Date: Wed, 12 Sep 2012 23:09:27 -0500 From: Soren Dreijer <dreijer+bsd@echobit.net> To: freebsd-ipfw@freebsd.org Subject: Significant network latency when using ipfw and in-kernel NAT Message-ID: <CALoZf3hfZDQQ4ZEXMrGUkYiGvb5QPoAcbpUikAq1adqVY4fLyg@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Hi there, We're running freebsd 9.0-RELEASE on a box whose primary purpose is to act as a firewall and a gateway. Up until today, we've been using ipfw in conjunction with natd and the divert action in ipfw to forward packets between the freebsd box (i.e. the public Internet) and our private servers. Unfortunately, natd appears to be quite the CPU hog and we therefore decided to switch to the in-kernel NAT support in ipfw. The issue we're running in to is that the network latency appears to be skyrocketing when ipfw contains nat rules. Basically all TCP traffic originating from the box times out and pinging google.com on the box gives an average of ~10 SECONDS -- and that's even if I explicitly allow all ICMP traffic before the packets even get to the nat rules in ipfw. The really odd part, however, is that I can ping the freebsd box just fine externally. For instance, pinging the server from my home connection gives an average of 45 ms. I'm also able to communicate just fine with the internal servers through the freebsd box. Does anybody have any idea what's going on? I assume I must've misconfigured something big here... Thanks, Soren Dreijer
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CALoZf3hfZDQQ4ZEXMrGUkYiGvb5QPoAcbpUikAq1adqVY4fLyg>