noticeably reduce the CPU load.

Who is online

Users browsing this forum: cmmike, McGremlin, NightWolf and 41 guests