NAT gateway is an important network system in today's IPv4 network when translating a private IPv4 address to a public address. However, traditional NAT system based on Linux Netfilter cannot achieve high network throughput to meet modern requirements such as data centers. To address this challenge, we improve the network performance of NAT system by three ways. First, we leverage DPDK to enable polling and zero-copy delivery, so as to reduce the cost of interrupt and packet copies. Second, we enable multiple CPU cores to process in parallel and use lock-free hash table to minimize the contention between CPU cores. Third, we use hash search instead of sequential search when looking up the NAT rule table. Evaluation shows that our Quick NAT system significantly improves the performance of NAT on commodity platforms.
翻译:NAT网关是当今IPv4网络中一个重要的网络系统,在将私人IPv4地址转换为公共地址时,它是一个重要网络系统。然而,基于Linux Netfilter的传统NAT系统无法达到满足数据中心等现代要求的高网络输送量。为了应对这一挑战,我们以三种方式改进NAT系统的网络性能。首先,我们利用DPDK来进行投票和零副本交付,以减少中断和包装副本的费用。第二,我们使多个CPU核心能够平行地处理并使用无锁散列表来尽量减少CPU核心之间的争议。第三,我们在寻找NAT规则表时使用搜索而不是顺序搜索。评估显示,我们的快速NAT系统大大改善了商品平台上NAT的性能。