From owner-freebsd-current@FreeBSD.ORG  Mon Sep  6 11:08:16 2010
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 4BA071065696
	for <freebsd-current@freebsd.org>; Mon,  6 Sep 2010 11:08:16 +0000 (UTC)
	(envelope-from randy@psg.com)
Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:1::36])
	by mx1.freebsd.org (Postfix) with ESMTP id 2F6738FC2A
	for <freebsd-current@freebsd.org>; Mon,  6 Sep 2010 11:08:16 +0000 (UTC)
Received: from localhost ([127.0.0.1] helo=rmac.psg.com.psg.com)
	by ran.psg.com with esmtp (Exim 4.72 (FreeBSD))
	(envelope-from <randy@psg.com>)
	id 1OsZYa-0005Rh-Lw; Mon, 06 Sep 2010 11:08:12 +0000
Date: Mon, 06 Sep 2010 20:08:12 +0900
Message-ID: <m2wrqzgmeb.wl%randy@psg.com>
From: Randy Bush <randy@psg.com>
To: Ian FREISLICH <ianf@clue.co.za>
In-Reply-To: <E1OsXO0-00017U-Fa@clue.co.za>
References: <4C84A44D.90403@3mail4.co.uk> <4C825094.5040204@secover.com.br>
	<20100905155311.GA48095@onelab2.iet.unipi.it>
	<4C84364D.9070700@DataIX.net> <E1OsXO0-00017U-Fa@clue.co.za>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/22.3 Mule/5.0 (SAKAKI)
MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka")
Content-Type: text/plain; charset=US-ASCII
Cc: freebsd-current@freebsd.org
Subject: Re: significantly slow IPFW + NATD + amd64 
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Sep 2010 11:08:16 -0000



Ian FREISLICH wrote:
> 
> Peter Reo Molnar wrote:
> > Hello,
> > 
> > I tried setup NAT with IPFW, compiled my kernel and I found that there 
> > is very slow connection.
> > After I disabled NAT and IPFW then speed was increased.
> > 
> > 64-bit FreeBSD 9-CURRENT :
> > With IPFW: 1.2 MB/sec
> > Without IPFW: 33 MB/sec
> > 
> > 
> > my ipfw work with i386 (stable) without speed decreasing:
> > 
> > fw.test.conf:
> > -f flush
> > add 00050 divert 8668 ip4 from any to any via re0
> > add 00100 allow ip from any to any via lo0
> > add 00200 deny ip from any to 127.0.0.0/8
> > add 00300 deny ip from 127.0.0.0/8 to any
> 
> This looks like you're using the old style NAT - divert to userland.
> That has always performed poorly.  Perhaps not as poorly as this
> though.  How much CPU is natd consuming?
> 
> Have you considered using in-kernel NAT?  See the 'NETWORK ADDRESS
> TRANSLATION' section in the ipfw manual.  It's worth a try.

i never managed to figure out how to convert my pppoe nat config to ipfw
natting.

    foo:
     set device PPPoE:vr0
     set MTU 1454
     accept CHAP
     enable lqr
     add default HISADDR
     nat enable yes
     nat port tcp 192.168.0.33:51332 51332
     nat port udp 192.168.0.33:51332 51332
     set authname blogovitch
     set authkey vitchoblog

    loop:
     set log phase chat connect lcp ipcp command
     set device localhost:pptp
     set dial
     set login
     set ifaddr 192.168.0.200 192.168.0.201 255.255.255.255

clue bat solicited

randy