From owner-freebsd-pf@FreeBSD.ORG Sun Jun 21 17:58:05 2015 Return-Path: Delivered-To: freebsd-pf@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id BF81BE25 for ; Sun, 21 Jun 2015 17:58:05 +0000 (UTC) (envelope-from freebsd-pf@dino.sk) Received: from mailhost.netlabit.sk (mailhost.netlabit.sk [84.245.65.72]) (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 55B8C3F6 for ; Sun, 21 Jun 2015 17:58:04 +0000 (UTC) (envelope-from freebsd-pf@dino.sk) Received: from zeta.dino.sk (fw1.dino.sk [84.245.95.252]) (AUTH: LOGIN milan) by mailhost.netlabit.sk with ESMTPA; Sun, 21 Jun 2015 19:57:54 +0200 id 00EB08DC.5586FB22.00017FD7 Date: Sun, 21 Jun 2015 19:57:53 +0200 From: Milan Obuch To: Ian FREISLICH Cc: freebsd-pf@freebsd.org Subject: Re: Large scale NAT with PF - some weird problem Message-ID: <20150621195753.7b162633@zeta.dino.sk> In-Reply-To: References: <20150621133236.75a4d86d@zeta.dino.sk> <20150620182432.62797ec5@zeta.dino.sk> <20150619091857.304b707b@zeta.dino.sk> <14e119e8fa8.2755.abfb21602af57f30a7457738c46ad3ae@capeaugusta.com> X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.27; i386-portbld-freebsd10.1) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Jun 2015 17:58:05 -0000 On Sun, 21 Jun 2015 08:38:04 -0400 Ian FREISLICH wrote: [ snip ] > > One observation, on pfctl -vs info output - when src-limit counters > > rises to 30 or so, I am getting first messages someone has problem. > > Is it only coincidence or is there really some relation to my > > problem? > > Perhaps. These are the options I had set. You probably don't want > the if-bound one. > Well, it hit me again, and I am not sure there is any relation. Anyway, I tried pfctl -F with various classes, even all, but nothing helped. Only after /etc/rc.d/pf restart affected clients begun to work again. > # Options > # ~~~~~~~ > set timeout { \ > adaptive.start 900000, \ > adaptive.end 1800000 \ > } > set block-policy return > set state-policy if-bound > set optimization normal > set ruleset-optimization basic > set limit states 1500000 > set limit frags 40000 > set limit src-nodes 150000 > > --- /etc/sysctl.conf --- > net.inet.ip.fastforwarding=1 > --- > I think I have set it up similarly. I think there could be some bug hitting me, but no idea how to check and what. > I also had some other settings regarding interrupt moderation on > the NIC, netisr threads, queue depth and dispatch. I disabled > entropy harvesting on interrupts, and the network path. Some of > these settings are loader.conf settings, some are runtime sysctls. > > I still think that if it's possible, you should give 10-STABLE a > try. > This will take some time to do. Unfortunatelly, I did not think about possibilities to test various version when the system was installed. My bad. Now it is not easy, but I am trying to find usable way to do it. Regards, Milan