Firewalld, the default firewall management tool in Red Hat Enterprise Linux and Fedora, has gained long sought support for nftables. This was announced in detail on firewalld's project blog. The feature landed in the firewalld 0.6.0 release as the new default firewall backend. The benefits of nftables have been outlined on the Red Hat Developer Blog: What comes after iptables? Its successor, of course: nftables Benchmarking nftables Migrating my iptables setup to nftables There are many longstanding issues with firewalld...
In a previous post, we introduced QinQ support for Open vSwitch. This post will investigate how QinQ performs relative to alternatives (VXLAN, GENEVE) in both throughput and CPU utilization. This will give us some understanding why we might consider QinQ over VXLAN or GENEVE. We're going to look at the following tunnel types and configurations: VXLAN-SW VXLAN in software only. No hardware offload. VXLAN-HW VXLAN with hardware offload. This includes UDP tunnel segmentation offload and receives side flow steering. GENEVE-SW...
Open vSwitch (OVS) recently gained support for 802.1ad (QinQ). It can be used as a lightweight alternative to tunnel technologies such as; VXLAN, GENEVE, GRE. A key advantage of QinQ is that it can make use of hardware offload features common in network interface cards (NICs). Only newer NICs support hardware offload for VXLAN and GENEVE. QinQ also incurs less frame processing and has a smaller encapsulation overhead. QinQ is an IEEE standard formally known an 802.1ad. It has been...
