"How much bandwidth can PF handle?"
There are no easy answers to those questions.
For a simple home connection, most hardware should be more than enough.
Other applications may require a faster machine with high-end NICs.
PF is used in some very large, high-traffic applications, and the developers
are power users of PF.
Odds are it will do very well for you.
"How much computing power do I need to handle my Internet connection?"
PF performance is determined by several variables:
- Number of packets per second.
Almost the same amount of processing needs to be done on a packet with
1500 byte payload as for a packet with a one byte payload.
The number of packets per second determines the number of times the state
table and filter rules have to be evaluated every second, determining
the effective demand on the system.
- Efficiency of your network card.
Some network adapters are just more efficient than others.
Older rl(4) NICs tend to be
relatively poor performers, while
ix(4) NICs tend to perform
- Complexity and design of your ruleset.
More lines being evaluated for each packet will result in slower
More packets being filtered by quick rules will result in
- Barely worth mentioning: CPU and RAM.
As PF is a kernel-based process, it will not use swap space.
So, if you have enough RAM, it runs, if not, it panics due to
Huge amounts of RAM are not needed.
Will multiple processors help?
PF will only use one processor, so multiple processors (or multiple cores)
WILL NOT improve PF performance.
However, under some circumstances, running the SMP version of OpenBSD
(bsd.mp) instead of bsd will give better performance
due to differences in how interrupt handling is done.
If you are seeing performance problems, experiment with this.
Most users will never hit any limits to worry about it.