Date: Sat, 23 Dec 2017 03:15:40 +0700 From: Eugene Grosbein <eugen@grosbein.net> To: Michael Grimm <trashcan@ellael.org>, freebsd-net@freebsd.org, freebsd-jail@FreeBSD.org Subject: Re: performance issue within VNET jail Message-ID: <5A3D67EC.6010907@grosbein.net> In-Reply-To: <8C8A172B-4D4F-4066-8B94-EF5F59E2D345@ellael.org> References: <4F5EE3F6-0163-4435-8726-56B0D4AE9FAF@ellael.org> <B6446660-9FD2-4C28-A3A2-8AC99624C7FF@sigsegv.be> <8102F5FD-DCFC-4EF8-A443-9E6C9EB1F467@ellael.org> <DB5DE737-7171-4953-AF98-45F1BE7AF09E@sigsegv.be> <8C8A172B-4D4F-4066-8B94-EF5F59E2D345@ellael.org>
next in thread | previous in thread | raw e-mail | index | archive | help
23.12.2017 2:11, Michael Grimm wrote: > Kristof Provost <kristof@sigsegv.be> wrote: > >> I run a very similar setup (although on CURRENT), and see no performance issues from my jails. > > In utter despair I did upgrade one server to CURRENT (#327076) today, but that hasn't been successful :-( > > Ok, right now I do know: > > (#) there is *no* performance loss (TCP) when: > > (-) fetching files from outside through PF/extIF to host > (-) fetching files from partner server host via IPSEC tunnel bound to extIF (ESP) to host > (-) fetching files from partner server host via IPSEC tunnel bound to extIF (ESP) to jail via bridge > (-) fetching files from partner server jail via bridge and then via IPSEC tunnel bound to extIF (ESP) to host > (-) fetching files from partner server jail via bridge and then via IPSEC tunnel bound to extIF (ESP) and then via bridge to jail > > (#) there is a *dramatic* performance loss (TCP) when: > > (-) fetching files from outside through PF/extIF via bridge to jail > > (#) I did try to tweak the following settings *without* success: > > (-) sysctl net.inet.tcp.tso=0 > (-) sysctl net.link.bridge.pfil_onlyip=0 > (-) sysctl net.link.bridge.pfil_bridge=0 > (-) sysctl net.link.bridge.pfil_member=0 > (-) reducing mtu to 1400 (1490 before) on all interfaces extIF, bridge, epairXs > (-) deactivating "scrub in all" and "scrub out on $extIF all random-id" in /etc/pf.conf > (-) setting "set require-order yes" and "set require-order no" in /etc/pf.conf [1] > > [1] I do see more a lot of out-of-order packages within a jail "netstat -s -p tcp" after those slow downloads, but not after downloads via IPSEC tunnel from partner host. > > That leads me to the conclusions: > > (#) the bridge is not to blame > (#) it's either the PF/NATing or something else, right? > > Thanks for your suggestions so far, but I am lost here. Any ideas? It seems to me some kind of bug in the PF. I personally never tried it, I use ipfw and it works just fine. Maybe, you should try to switch to it too, at least for a test.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5A3D67EC.6010907>