Estimate the number of firewall rules needed to cover a matrix of sources, destinations and services.
Firewalls that evaluate rules linearly (as opposed to using hardware TCAM or hash-based lookups) check each incoming packet against rules in order until a match is found. Worst-case latency assumes every packet is checked against all rules (e.g. it falls through to a default-deny at the bottom); average-case assumes a match occurs halfway through the list. This directly caps the theoretical maximum packet throughput a single processing path can sustain, since processing time compounds with rule count.
Worst-case latency added
latency_added_ms = rule_count × time_per_rule_us / 1000
Maximum throughput
max_throughput_pps = 1,000,000 / (rule_count × time_per_rule_us)
In a linear rule-evaluation model, packets that match rules near the top of the list are processed faster than those matching near the bottom (or not at all, falling through to a default rule). Placing frequently-matched rules earlier reduces average processing time.
Many hardware and high-performance software firewalls use TCAM (ternary content-addressable memory), hash tables, or optimized rule-set compilation (e.g. building a decision tree) so lookup time is closer to constant regardless of rule count, rather than growing linearly with the number of rules.
It varies widely by platform: software-based linear ACL checks might take 0.1-1 microsecond per rule on modern CPUs, while purpose-built ASICs with TCAM can evaluate an entire rule set in near-constant time regardless of count.
The firewall becomes a bottleneck — packets queue up, latency spikes, and if buffers fill, packets get dropped. This is why rule-set size and lookup algorithm matter for high-throughput links, not just for security correctness.