* Florin Andrei <florin@andrei.myip.org> [2007-10-05 03:55]:
quoted text
> The hardware is AMD64, Tyan Transport, 2 CPUs 2 cores each. I am using the 
> SMP kernel. The network card is Intel Pro/1000 PCI Express 4x dual gigabit 
> port, it carries both em0 and em1.

First, you want to run 4.2 or -current, that shoudl about double your 
throughput.
then, an i386 kernel should perform considerably better than amd64 for 
firewalling/routing/...
next, you don't want SMP for such tasks. take out the second CPU and 
give it to somebody who can use it, and run the uniprocessor kernel.
last, increase net.inet.ip.ifq.maxlen until you see the congestion 
counter not increasing much any more under load. should not exceed 2500 
by too much. as a rule of thumb, 256 per gigE interface aren't too far 
off.

-- 
Henning Brauer, hb@bsws.de, henning@openbsd.org
BS Web Services, http://bsws.de
Full-Service ISP - Secure Hosting, Mail and DNS Services
Dedicated Servers, Rootservers, Application Hosting - Hamburg & Amsterdam