Date: Sat, 03 Mar 2007 07:53:39 +0600 From: "Sergey N. Romanov" <sr@innter.net> To: freebsd-pf@freebsd.org Subject: PF performance problems Message-ID: <45E8D523.9010205@innter.net>
next in thread | raw e-mail | index | archive | help
Hello,
We have PF-related problems on our FreeBSD 6.2 server. This is
web-server and we have large problems even with not so much requests
amount (may be if more than 100-200/second) - we can't ping host, can't
make any connection to host and etc. We can solved this problem only
after PF restart (from console). Of course if requests amount the same
then we have problem again immediately.
I have made some tests...
With disabled firewall "http_load -parallel 200 -seconds 60 urls" can
make 4500 requests per second. No any problems with ping and etc.
Then I have created simple (as I think) PF config
ext_if = "em1"
set skip on lo0
set skip on em0
set block-policy return
block in log from any to any
block out log from any to any
pass in on $ext_if proto tcp from any to any port 80 flags S/SA keep state
pass in quick on $ext_if proto udp from any to any keep state
pass in quick on $ext_if proto icmp from any to any keep state
pass out on $ext_if proto tcp from any to any flags S/SA modulate state
pass out on $ext_if proto { udp, icmp } from any to any keep state
and with this config http_load can make only about 75 requests per
second :-((
With logging I can't see that any requests are blocked by block rule and
I can see that passed amount is equal to amount in http_load report.
Why we have this problem? Where to search for problem?
--
Best regards
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?45E8D523.9010205>