Re: [9fans] NAT vs /net

[presotto@plan9.bell-labs.com]

[-- Attachment #1: Type: text/plain, Size: 814 bytes --]

At its peak there were about 20 people importing our outside interface
to inside machines.  After that we began trusting our path through the
firewall and switched to that in order to push on its harder.

The cost of importing /net is one process on the server machine per
import plus about 5 extra copies of the data due to shoving it trhough
the extra machine plus an extra header per message on the inside net
plus a bunch of context switches you wouldn't need on a nat.

The advantage is no need to worry about embedded addresses since
they would be 'real'.

For a small network, 100 or so machines, I wouldn't bother with
a NAT box and just do the import.  We're building a super-NAT
box for hiding networks the size of Lucent behind a Plan 9
box.  For that, the import surely wouldn't scale.

[-- Attachment #2: Type: message/rfc822, Size: 1452 bytes --]

From: Scott Schwartz <schwartz@bio.cse.psu.edu>
To: 9fans@cse.psu.edu
Subject: [9fans] NAT vs /net
Date: Thu, 25 Jan 2001 21:28:25 -0500
Message-ID: <20010126022825.20068.qmail@g.bio.cse.psu.edu>

On thing I've wondered about is how well importing /net scales.  That
strikes me as an elegant way for folks inside a firewall to talk to the
outside, but with lots of users it means lots of mounts, and running
into limits on number of processes and file descriptors and stuff.
Anyone tested this to destruction?