Date: Sun, 21 Jun 2015 19:57:53 +0200 From: Milan Obuch <freebsd-pf@dino.sk> To: Ian FREISLICH <ian.freislich@capeaugusta.com> Cc: freebsd-pf@freebsd.org Subject: Re: Large scale NAT with PF - some weird problem Message-ID: <20150621195753.7b162633@zeta.dino.sk> In-Reply-To: <E1Z6eVg-0000yz-Ar@clue.co.za> References: <20150621133236.75a4d86d@zeta.dino.sk> <20150620182432.62797ec5@zeta.dino.sk> <20150619091857.304b707b@zeta.dino.sk> <14e119e8fa8.2755.abfb21602af57f30a7457738c46ad3ae@capeaugusta.com> <E1Z6dHz-0000uu-D8@clue.co.za> <E1Z6eVg-0000yz-Ar@clue.co.za>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, 21 Jun 2015 08:38:04 -0400
Ian FREISLICH <ian.freislich@capeaugusta.com> wrote:
[ snip ]
> > One observation, on pfctl -vs info output - when src-limit counters
> > rises to 30 or so, I am getting first messages someone has problem.
> > Is it only coincidence or is there really some relation to my
> > problem?
>
> Perhaps. These are the options I had set. You probably don't want
> the if-bound one.
>
Well, it hit me again, and I am not sure there is any relation. Anyway,
I tried pfctl -F with various classes, even all, but nothing helped.
Only after /etc/rc.d/pf restart affected clients begun to work again.
> # Options
> # ~~~~~~~
> set timeout { \
> adaptive.start 900000, \
> adaptive.end 1800000 \
> }
> set block-policy return
> set state-policy if-bound
> set optimization normal
> set ruleset-optimization basic
> set limit states 1500000
> set limit frags 40000
> set limit src-nodes 150000
>
> --- /etc/sysctl.conf ---
> net.inet.ip.fastforwarding=1
> ---
>
I think I have set it up similarly. I think there could be some bug
hitting me, but no idea how to check and what.
> I also had some other settings regarding interrupt moderation on
> the NIC, netisr threads, queue depth and dispatch. I disabled
> entropy harvesting on interrupts, and the network path. Some of
> these settings are loader.conf settings, some are runtime sysctls.
>
> I still think that if it's possible, you should give 10-STABLE a
> try.
>
This will take some time to do. Unfortunatelly, I did not think about
possibilities to test various version when the system was installed. My
bad. Now it is not easy, but I am trying to find usable way to do it.
Regards,
Milan
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150621195753.7b162633>