Skip to content

Comprehensive Firewall Comparison

Recently I've reviewed several different hardware Systems like the Zimaboard or the famous dec740. At the Zimaboard due to popular request I benchmarked several different firewall solutions. As those the benchmark results came out quite differently I decided to make a comprehensive comparison of several different firewall solutions, i.e

Benchmarking setup

In order to find out differences I will run several benchmarks with T-Rex 3.02 on an Intel i7 8600k with a Mellanox Connectx-4 (Dual Port) on CentOS 7.9. The device under test (DUT) is a Asrock x470 Taichi Ultimate with a Ryzen 3700x and 32 GB RAM of DDR4. It has a Mellanox Connectx-3 (Dual Port) NIC.

There are several different types of benchmarks I will run on all firewalls. There will be two iterations, first running with default settings, second with optimized settings. Most Firewall solutions come with default values, e.g. for connection limits.

Every firewall will get a WAN connection in order to load updates and for management. The WAN interface is an Intel 1G NIC which will never be benchmarked, only the 10G interfaces will.

pfSense 2.6 CE

WebGUI

OpenBSD

https://www.openbsd.org/faq/pf/example1.html

Danos

Doesn't recognize Connectx-3 as dataplane. The docs say MLX3 may be supported but sadly it seems like it's not.

Sophos

Doesn't recognize ANY interface card, neither Acquantia nor Mellanox