From owner-freebsd-ipfw Sat Mar 23 16:45:23 2002 Delivered-To: freebsd-ipfw@freebsd.org Received: from rwcrmhc54.attbi.com (rwcrmhc54.attbi.com [216.148.227.87]) by hub.freebsd.org (Postfix) with ESMTP id 1B9AF37B417 for ; Sat, 23 Mar 2002 16:45:21 -0800 (PST) Received: from blossom.cjclark.org ([12.234.91.48]) by rwcrmhc54.attbi.com (InterMail vM.4.01.03.27 201-229-121-127-20010626) with ESMTP id <20020324004515.QNLL1214.rwcrmhc54.attbi.com@blossom.cjclark.org>; Sun, 24 Mar 2002 00:45:15 +0000 Received: (from cjc@localhost) by blossom.cjclark.org (8.11.6/8.11.6) id g2O0jFn49336; Sat, 23 Mar 2002 16:45:15 -0800 (PST) (envelope-from cjc) Date: Sat, 23 Mar 2002 16:45:15 -0800 From: "Crist J. Clark" To: Tony Saign Cc: freebsd-ipfw@FreeBSD.ORG Subject: Re: Problems after cvsup to 4.5 -stable 3/21 with ipfw Message-ID: <20020323164515.B48968@blossom.cjclark.org> References: <000001c1d289$7641c9a0$1401a8c0@frankenmobl> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <000001c1d289$7641c9a0$1401a8c0@frankenmobl>; from tony@saign.com on Sat, Mar 23, 2002 at 08:40:37AM -0800 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG On Sat, Mar 23, 2002 at 08:40:37AM -0800, Tony Saign wrote: > After a recent cvsup to 4.5 -stable, I noticed my server to be EXTREMLY > sluggish with ipfw enabled. > Web pages hanging indefinately, mail download HORRIBLY slow! > > Turning ipfw off by add 0110 allow tcp from any to any via fxp0, things > return to normal. > > I made no changes to my ruleset listed below. Can anyone offer any > insight/help? (PLEASE!) > > Thanks, > -Tony > > 00100 50 2516 allow ip from any to any via lo0 > 00110 3235 1131435 allow tcp from any to any via fxp0 > 00200 0 0 deny ip from any to 127.0.0.0/8 > 00300 0 0 deny ip from 127.0.0.0/8 to any > 00400 0 0 deny ip from 168.120.0.0/16 to any > 00500 0 0 deny tcp from 168.120.0.0/16 to any > 00600 0 0 deny udp from 168.120.0.0/16 to any > 00700 0 0 allow tcp from any to 216.40.33.39 55000 > 00800 6413 4145842 allow tcp from any to any out established > 00900 120 5801 allow tcp from any to any keep-state out setup > 01000 4591 321384 allow tcp from any to any established The 'keep-state' in 900 is totally pointless. Although off of the top of my head, I can't see a reason why this would be slowing you down, do you get better performance with that 'keep-state' gone? -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message