Tempesta FW is a high performance open source Linux application deliverycontroller (ADC). The project is built into the Linux TCP/IP stack to getmaximum performance for normal Web content delivery and efficient trafficfiltering for volumetric DDoS mitigation. I'll start by considering a simple example of how to build an ADC usingtraditional open source software. I'll describe drawbacks of the approach andwhy we started Tempesta FW's development. Next I'll go into the projectinternals and conclude the presentation with Tempesta FW performancebenchmarks and several examples. Application delivery controllers (ADCs) are typically hardware appliances thataccelerate Web content delivery, intelligently balance loads among upstreamservers, employ QoS and traffic shaping to efficiently and elegantly mitigateDDoS on all network layers, and provide Web application firewalling andapplication performance monitoring. However, it seems there are no open sourceprojects that are able to perform these tasks with comparable performance andaccuracy. In this presentation I'll describe Tempesta FW - a high performance, opensource Linux application delivery controller. The project is built into theLinux TCP/IP stack to get maximum performance for normal Web content deliveryand efficient traffic filtering for volumetric DDoS mitigation. I'll start by considering a simple example of an installation of Nginx,Fail2Ban, and IPtables. Alternative configurations containing other opensource projects will be covered as well. I'll describe why such configurationsusually do a poor job, and why we started Tempesta FW's development. Next I'll describe how Tempesta FW services HTTP requests, and how the HTTPlayer works with low-layer filter logic. There are several HTTP load-balancingstrategies, including flexible distribution of requests by almost any HTTPfield and predictive strategy by monitoring application performance. Severaltechnologies at the basis of Tempesta FW's performance will also be covered: * Linux TCP/IP stack optimizations for efficient HTTP proxying * stateless HTTP parsing and using AVX2 instruction set to efficiently process HTTP strings * lightweight in-memory database, TempestaDB, based on a cache-conscious lock-free data structure used for servicing a web cache I'll conclude with Tempesta FW performance benchmarks and show severalinstallation and configuration examples.