Date: Fri, 9 Nov 2012 09:54:18 +0400 From: Gleb Smirnoff <glebius@FreeBSD.org> To: "Anders N." <wicked@baot.se> Cc: freebsd-questions@FreeBSD.org, freebsd-pf@FreeBSD.org Subject: Re: pf synproxy slowdown Message-ID: <20121109055418.GU84182@FreeBSD.org> In-Reply-To: <20121109054016.GA76137@baot.se> References: <20121109054016.GA76137@baot.se>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Nov 09, 2012 at 05:40:16AM +0000, Anders N. wrote: A> Hi. I've got a server running pf that has been displaying some odd (at least to me) behavior. A> A> I use the "synproxy state"[1] option quite a few times in my config without any ill effects that I've noticed until now. I realized it was on every open port except for ssh, so I added it to my ssh line: A> A> pass in on $ext_if proto tcp from any to $IP port 22 flags S/SA synproxy state A> A> After doing so, scp/sftp/rsync have all slowed down to a crawl! I get ~1/4th the speed I usually do from the server with it enabled there. Remove it, speed goes back to normal. I'm using synproxy state with some other other services that send large amounts of data very quickly (http, torrents, etc) and none of them exhibit this slowdown, so I'm wondering why scp is so slow with it. Here's the rest of my pf.conf, if it matters: This is because synproxy module doesn't know which TCP extensions does the backend TCP stack supports, thus announces none to the remote peer. Connection created via synproxy rule will not support neither window scaling, nor SACK, nor timestamps. Obviously, this results in bad performance. -- Totus tuus, Glebius.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20121109055418.GU84182>