3. Performance Tests

In use, the WRAP is largely the same as the Soekris net4501. Installation of m0n0wall is identical, as is the initial configuration (please see the previous review for details). For the purposes of using m0n0wall as an Ethernet firewall, the only real differences are the processors, cases and price. With the WRAP you get the faster 266Mhz processor which has quite a significant effect on the performance over the 133 MHz processor of the Soekris net4501. Available SDRAM is 64 MB in both.

However, colour preferences aside, there is no doubt that the Soekris case is the more professionally finished, with no screws visible once assembled and the ability to remove the CompactFlash card without removing the main board. 

Below are two sets of performance data provided by Manuel Kasper showing the throughput of the firewall under NAT and packet filtering, and throughput of an IPSec VPN.

As you can see, the WRAP is certainly no slouch. What is surprising is its packet filtering and NAT performance relative to the Soekris net4801, with which it shares the same processor and Ethernet interfaces. Somehow the WRAP performs 50% better than the net4801 outbound and 27% inbound.

Manuel Kasper's explanation for this is:

"....I think I now know why the net4801s forwarding performance was inferior to the WRAP: the three NICs share IRQs on the net4801, whereas each NIC has its own IRQ on the WRAP. Due to a bug in the FreeBSD sis driver, if one NIC is disabled (as was the case with the third NIC in my tests), the driver spends lots of time trying to stop the already stopped interface during an interrupt. This has been fixed in [ed: m0n0wall] 1.1b17 (and the fix is also in 1.1). I'd expect performance to be about the same now (I haven't checked though)."

In the IPSec VPN test the net4801 catches up somewhat overtaking the WRAP by a small margin. This is again explained by Manuel as due to the tests being performed with an early beta test board of the WRAP.1C that had a 233 MHz processor (vs. 266MHz in the current product) .

Testing Notes [XP notebook] ----- LAN [device to be tested] WAN ----- [FreeBSD PC] In IPsec throughput tests, the ESP tunnel was established between m0n0wall and the FreeBSD PC (which was running racoon and FAST_IPSEC). FreeBSD PC hardware: P4 2.8 GHz (CPU usage was below 50% at all times during the tests). m0n0wall configuration: factory defaults (except for "block private networks on WAN" disabled, an inbound NAT mapping + rule in the WAN->LAN no-IPsec test and of course the IPsec tunnel). The highest of three iperf TCP readings was used (10 seconds each). All network connections 100 Mb/s Ethernet. iperf throughput between XP notebook and FreeBSD PC with no m0n0wall in between: 94 Mb/s in both directions. All test results given in Mb/s (LAN->WAN / WAN->LAN)