Date: Sun, 25 Oct 2015 20:33:53 +0000 From: James Lodge <James@Lodge.me.uk> To: "freebsd-net@freebsd.org" <freebsd-net@freebsd.org> Subject: Re: Jail - PF - NAT - Network Performance Message-ID: <VI1PR06MB1037207FCDF66129B8582912F9240@VI1PR06MB1037.eurprd06.prod.outlook.com> In-Reply-To: <BB154E57-A6B2-49D7-9EEA-8AEAE1134C75@FreeBSD.org> References: <VI1PR06MB1037187D07A9C500B3E4E791F9240@VI1PR06MB1037.eurprd06.prod.outlook.com> <DF61454E-408E-432F-8822-39353632CA90@FreeBSD.org> <VI1PR06MB10378E0DC73518F6A4571531F9240@VI1PR06MB1037.eurprd06.prod.outlook.com>, <BB154E57-A6B2-49D7-9EEA-8AEAE1134C75@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
> On 25 Oct 2015, at 18:47, James Lodge <James@Lodge.me.uk> wrote:
>
>> On 25 Oct 2015, at 17:46, James Lodge <James@Lodge.me.uk> wrote:
>> I currently have a FreeBSD 10.1 host running on Digital Ocean. I have mu=
ltiple jails and I'm not using vimage.
>>
>>
>> I'm using PF on the host to NAT traffic from said jails and all is worki=
ng as expected. I have a jail running OpenVPN and clients can connect and t=
raffic is routed to the Internet down the tunnel via PF/NAT. The issue I'm =
seeing is download speeds to the client from the Internet on the external s=
ide on PF. Upload always seem reasonable, but download is always woeful. I'=
m using a Windows machine as the client if that make any odds.
>>
>> Yeah, there=1B$B!G=1B(Bs an issue with checksums and pf/Xen.
>> Disabling TSO should work for you (sudo sysctl net.inet.tcp.tso=3D0), an=
d the problem should be completely fixed in the >next release (10.3 or 11.0=
)
>>
>> Regards,
>> Kristof
>
>
> Thanks Kristof for the quick reply,
>
> I was hoping it would be that simple, but Digital Ocean use KVM (from wha=
t I know) as their hypervisor so disabling TSO and LRO seems to have no not=
iced increase in performance.
>
>Can you run a tcpdump while you=1B$B!G=1B(Bre seeing the problem?
>The issue I know about is related to the TCP checksum, so I=1B$B!G=1B(Bd e=
xpect to see many invalid checksums.
>
>Regards,
>Kristof
There are discussions/threads regarding KVM/TSO with the same symptoms, but=
I would expect to see the same poor performance through PF be it local or =
remotely via OpenVPN, but I don't. Local I see perfect performance in and o=
ut from the host and jails. =20
Running wireshark locally on the windows client and downloading from the In=
ternet via PF, I see a lot of retransmissions and duplicate ACKs.=20
28 0.824146000 80.249.99.148 10.8.0.10 TCP 1422 [TCP Retransmission] 80=1B$=
B"*=1B(B57292 [ACK] Seq=3D9577 Ack=3D1 Win=3D14 Len=3D1368
33 0.872164000 10.8.0.10 80.249.99.148 TCP 66 [TCP Dup ACK 29#1] 57292=1B$B=
"*=1B(B80 [ACK] Seq=3D1 Ack=3D13681 Win=3D256 Len=3D0 SLE=3D15049 SRE=3D164=
17
I don't see any retransmissions or duplicate ACKs when downloading from the=
web server jail via its private IP down the tunnel.=20
if I run tcpdump i tun0 -n at the same time as seen the retransmissions and=
duplicate ACKS I get.....
20:26:58.567017 IP 10.8.0.10.60339 > 80.249.99.148.80: Flags [.], ack 43776=
0, win 256, options [nop,nop,sack 1 {440496:443232}], length 0
20:26:58.568680 IP 80.249.99.148.80 > 10.8.0.10.60339: Flags [.], seq 43776=
0:439128, ack 1, win 14, length 1368
20:26:58.580530 IP 10.8.0.10.60339 > 80.249.99.148.80: Flags [.], ack 43912=
8, win 256, options [nop,nop,sack 1 {440496:443232}], length 0
20:26:58.585141 IP 80.249.99.148.80 > 10.8.0.10.60339: Flags [.], seq 44323=
2:444600, ack 1, win 14, length 1368
20:26:58.596466 IP 10.8.0.10.60339 > 80.249.99.148.80: Flags [.], ack 43912=
8, win 256, options [nop,nop,sack 1 {440496:444600}], length 0
Regards
James=20
=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?VI1PR06MB1037207FCDF66129B8582912F9240>