Firewall Rule Estimator
Estimate the number of firewall rules needed to cover a matrix of sources, destinations and services.
Inputs
Time to evaluate one rule against one packet (linear ACL lookup)
Worst-Case Latency Added
0.2500ms
Average-Case Latency Added
0.1250ms
Max Throughput (single lookup path)
4,000pps
CPU Time Budget Used
2,500.00%
Step by step
Values used
Number of Firewall Rules = 500; Average Packet Rate = 100,000 packets/sec; Processing Time per Rule = 0.5000 µs
Worst-case latency added
latency_added_ms = rule_count × time_per_rule_us / 1000
Maximum throughput
max_throughput_pps = 1,000,000 / (rule_count × time_per_rule_us)
Worst-Case Latency Added
= 0.2500 ms
Average-Case Latency Added
= 0.1250 ms
Max Throughput (single lookup path)
= 4,000 pps
CPU Time Budget Used
= 2,500.00
How it works
Firewalls that evaluate rules linearly (as opposed to using hardware TCAM or hash-based lookups) check each incoming packet against rules in order until a match is found. Worst-case latency assumes every packet is checked against all rules (e.g. it falls through to a default-deny at the bottom); average-case assumes a match occurs halfway through the list. This directly caps the theoretical maximum packet throughput a single processing path can sustain, since processing time compounds with rule count.
Formulas
Worst-case latency added
latency_added_ms = rule_count × time_per_rule_us / 1000
- n
- Number of rules
- t
- Processing time per rule in microseconds
Maximum throughput
max_throughput_pps = 1,000,000 / (rule_count × time_per_rule_us)
Frequently Asked Questions
Why does rule order matter for firewall performance?
In a linear rule-evaluation model, packets that match rules near the top of the list are processed faster than those matching near the bottom (or not at all, falling through to a default rule). Placing frequently-matched rules earlier reduces average processing time.
How do modern firewalls avoid this linear-scan bottleneck?
Many hardware and high-performance software firewalls use TCAM (ternary content-addressable memory), hash tables, or optimized rule-set compilation (e.g. building a decision tree) so lookup time is closer to constant regardless of rule count, rather than growing linearly with the number of rules.
What's a realistic processing time per rule?
It varies widely by platform: software-based linear ACL checks might take 0.1-1 microsecond per rule on modern CPUs, while purpose-built ASICs with TCAM can evaluate an entire rule set in near-constant time regardless of count.
What happens if packet rate exceeds max throughput?
The firewall becomes a bottleneck — packets queue up, latency spikes, and if buffers fill, packets get dropped. This is why rule-set size and lookup algorithm matter for high-throughput links, not just for security correctness.