I had to put a firewall between our web servers and the database box. I'll confess I wasn't totally convinced it was worth the effort... but I finally did it.

Unfortunately, the device I chose (Linksys RVS4000) is a complete pooch. Oh sure, it has 1Gb interfaces on both sides but I'm getting way under 100Mb throughputs. The next device I tried is more of a traditional Firewall and doesn't appear to want to route private addresses (WatchGuard x55e).

So, for those of you who put firewalls between web and db servers, what do you use?

Note: Let's not debate the usefulness of said firewall, in this case it is a client requirement and not up for debate... I just want to get something working without a major performance hit.

If curious, this blog post has more details.

[Updated 10/9/2009] Once I flashed the WatchGuard to the latest major release upgrade (11.0.1) it handles all the routing properly. I'll know more about performance after some testing this weekend.


We use Cisco ASA's (active/passive pairs) between our segments, they have worked well. If 100 Mb/s is fast enough for you even the lowest end 5505 is rated to pass traffic at 150Mb/s See here for the model comparison.

  • I'm still working with WatchGuard support, but if I can't get this sorted out with them I believe I'll be shopping for a 5505 next. – Chris_K Oct 7 '09 at 14:10

Instead of proposing anoher device, i suggest to debug the problem with the Linksys. I had this problem once when QoS was the culprit for a lack of performance: the maximum available bandwidth was way below the real throughput available. So, first of all, i'd disable every trace of bandwidth management on said firewall. Second, it's a very basic trick and maybe you already tried that, but have you set EVERY network card involved (on the web server, on the db server, and both nics on the Linksys) to a fixed speed of 1000Mb/s / Full Duplex, instead of "Auto negotiation"? In my experience it often caused troubles between this kind of device.

  • Good points. I had disabled everything on the Linksys (including the firewall itself) and saw no improvements. I don't see much hope there. However, I wonder if I should try again forcing 10000FD. But if the server thought it was 1000FD and the Linksys reported it and the HP ProCurve in front of the Linksys also reported the same speed, does forcing them all really matter? (since they all appear to be on the same page). – Chris_K Oct 4 '09 at 21:59
  • 1
    I've seen where auto-negotiate, even when it looks like it's doing what you think it's doing, it killing your throughput. So unless you have a need to auto-negotiate, my advice is to set it all the same and see if that makes things better. – Milner Oct 9 '09 at 15:43

I'll typically use one of these Supermicro 1U Servers and Vyatta, or some other Linux distro and FireHOL (if I need to add services other than just routing).


Small box with a flash card in read-only mode running pfSense. It can do some packet filtering (although I'm not sure what type you want to do) but you can tune it and it is really fast. Test with the NICs first obviously for throughput. Some need a few tweats to get full speed.

Once on full speed, bump the state table limit up and then increase the state timeout which will stop your long running script from timing out. I'm recommend having the timeout at least 30 seconds longer than the connection timeout on your webservers. It'll stop idle connections that get reused from hitting the firewall and barfing.


if system based firewall or access list on your switch/router is not an option, there is always a choice of a bridging firewall (google this term if needed) that you should be able to build with any *bsd/linux box these days.


Is running a software firewall on the database server acceptable to the client? Possibly much less complex and if they already talk at 1GB, throughput isn't an issue.

  • That's something I hope to clarify this week. For that matter, I wonder if I could "get away" with using the Windows TCP/IP filtering on the adapter. – Chris_K Oct 4 '09 at 23:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.