NFShunt: A Linux firewall with OpenFlow-enabled hardware bypass
NFShunt: A Linux firewall with OpenFlow-enabled hardware bypass
复制标题
NFShunt：支持 OpenFlow 的硬件旁路的 Linux 防火墙
DOI：
10.1109/nfv-sdn.2015.7387413
复制
发表时间：
2015
期刊：
影响因子：
--
通讯作者：
S. Hazelhurst
中科院分区：
文献类型：
--
作者：
S. Miteff;S. Hazelhurst
数据密集型研究计算需要能够以高吞吐量长距离传输文件。状态防火墙引入足够的数据包丢失，以防止研究人员充分利用高带宽延迟的网络链路。为了解决这一挑战，Science DMZ设计通过普通以太网交换机权衡了有状态数据包过滤功能和无丢失转发功能[1]。我们提出了一种新的扩展科学DMZ设计，它使用基于SDN的防火墙。介绍了一种基于Linux的Netfilter和OpenFlow交换技术的防火墙NFShunt。NFShunt实现为与Netfilter的连接跟踪耦合的OpenFlow 1.0控制器，允许将旁路交换策略表示为iptables防火墙规则集的一部分。我们的实现进行了详细描述，并报告了延迟的控制平面机制。TCP吞吐量和数据包丢失显示在各种往返延迟，与纯交换，以及高端思科防火墙的比较。研究结果支持了有关防火墙引入数据包丢失的观察报告，并表明NFShunt的SDN设计是增强传统防火墙以满足数据密集型研究人员性能需求的可行方法。
Data-intensive research computing requires the capability to transfer files over long distances at high throughput. Stateful firewalls introduce sufficient packet loss to prevent researchers from fully exploiting high bandwidth-delay network links. To work around this challenge, the Science DMZ design trades off stateful packet filtering capability for loss-free forwarding via an ordinary Ethernet switch [1]. We propose a novel extension to the Science DMZ design, which uses an SDN-based firewall. This paper introduces NFShunt, a firewall based on Linux's Netfilter combined with OpenFlow switching. Implemented as an OpenFlow 1.0 controller coupled to Netfilter's connection tracking, NFShunt allows the bypass-switching policy to be expressed as part of an iptables firewall rule-set. Our implementation is described in detail, and latency of the control-plane mechanism is reported. TCP throughput and packet loss is shown at various round-trip latencies, with comparisons to pure switching, as well as to a high-end Cisco firewall. The results support reported observations regarding firewall introduced packet-loss, and indicate that the SDN design of NFShunt is a viable approach to enhancing a traditional firewall to meet the performance needs of data-intensive researchers.