% iptables

\subsubsection{Definition}

Iptables is a user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall, implemented as different Netfilter modules~\cite{iptables-1}. The rules are organized in tables and, for each one, there are a number of built-in chains or maybe user-defined chains.\newline
Each rule has fields to be matched in the packet and an action that is performed if the traffic has a match. If the packet does not match any rule, the following rule is examined, until the default action will be performed if no rules has matched.\newline

The test is built to be a stress-test, which simulates different situations, from the one with lowest security requirements that implements few filtering rules, to the highest critical security environment. To pretend these circumstances the performance estimation is computing with the following number of rules: [0, 10, 100, 250, 500, 750, 1000, 1500, 2000, 3000, 4000, 5000, 6000, 7000, 8000, 9000, 10000].
This is done exploiting the following bash script that receive the number of rules as parameter in input:

\hfill
\begin{figure}[H]
	\HRule
\begin{lstlisting}[numbers=left,stepnumber=1, style=Bash]
#!/bin/bash

# clear the perf-test table
iptables -F perf-test

for j in seq 1 $1; do
  
  if [[ $j -ne 22 ]] && [[ $j -ne 5201 ]] && [[ $j -ne 80 ]];then
     iptables -A perf-test -p tcp --destination-port $j -j DROP
  fi

done

exit
\end{lstlisting}
	\HRule
\end{figure}

OpenStack offers two possibilities to use Iptables as security system, one is using it directly on the Operating System of the Hypervisor, or the second choice is insert rules using the Virtual Machine's Iptables. The performance tests are developed to evaluate both of them.
\clearpage

\subsubsection{Latency test}

The following graph shows that the Iptables latency performance degrades as a straight line with the number increasing of rules.
From zero to a hundred of rules both host OS and the guest OS have the same performance, with little fluctuations due to a non complete system isolation.
The differences between them starts to diverge after $1500$ rules when the two lines diverge until reach 450 ms of difference at ten thousand rules.

\hfill
\begin{figure}[H]
	\centerline{\includegraphics[width=\textwidth]
		{latex_files/pdf/iptables_rtt.pdf}}
	\caption{Latency test report for Iptables}
	\label{fig:iptables-rtt}
\end{figure}

This behaviour proves that guest Iptables has a better response then host Iptables when high numbers of filtering rules are injected.
This result leads to prefers the Virtual Machines over the physical host if the latency is the metric to be optimized. 
\clearpage

\subsubsection{Bandwidth test}

The following graph shows that the Iptables bandwidth performance degrades as a negative\break exponential line with the number increasing of rules.
It displays that the bandwidth goes down quickly with a little amount of entry in the Iptables data structure for both of the OSs.
The differences between them starts to be marked after 250 rules when the two lines diverge until reach more than 250 MB/s of difference at ten thousand rules.

\hfill
\begin{figure}[H]
	\centerline{\includegraphics[width=\textwidth]
		{latex_files/pdf/iptables_bandwidth.pdf}}
	\caption{Latency test report for Iptables}
	\label{fig:iptables-bandwidth}
\end{figure}

This behaviour proves that guest Iptables has a better response then host Iptables when high numbers of filtering rules are injected.
This result leads to prefers the Virtual Machines over the physical host if the bandwidth is the metric to be optimized.
\clearpage

\subsubsection{CPU consumption}

The following chart shows that the Iptables CPU consumption performance degrade as a straight line with the number increasing of rules, but unlike the latency trend, this one highlight that OSs has different behaviour also with a little number of rules.

\hfill
\begin{figure}[H]
	\centerline{\includegraphics[width=\textwidth]
		{latex_files/pdf/iptables_cpu.pdf}}
	\caption{Latency test report for Iptables}
	\label{fig:iptables-cpu}
\end{figure}

This behaviour proves that guest Iptables has a better response then host Iptables when high numbers of filtering rules are injected.
This result leads to prefers the Virtual Machines over the physical host if the CPU consumption is the metric to be optimized.