Skip site navigation (1)Skip section navigation (2)
Date:      Sun, 21 Jun 2015 08:38:04 -0400
From:      Ian FREISLICH <ian.freislich@capeaugusta.com>
To:        Milan Obuch <freebsd-pf@dino.sk>
Cc:        freebsd-pf@freebsd.org
Subject:   Re: Large scale NAT with PF - some weird problem
Message-ID:  <E1Z6eVg-0000yz-Ar@clue.co.za>
In-Reply-To: <20150621133236.75a4d86d@zeta.dino.sk>
References:  <20150621133236.75a4d86d@zeta.dino.sk> <20150620182432.62797ec5@zeta.dino.sk> <20150619091857.304b707b@zeta.dino.sk> <14e119e8fa8.2755.abfb21602af57f30a7457738c46ad3ae@capeaugusta.com> <E1Z6dHz-0000uu-D8@clue.co.za>

next in thread | previous in thread | raw e-mail | index | archive | help
Milan Obuch wrote:
> On Sun, 21 Jun 2015 07:19:51 -0400
> Ian FREISLICH <ian.freislich@capeaugusta.com> wrote:
> 
> > Milan Obuch wrote:
> > > Ian FREISLICH <ian.freislich@capeaugusta.com> wrote:
> > > 
> > > > How many NAT states in your table?
> > > 
> > > How can I find out? Is there another statistics collected I can gert
> > > out of pfctl?
> > 
> > pfctl -s nat -v
> > 
> > Ian
> > 
> 
> My nat rule evaluates into 12 nat 'paragraphs' in this listing,
> totalling around 19500 states, plus 4 small nat's with one state, plus
> 50 binat's with total 1000 states approx.

That's not many states.

> One observation, on pfctl -vs info output - when src-limit counters
> rises to 30 or so, I am getting first messages someone has problem. Is
> it only coincidence or is there really some relation to my problem?

Perhaps.  These are the options I had set.  You probably don't want
the if-bound one.

# Options
# ~~~~~~~
set timeout { \
        adaptive.start  900000, \
        adaptive.end    1800000 \
        }
set block-policy return
set state-policy if-bound
set optimization normal
set ruleset-optimization basic
set limit states 1500000
set limit frags 40000
set limit src-nodes 150000

--- /etc/sysctl.conf ---
net.inet.ip.fastforwarding=1
---

I also had some other settings regarding interrupt moderation on
the NIC, netisr threads, queue depth and dispatch.  I disabled
entropy harvesting on interrupts, and the network path.  Some of
these settings are loader.conf settings, some are runtime sysctls.

I still think that if it's possible, you should give 10-STABLE a
try.

Ian

-- 
Ian Freislich



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?E1Z6eVg-0000yz-Ar>