postfwd - version differences
Author: jpk
Description: postfwd version differences
Keywords: postfwd, postfwd version differences, postfwd usage, postfwd manual, postfix, policy, policy delegation, firewall, postfix acl, postfix acls, pfwpolicy, postfw, restrictions, IT-Security, IT-Consulting, Jan, Peter, Kessler

# postfwd1 vs postfwd2

With release of postfwd3 2.00 this question has become obsolete. There is only one version of postfwd. Please look at the manpage for the --personality, --v1 and --v2 options!
As you might have noticed, there are two different versions of postfwd available - postfwd(1) and postfwd2. Which version fits best for you depends on your setup. Both versions use the same ruleset parser*. They also share the basic command line arguments (use both with --help for details). This allows to switch easily between them.
The following table might help you to decide which version to use. Basically you should stick with postfwd1 for the moment unless you encounter performance issues with dns based checks or very complex rulesets with thousands of checks. Please note that, due to implementation, rate limits are handled faster by postfwd1 at the moment. If performance really matters and you use a complex ruleset with rate limits and lots of dns based checks you should consider running two instances at different ports/sockets: postfwd1 for the rate limits and postfwd2 for the rest.

Version | postfwd1 | postfwd2
--- | --- | ---
Specs | Single process (Multiplexer) Default port: tcp/10040 Small memory footprint | Multiple processes (Preforker) Default port: tcp/10045 Scales with multiple cpus/cores Builtin watchdog function Debug classes
Usage | Fits for most setups Any single core system Rate-limit-only rulesets | High throughput setups with lots of requests per second and rulesets that use a lot of dnsbl lookups really huge rulesets containing tons of checks
- *Issues |  | postfwd2 versions below 1.30 do not support multiple rate limits for the same item:
      # reject on 300+ connections/hour, warn at 200+
      id=R01; client_address=1.2.3.4; action=rate(client_address/300/3600/REJECT state RED)
      id=R02; client_address=1.2.3.4; action=rate(client_address/200/3600/WARN state YELLOW)